SeedPass/memory-update.md

# Learnings from known-issues-agent run

- Initialized `KNOWN_ISSUES.md` as it was missing.
- Verified that `npm run --prefix torch lint` requires `npm install --prefix torch` to be run first.
- Confirmed that `landing/index.html` no longer contains `innerHTML` violations.
- Confirmed `torch-config.json` correctly defines scheduler handoff commands.
- Consolidated resolved issues into `KNOWN_ISSUES.md` for historical tracking.

# Learnings from test-coverage run

- `artifacts/coverage/coverage.full.json` is useful for choosing high-impact gaps quickly; `src/utils/input_utils.py` was at 25.00% and had no direct tests.
- Added deterministic unit tests for `timed_input` POSIX/Windows dispatch, timeout handling, and backspace behavior without relying on real terminal input.
- Added positive-path tests for `utils/terminal_utils` header/notification rendering to complement existing failure-path tests.
- Focused coverage after changes: `src/utils/input_utils.py` reached 100% and `src/utils/terminal_utils.py` reached 88% in targeted runs.

# Learnings from entry-type verification run

- Added an enum-driven regression suite to verify every `EntryType` value can be added, retrieved, and filtered via `EntryManager`.
- Guard test now asserts `ALL_ENTRY_TYPES` stays in sync with the `EntryType` enum, so introducing a new kind requires explicit test coverage updates.

# Learnings from account roundtrip restore run

- Added end-to-end regression tests for account lifecycle recovery:
  Nostr sync -> local account deletion -> seed-based restore -> entry integrity checks.
- Added parallel lifecycle regression for portable backups:
  export -> local account deletion -> import with seed -> entry integrity checks.
- `PasswordManager` test harnesses that call `sync_vault()` need `state_manager` set (even `None`) to avoid `AttributeError` in `sync_vault_async`.

# Learnings from real-relay roundtrip run

- Added an opt-in `@pytest.mark.network` roundtrip test in `test_nostr_real.py` that uses live relays and validates sync -> delete local index -> seed-based restore.
- Real-relay tests should isolate keyspace per run using a random `account_index` so snapshot queries do not collide with prior runs.
- Relay propagation can be eventual; bounded retry/backoff around `attempt_initial_sync()` improves stability for live network execution.

# Learnings from live relay + portable chain run

- Added an opt-in live test that chains both recovery paths: real-relay sync and portable export/import, then re-syncs and restores again from relays.
- Keeping `fingerprint` + `account_index` consistent across source/import/restore clients preserves deterministic relay identity for end-to-end verification.

# Learnings from nostr-index-size gating update

- `test_nostr_index_size_limits` remains discoverable in test collection but now requires explicit `NOSTR_INDEX_SIZE_E2E=1` to execute.
- This avoids automatic execution in CI desktop jobs while preserving manual E2E stress capability.

# Learnings from 1000-entry live index-size run

- With `NOSTR_INDEX_SIZE_E2E=1`, live relays handled checkpoints up to 1000 entries with successful publish/retrieve at every batch.
- Observed encrypted payload growth is strongly superlinear (about 30 KB at 100 entries to about 4.6 MB at 1000 entries), which is useful for practical relay size planning.

# Learnings from security checklist + threat model kickoff

- Added `docs/security_readiness_checklist.md` with status/owner/evidence fields and explicit exit criteria per security readiness item.
- Started item 1 by drafting `docs/threat_model.md` with scope, assets, trust boundaries, attacker profiles, assumptions, non-goals, and prioritized risks.
- Added five explicit decision gates to complete item 1 (metadata leakage posture, endpoint stance, recovery policy, relay trust posture, release trust chain).

# Learnings from threat model defaults pass

- Added concrete proposed defaults and requirements for all five item-1 decision gates in `docs/threat_model.md`.
- Added a decision approval table so maintainers can formally approve/reject each gate and close item 1 with traceable signoff.

# Learnings from threat model provisional approval

- Applied best-judgment provisional approvals for all five decision gates and recorded them in `docs/threat_model.md`.
- Marked checklist item 1 as `Done` in `docs/security_readiness_checklist.md` with evidence and approval date.

# Learnings from crypto/key-management review kickoff

- Added `docs/crypto_key_management_review.md` and moved checklist item 2 to `In Progress`.
- Identified immediate P0 gaps: PBKDF2 baseline appears low for modern threat levels and Argon2 `time_cost` config is not clearly wired through all active unlock paths.
- Documented prioritized remediation plan and explicit completion criteria for closing item 2.

# Learnings from argon2 wiring remediation

- Added `PasswordManager._derive_seed_key` and related config helpers so seed-key derivation consistently applies configured `kdf_mode` and Argon2 `time_cost`.
- Replaced multiple direct seed-key derivation callsites with the shared helper across setup/unlock/import/password-change flows.
- Added focused tests in `src/tests/test_kdf_modes.py` validating Argon2 `time_cost` propagation and PBKDF2 iteration override behavior.