# Windows catalog recovery proof — PR #20152

Target: [#20152](https://github.com/pingdotgg/t3code/pull/20152).
Candidate head: 24c644b5c7e9692a7674d2f0cd5e176b2d97b67d.
Base: 1451e7cb23034d29774338608368a15d8845df36.

## Observable service behavior

The real catalog service uses real temporary filesystem writes and AES-256-GCM cryptography with synthetic test credentials. Native safeStorage and the Windows key reader are simulated. No real connection credentials or profile keys are included in this artifact.

| Operation | Main implementation | Candidate |
| --- | --- | --- |
| Read stable/Alpha-key catalog when native key differs | Decryption fails | Authenticated recovery succeeds |
| Write before get with existing stable-key catalog | Uses native key; prior reader loses access | Uses the key authenticating the existing catalog |
| Replace recovered catalog with Alpha/current-key catalog, then write | No matching-key recovery | Selects the key for the replacement document |
| Write after replacing a recovered catalog with unreadable data | No recovery/write-authentication guard | Refuses and preserves bytes |

The main-file substitution produced 4 expected failing store cases and 10 passing cases. Removing only write authentication produced the expected failure when malformed JSON was overwritten. Removing the pre-native short-frame guard reached a native mock that aborts on truncated input. An exact-header mutation also failed its retained framing assertion. All mutations were restored.

## Validation

- Four focused suites: 35 cases before test consolidation; 34 after, then 35 on the final candidate with one new stalled-lookup behavior case. Store suite: 15→14→15; PR-specific cases: six repeated matrix rows→five distinct cases plus one timeout behavior case. No new test file.
- Existing suites: DesktopConnectionCatalogStore, DesktopUserData, DesktopPreReadyFileSystem, ChromiumKeys.
- Desktop typecheck, targeted lint and formatting passed.
- Real crypto authenticates stable and Alpha recovery, fresh nonce writes, matching-key decryptability, and tampered-tag rejection. Profile key and token fixture bytes remain unchanged.
- Recovery is packaged-Windows only. Native success, new catalogs and representative non-Windows behavior retain existing paths.

Each legacy key lookup has a ten-second cancellation deadline. A deterministic TestClock/Deferred regression proves interruption of a stalled first candidate, recovery through healthy Alpha, and original native error plus byte preservation when both candidates stall. Removing the timeout causes an expected assertion failure without hanging. Scoped native process cleanup is retained and awaited; a hard wall-clock bound for Windows cleanup was not verified.

## Limits

This is service/test-level Linux proof, not a running native Windows app. No native DPAPI/PowerShell execution, safeStorage, packaged startup/upgrade, real profile ACLs, cross-version native decryptability, UI connection recovery or restart persistence was verified. The author's historical Windows evidence does not certify this rebuilt head. Cached key-lookup failures require an app restart after restoring profile keys. The original cause of key divergence is not fixed.

Human approval of production encryption/key recovery remains required before landing. No merge was performed. Screenshots are not applicable to this nonvisual service change.

Tests: GPT-6-Astra (high). Implementation: GPT-6.1-Sol (high), Codex harness through T3 Code.