# Atomic secret publication proof

Target: [#10579](https://github.com/pingdotgg/t3code/pull/10579).
Tested local head: 1a06b7fdbde642cabaa660509b90f1e92c5121f5. Linux, Node 24.

The store writes a private 0600 candidate under the 0700 secrets directory, syncs and closes it, then hard-links the complete candidate to the final name without replacing a concurrent winner. Parent-directory open/sync follows publication. Only Windows EPERM from that directory operation is tolerated; other errors propagate, leaving any published complete bytes intact.

Tests before takeover: 18 expanded cases in two files, 559 lines.
After: 16 expanded cases in the existing suite, 361 lines. The 292-line one-off publication suite was deleted.

Final storage, SessionStore and replayMarkers suites: 45/45 pass. Scoped lint, formatting and server typecheck pass.
The primary independently reran the final 16 storage tests: 16/16 pass.

A real partial write is paused after two bytes using Deferred. While paused, the final secret is absent. A second creator publishes its complete 32-byte winner; both generators receive the same winning bytes. Publication requires that the candidate has synced and closed. Other cases inject partial-write failure, interruption and file-sync failure, then verify no public key or temporary data and a successful retry. Real POSIX mode assertions and duplicate creation preserve the existing winner.

Exact main production, 7e7e6d8240858d19d8e72dbcd0f0117e3d0a7f56, was temporarily substituted and restored byte-for-byte. It fails eight assertions: exposed partial bytes; published partial keys after write failure, interruption or file-sync failure; and four unreported directory durability errors. These are assertion failures, not import errors or timeouts.

The original PoC also failed a newly covered Windows directory-open EPERM case because its exception only wrapped sync. The final head passes. Six selected directory-error cases cover tolerated Windows open/sync EPERM and propagated Windows EIO or Linux EPERM/EIO. Windows platform/errors are injected on Linux; this is not native Windows verification.

Command:
./node_modules/.bin/vp test run apps/server/src/auth/ServerSecretStore.test.ts apps/server/src/auth/SessionStore.test.ts apps/server/src/auth/replayMarkers.test.ts

Tests use isolated temporary directories and real filesystem write, sync, close, hard-link and cleanup operations. No live application data, secrets or credentials are used. This is nonvisual backend behavior; screenshots do not apply.

Limits: native Windows, macOS, Electron, iOS, Android and power-loss behavior remain unverified. The filesystem must support hard links; unsupported-link errors propagate. Scoped cleanup does not guarantee cleanup after process termination or power loss. Windows creation does not promise unsupported directory-flush durability. Human review of authentication persistence is still required.

Tests: GPT-6 Astra / Codex. Implementation and primary verification: GPT-6.1 Sol / Codex in T3 Code.