# Native locked-keyring catalog evidence

Captured 2026-10-22, isolated test only. Actual T3 Code desktop app, Electron 44.9.3, Chromium 152.0.7977.167, GNOME Secret Service login collection, Xvfb/Openbox/private DBus. No production source edits by test agent. No live T3 data used.

## Source and binaries

- Before source: 97d8e3e6cc61efa14ef342afe1c2d8348fd6f7d0.
- Before main.cjs SHA256: bb145654bb64c2723c8d645d88b73361ea0da12cfb74f416e0c2fd1f8f6b816b.
- Baseline recording ran an archived a0dc6d6410e6e72ca836a97bc322931206d8ed75 build. That commit differs from 97d8e3e6cc only in ElectronSafeStorage.test.ts. Rebuilding with the 97d8e3e6cc desktop source produced exactly the same binary SHA256 above. This is binary equivalence, not a claim the recording originally ran at the earlier source checkout.
- After source: 386a88ddd8d6e98d1527d17bd5933fe1bc70c06c.
- After main.cjs SHA256: b5b417930176e34b300926fcf9a35511d7fce62db340198f82b696128612abd8.
- Web/server built with vp run --filter @t3tools/desktop build; committed after desktop rebuilt with vp pack. Earlier build raced with implementation and was excluded as independent before/after evidence.

## Results

1. Additional raw Electron boundary probe, cold async initialization, real locked keyring, cancelled prompt: selected backend gnome_libsecret, async availability true, sync availability false, encryptStringAsync('non-secret probe') returns v10. PBKDF2-SHA1 peanuts/saltysalt (1 iteration, 16 bytes), AES-128-CBC with 16 spaces IV decrypts to the exact non-secret probe.
2. Actual baseline T3 main-process registered desktop:set-connection-catalog handler invoked through main inspector: cancelled real unlock prompt; returned true; persisted catalog prefix v10; same known key decrypts exact non-secret catalog probe. Main inspector answered while pending at 5967ms.
3. Actual committed fixed T3 handler: cancelled unlock prompts; returned DesktopConnectionCatalogStoreProtectionError, operation encrypt-catalog, cause ElectronSafeStorageEncryptError, underlying error 'The keyring fell back to an insecure fixed encryption key.' Existing catalog SHA256 before and after: 50a3319dc307a57febab885cb0d06dea1b6e311ac2d3465efebf6f0c44be9aec. No rewrite.
4. Same initialized fixed process with existing file moved aside: save refused with same typed errors; pristine catalog file absent.
5. During fixed pending prompt, independent main inspector evaluation returned responsive=true at 5480ms, with a visible BrowserWindow; actual renderer executeJavaScript returned document.readyState complete and body width 1100.
6. Native login collection unlocked via Secret Service; fresh fixed process: actual catalog save true, immediate read round trip true, persisted prefix v11, backend gnome_libsecret, async availability true.
7. Valid native catalog re-saved, round trip true, prefix v11. Full app and owned backend restart: catalog plaintext SHA256 matched 78a3e1617c3e73523ffa5ed4b90b2e9cc959f79c04e806944250b5007f01f389.

## Scope and limitations

The catalog boundary is the actual registered app IPC handler, called from the Electron main inspector with a synthetic sender id. It executes the real service and file writer; no safeStorage mock, stub, or substituted encryption. This is not a user clicking a Settings Save button. Recordings show real native prompt interactions and T3 windows; outcome captions summarize measured inspector/file results and are not app UI. The isolated client sometimes shows Still connecting while catalog initialization is pending. Main/renderer evaluation proves responsiveness, not a frame-rate benchmark. The first arbitrary-string restart assertion failed because the renderer replaced an invalid catalog; the corrected valid-catalog restart check passed. No evidence from the older fdee head is relabeled here.

Public allowlist: index.md, before.png, after.png, before-cancel-save.mp4, after-cancel-save.mp4 only. Private raw logs, catalogs, environment configuration, and keyring files excluded.