docs(encryption): Stage 7a-2 proposed - storage-layer registration enforcement#843

Merged

bootjp merged 10 commits into

mainfrom

feat/encryption-7a2-storage-layer-enforcement

May 26, 2026

Commits on May 26, 2026

docs(encryption): Stage 7a-2 proposed - storage-layer registration enforcement
bootjp
committed
docs(encryption): 7a-2 design round-1 - per-DEK registered signal, deadlock mitigation, centralized retry
bootjp
committed
docs(encryption): 7a-2 design round-2 - resolve claude P1/P2 (startup order, both-close-sites, encryptForKey signature, runtime paths)
bootjp
committed
docs(encryption): 7a-2 design round-3 - correct ExpireAt call-site (claude P1) + DeletePrefix note (P2)
bootjp
committed
docs(encryption): 7a-2 design round-4 - sync §4/§5 with §2.1/§2.2 (atomic.Uint32, ExpireAt, OQ closure)
bootjp
committed
docs(encryption): 7a-2 design round-5 - P3 polish (field name, MD040 fence, current-vs-future callers)
bootjp
committed
docs(encryption): 7a-2 - correct direct-path ApplyMutations caller inventory
bootjp
committed
docs(encryption): 7a-2 - correct SplitRange call-path (not a direct-write caller)
bootjp
committed
docs(encryption): 7a-2 - mark §1 table admin-snapshot/migration as future callers
bootjp
committed
docs(encryption): 7a-2 - seed Registered() on the already-registered restart path
bootjp
committed