H-03: stateLock fence around state mutations; lock() sync-callable via ReentrantLock

@@ -17,6 +17,7 @@1717 import kotlinx.serialization.json.JsonPrimitive1818 import java.util.Base641919 import java.util.UUID20+import java.util.concurrent.locks.ReentrantLock2021 import javax.inject.Inject2122 import javax.inject.Singleton2223 @@ -64,8 +65,26 @@6465     private val store: VaultStorage,6566 ) {6667     private val mutex = Mutex()68+    // H-03: lock() and requireUnlocked() cannot take [mutex] from non-suspend69+    // callers (ProcessLifecycleOwner, ViewModels, VaultLockTimer). This sync70+    // lock guards ONLY the brief read/write of derivedKey/rootKey/entryList so71+    // lock() can serialize against an in-flight suspend op without blocking on72+    // Argon2id or store I/O. Suspend ops hold [mutex] for their full body and73+    // take [stateLock] only around the state-write portions. Acquisition order74+    // is always mutex → stateLock.75+    private val stateLock = ReentrantLock()6776     private val rng = SecureRandom()6877 78+    /**79+     * Run [block] with [stateLock] held. Used to fence the small state-write80+     * portions of suspend operations against [lock] and [requireUnlocked]81+     * racing from another thread.82+     */83+    private inline fun <T> mutateState(block: () -> T): T {84+        stateLock.lock()85+        return try { block() } finally { stateLock.unlock() }86+    }87+6988     private var derivedKey: ByteArray? = null7089     private var rootKey: ByteArray? = null7190     private var entryList: MutableList<VaultEntry> = mutableListOf()@@ -259,12 +278,14 @@259278         return try {260279             val salt = VaultCrypto.generateSalt()261280             val key = VaultCrypto.deriveKey(password, salt)262-            entryList = mutableListOf()263-            duressConfigured = false264-            recoveryWordHash = null265-            recoveryWordsSet = false266-            decoyMode = false267-            rootKey = generateRecoverableRootKey()281+            mutateState {282+                entryList = mutableListOf()283+                duressConfigured = false284+                recoveryWordHash = null285+                recoveryWordsSet = false286+                decoyMode = false287+                rootKey = generateRecoverableRootKey()288+            }268289             val slotA = sealSlotA(key, salt)269290             if (!store.writeSlotA(slotA)) return CreateVaultResult.Error("storage_write_failed")270291             // P1-3 (codex): every later step must roll the slot pair back if it@@ -281,9 +302,11 @@281302                 false282303             }283304             if (!created) return CreateVaultResult.Error("storage_write_failed")284-            derivedKey = key285-            publish()286-            _isUnlocked.value = true305+            mutateState {306+                derivedKey = key307+                publish()308+                _isUnlocked.value = true309+            }287310             CreateVaultResult.Success288311         } catch (e: Exception) {289312             CreateVaultResult.Error(e.message ?: "create_failed")@@ -333,17 +356,19 @@333356 334357             val previousDerivedKey = derivedKey335358             val previousRootKey = rootKey336-            derivedKey = nextDerivedKey337-            rootKey = sessionRootKey338-            nextDerivedKey = null339-            sessionRootKey = null340-            entryList = mutableListOf()341-            duressConfigured = false342-            recoveryWordHash = null343-            recoveryWordsSet = false344-            decoyMode = false345-            publish()346-            _isUnlocked.value = true359+            mutateState {360+                derivedKey = nextDerivedKey361+                rootKey = sessionRootKey362+                nextDerivedKey = null363+                sessionRootKey = null364+                entryList = mutableListOf()365+                duressConfigured = false366+                recoveryWordHash = null367+                recoveryWordsSet = false368+                decoyMode = false369+                publish()370+                _isUnlocked.value = true371+            }347372             previousDerivedKey?.let(VaultCrypto::zero)348373             previousRootKey?.let(VaultCrypto::zero)349374             AdoptVaultResult.Success(vaultId)@@ -438,17 +463,19 @@438463     /** Adopt a derived slot-A [key]/[payload] as the live (real-vault) session. */439464     private fun adoptSlotA(key: ByteArray, payload: VaultPayload): UnlockResult {440465         return try {441-            derivedKey = key442-            decoyMode = false443-            entryList = payload.entries.toMutableList()444-            duressConfigured = payload.duressConfigured445-            recoveryWordHash = payload.recoveryWordHash446-            recoveryWordsSet = payload.recoveryWordsSet447-            _settings.value = store.loadSettings()448-            ensureRootKey(payload)449-            autoPurgeExpiredTrash()450-            publish()451-            _isUnlocked.value = true466+            mutateState {467+                derivedKey = key468+                decoyMode = false469+                entryList = payload.entries.toMutableList()470+                duressConfigured = payload.duressConfigured471+                recoveryWordHash = payload.recoveryWordHash472+                recoveryWordsSet = payload.recoveryWordsSet473+                _settings.value = store.loadSettings()474+                ensureRootKey(payload)475+                autoPurgeExpiredTrash()476+                publish()477+                _isUnlocked.value = true478+            }452479             UnlockResult.Success453480         } catch (e: Exception) {454481             UnlockResult.Error(e.message ?: "unlock_failed")@@ -528,17 +555,19 @@528555     /** Adopt a derived [DuressUnlock] as a live decoy session (edits persist to slot B only). */529556     suspend fun commitDuressUnlock(unlock: DuressUnlock): UnlockResult = mutex.withLock {530557         return try {531-            derivedKey = unlock.key532-            decoyMode = true533-            entryList = unlock.payload.entries.toMutableList()534-            duressConfigured = false535-            recoveryWordHash = unlock.payload.recoveryWordHash536-            recoveryWordsSet = unlock.payload.recoveryWordsSet537-            rootKey = if (unlock.payload.rootKeyB64.isNotBlank()) unb64(unlock.payload.rootKeyB64)538-                      else VaultCrypto.generateRootKey()539-            _settings.value = store.loadSettings()540-            publish()541-            _isUnlocked.value = true558+            mutateState {559+                derivedKey = unlock.key560+                decoyMode = true561+                entryList = unlock.payload.entries.toMutableList()562+                duressConfigured = false563+                recoveryWordHash = unlock.payload.recoveryWordHash564+                recoveryWordsSet = unlock.payload.recoveryWordsSet565+                rootKey = if (unlock.payload.rootKeyB64.isNotBlank()) unb64(unlock.payload.rootKeyB64)566+                          else VaultCrypto.generateRootKey()567+                _settings.value = store.loadSettings()568+                publish()569+                _isUnlocked.value = true570+            }542571             UnlockResult.Success543572         } catch (e: Exception) {544573             UnlockResult.Error(e.message ?: "decoy_unlock_failed")@@ -555,7 +584,9 @@555584      * Requires the real vault to be unlocked and not itself a decoy session.556585      */557586     suspend fun setDuressPassphrase(duressPassphrase: String): Boolean = mutex.withLock {558-        if (derivedKey == null || decoyMode) return false587+        // H-03: read derivedKey/decoyMode atomically with any concurrent lock().588+        val unlockedAndReal = mutateState { derivedKey != null && !decoyMode }589+        if (!unlockedAndReal) return false559590         // Reject a duress passphrase that also opens the real vault: it would make the560591         // lock screen ambiguous (both slots would decrypt for the same input).561592         tryUnlockSlotA(duressPassphrase)?.let { discardSlotAUnlock(it); return false }@@ -570,7 +601,7 @@570601             VaultCrypto.zero(plaintext)571602             val ok = store.writeDecoySlot(StoredVault(version = 1, salt = b64(salt), blob = blob))572603             if (ok) {573-                duressConfigured = true604+                mutateState { duressConfigured = true }574605                 runCatching { persistSlotA(bumpVersion = false) }575606             }576607             ok@@ -582,8 +613,11 @@582613     /** Tear down the duress vault: drop slot B and the duress flag on the real payload. */583614     suspend fun clearDuress(): Boolean = mutex.withLock {584615         store.clearDecoySlot()585-        if (derivedKey != null && !decoyMode) {586-            duressConfigured = false616+        // H-03: stateLock-fence the derivedKey/decoyMode read AND the617+        // duressConfigured write so a concurrent lock() cannot land between them.618+        val shouldClear = mutateState { derivedKey != null && !decoyMode }619+        if (shouldClear) {620+            mutateState { duressConfigured = false }587621             runCatching { persistSlotA(bumpVersion = false) }588622         }589623         true@@ -596,17 +630,19 @@596630             val payload = VaultCodec.decode(597631                 VaultCrypto.decrypt(unb64(slotA.blob), key, VaultCrypto.AAD_SLOT_A),598632             )599-            derivedKey = key.copyOf()600-            decoyMode = false601-            entryList = payload.entries.toMutableList()602-            duressConfigured = payload.duressConfigured603-            recoveryWordHash = payload.recoveryWordHash604-            recoveryWordsSet = payload.recoveryWordsSet605-            _settings.value = store.loadSettings()606-            ensureRootKey(payload)607-            autoPurgeExpiredTrash()608-            publish()609-            _isUnlocked.value = true633+            mutateState {634+                derivedKey = key.copyOf()635+                decoyMode = false636+                entryList = payload.entries.toMutableList()637+                duressConfigured = payload.duressConfigured638+                recoveryWordHash = payload.recoveryWordHash639+                recoveryWordsSet = payload.recoveryWordsSet640+                _settings.value = store.loadSettings()641+                ensureRootKey(payload)642+                autoPurgeExpiredTrash()643+                publish()644+                _isUnlocked.value = true645+            }610646             UnlockResult.Success611647         } catch (_: Exception) {612648             UnlockResult.WrongPassword@@ -614,17 +650,26 @@614650     }615651 616652     fun lock() {617-        derivedKey?.let(VaultCrypto::zero)618-        rootKey?.let(VaultCrypto::zero)619-        derivedKey = null620-        rootKey = null621-        entryList = mutableListOf()622-        duressConfigured = false623-        recoveryWordHash = null624-        recoveryWordsSet = false625-        decoyMode = false626-        _entries.value = emptyList()627-        _isUnlocked.value = false653+        // H-03: must observe derivedKey/entryList atomically with any in-flight654+        // suspend op (an addEntry mid-encrypt, an unlock adopting the payload,655+        // etc.). mutex cannot be acquired from this non-suspend caller; stateLock656+        // guards just the brief state reset.657+        stateLock.lock()658+        try {659+            derivedKey?.let(VaultCrypto::zero)660+            rootKey?.let(VaultCrypto::zero)661+            derivedKey = null662+            rootKey = null663+            entryList = mutableListOf()664+            duressConfigured = false665+            recoveryWordHash = null666+            recoveryWordsSet = false667+            decoyMode = false668+            _entries.value = emptyList()669+            _isUnlocked.value = false670+        } finally {671+            stateLock.unlock()672+        }628673     }629674 630675     @Volatile private var suppressNextBackgroundLock = false@@ -765,19 +810,37 @@765810      * [mutex].766811      */767812     private suspend fun installRootKey(nextRootKey: ByteArray): Boolean {768-        val key = derivedKey ?: return false769-        if (decoyMode) return false770-        val priorSlot = store.loadSlotA() ?: return false771-        val priorRootKey = rootKey ?: return false772-        val priorRecoveryHash = recoveryWordHash773-        val priorRecoverySet = recoveryWordsSet813+        // H-03: snapshot the live fields under stateLock so the success and the814+        // rollback paths both see consistent prior/new state. Writing the new815+        // rootKey/recovery fields is inside its own mutateState at the end.816+        // H-03 (P1-3 codex): the snapshot must COPY the live key/rootKey arrays817+        // — holding live references would let a zero-on-failure operation also818+        // wipe the session's still-live key arrays.819+        data class Snapshot(820+            val key: ByteArray,821+            val priorRootKey: ByteArray,822+            val priorRecoveryHash: String?,823+            val priorRecoverySet: Boolean,824+        )825+        val snap = mutateState {826+            val k = derivedKey ?: return false827+            if (decoyMode) return false828+            val priorRoot = rootKey ?: return false829+            Snapshot(k.copyOf(), priorRoot.copyOf(), recoveryWordHash, recoveryWordsSet)830+        } as Snapshot? ?: return false831+        val priorSlot = store.loadSlotA() ?: run {832+            VaultCrypto.zero(snap.priorRootKey)833+            return false834+        }774835         val nextWords = rootKeyToWords(nextRootKey)775836 776837         return try {777838             takeVaultSnapshot("local_save")778-            rootKey = nextRootKey779-            recoveryWordHash = recoveryWordsHash(nextWords)780-            recoveryWordsSet = false839+            mutateState {840+                rootKey = nextRootKey841+                recoveryWordHash = recoveryWordsHash(nextWords)842+                recoveryWordsSet = false843+            }781844 782845             val nextRecoveryEscrow = buildRecoveryEscrow(nextWords)783846                 ?: throw IllegalStateException("recovery_escrow_failed")@@ -785,7 +848,7 @@785848                 ?: throw IllegalStateException("root_escrow_failed")786849             val plaintext = VaultCodec.encode(currentPayload())787850             val blob = try {788-                b64(VaultCrypto.encrypt(plaintext, key, VaultCrypto.AAD_SLOT_A))851+                b64(VaultCrypto.encrypt(plaintext, snap.key, VaultCrypto.AAD_SLOT_A))789852             } finally {790853                 VaultCrypto.zero(plaintext)791854             }@@ -802,13 +865,15 @@802865                 store.writeSlotA(priorSlot)803866                 throw e804867             }805-            VaultCrypto.zero(priorRootKey)806-            publish()868+            VaultCrypto.zero(snap.priorRootKey)869+            mutateState { publish() }807870             true808871         } catch (_: Exception) {809-            rootKey = priorRootKey810-            recoveryWordHash = priorRecoveryHash811-            recoveryWordsSet = priorRecoverySet872+            mutateState {873+                rootKey = snap.priorRootKey874+                recoveryWordHash = snap.priorRecoveryHash875+                recoveryWordsSet = snap.priorRecoverySet876+            }812877             VaultCrypto.zero(nextRootKey)813878             store.writeSlotA(priorSlot)814879             false@@ -857,9 +922,14 @@857922             // key while matching disk on the new one.858923             val priorB = store.loadSlotB()859924             if (!commitVaultRotation(slotA, priorB, next)) return false860-            VaultCrypto.zero(oldKey); oldKey = null861-            derivedKey?.let(VaultCrypto::zero)862-            derivedKey = newKey; newKey = null925+            // H-03 (P1-2 codex): zero the OLD live key and assign the NEW one926+            // inside the same stateLock critical section, so a concurrent lock()927+            // can't observe the in-between (zeroed but not yet reassigned).928+            mutateState {929+                oldKey?.let(VaultCrypto::zero); oldKey = null930+                derivedKey?.let(VaultCrypto::zero)931+                derivedKey = newKey; newKey = null932+            }863933             true864934         } catch (_: Exception) {865935             false@@ -892,8 +962,13 @@892962             modifiedAt = stamp,893963             passwordChangedAt = if (!draft.password.isNullOrEmpty()) stamp else draft.passwordChangedAt,894964         ))895-        val rollback = entryList.toMutableList()896-        entryList.add(entry)965+        // H-03: capture rollback AND write entryList under stateLock so a966+        // concurrent lock() cannot zero the session between the read and the write.967+        val rollback = mutateState {968+            val r = entryList.toMutableList()969+            entryList.add(entry)970+            r971+        }897972         persistOrRollback(rollback)898973         entry899974     }@@ -910,57 +985,69 @@910985     suspend fun addEntries(drafts: List<VaultEntry>): Int = mutex.withLock {911986         requireUnlocked()912987         if (drafts.isEmpty()) return 0913-        val rollback = entryList.toMutableList()914988         val now = System.currentTimeMillis()915-        for (draft in drafts) {989+        val ready = drafts.map { draft ->916990             val stamp = VaultCrypto.monotonicEntryTimestamp()917-            entryList.add(918-                withDerivedLast4(919-                    draft.copy(920-                        id = draft.id.ifBlank { UUID.randomUUID().toString() },921-                        createdAt = if (draft.createdAt > 0) draft.createdAt else now,922-                        modifiedAt = stamp,923-                        passwordChangedAt = if (!draft.password.isNullOrEmpty()) stamp else draft.passwordChangedAt,924-                    ),991+            withDerivedLast4(992+                draft.copy(993+                    id = draft.id.ifBlank { UUID.randomUUID().toString() },994+                    createdAt = if (draft.createdAt > 0) draft.createdAt else now,995+                    modifiedAt = stamp,996+                    passwordChangedAt = if (!draft.password.isNullOrEmpty()) stamp else draft.passwordChangedAt,925997                 ),926998             )927999         }1000+        // H-03: capture rollback AND append every entry under stateLock.1001+        val rollback = mutateState {1002+            val r = entryList.toMutableList()1003+            entryList.addAll(ready)1004+            r1005+        }9281006         persistOrRollback(rollback)9291007         return drafts.size9301008     }9311009 9321010     suspend fun updateEntry(patch: VaultEntry): VaultEntry = mutex.withLock {9331011         requireUnlocked()934-        val idx = entryList.indexOfFirst { it.id == patch.id }935-        if (idx == -1 || entryList[idx].deletedAt != null) throw IllegalStateException("entry_not_found")936-        val current = entryList[idx]937-        val stamp = VaultCrypto.monotonicEntryTimestamp(current.modifiedAt)938-        // Only refresh passwordChangedAt when the password value actually changes.939-        val passwordChanged = patch.password != null && patch.password != current.password940-        // Capture the outgoing password (newest first) so the user can reveal/copy/941-        // restore it later. History is computed authoritatively from `current`, not942-        // the patch — updateEntry is a full-entry replace, so trusting patch's value943-        // would let a stale form clobber the real history. Record the age the old944-        // password carried, skip an empty prior, and skip an immediate exact dupe945-        // (e.g. restore-then-restore). Capped at PASSWORD_HISTORY_MAX.946-        val priorPassword = current.password947-        val shouldCapture = passwordChanged &&948-            !priorPassword.isNullOrEmpty() &&949-            current.passwordHistory?.firstOrNull()?.password != priorPassword950-        val nextHistory = if (shouldCapture) {951-            (listOf(PasswordHistoryItem(priorPassword!!, current.passwordChangedAt ?: current.createdAt)) +952-                (current.passwordHistory ?: emptyList())).take(PASSWORD_HISTORY_MAX)953-        } else {954-            current.passwordHistory1012+        // H-03: read entryList, compute the patched entry, and write it under a1013+        // single stateLock so a concurrent lock() cannot interleave between the1014+        // lookup and the assignment (would IndexOutOfBoundsException on a shrunk1015+        // list, or clobber the entry onto the wrong id after a relock).1016+        var prepared: Pair<VaultEntry, MutableList<VaultEntry>>? = null1017+        mutateState {1018+            val idx = entryList.indexOfFirst { it.id == patch.id }1019+            if (idx == -1 || entryList[idx].deletedAt != null) throw IllegalStateException("entry_not_found")1020+            val current = entryList[idx]1021+            val stamp = VaultCrypto.monotonicEntryTimestamp(current.modifiedAt)1022+            // Only refresh passwordChangedAt when the password value actually changes.1023+            val passwordChanged = patch.password != null && patch.password != current.password1024+            // Capture the outgoing password (newest first) so the user can reveal/copy/1025+            // restore it later. History is computed authoritatively from `current`, not1026+            // the patch — updateEntry is a full-entry replace, so trusting patch's value1027+            // would let a stale form clobber the real history. Record the age the old1028+            // password carried, skip an empty prior, and skip an immediate exact dupe1029+            // (e.g. restore-then-restore). Capped at PASSWORD_HISTORY_MAX.1030+            val priorPassword = current.password1031+            val shouldCapture = passwordChanged &&1032+                !priorPassword.isNullOrEmpty() &&1033+                current.passwordHistory?.firstOrNull()?.password != priorPassword1034+            val nextHistory = if (shouldCapture) {1035+                (listOf(PasswordHistoryItem(priorPassword!!, current.passwordChangedAt ?: current.createdAt)) +1036+                    (current.passwordHistory ?: emptyList())).take(PASSWORD_HISTORY_MAX)1037+            } else {1038+                current.passwordHistory1039+            }1040+            val updated = withDerivedLast4(patch.copy(1041+                createdAt = current.createdAt,1042+                modifiedAt = stamp,1043+                passwordChangedAt = if (passwordChanged) stamp else current.passwordChangedAt,1044+                passwordHistory = nextHistory,1045+            ))1046+            val rollback = entryList.toMutableList()1047+            entryList[idx] = updated1048+            prepared = updated to rollback9551049         }956-        val updated = withDerivedLast4(patch.copy(957-            createdAt = current.createdAt,958-            modifiedAt = stamp,959-            passwordChangedAt = if (passwordChanged) stamp else current.passwordChangedAt,960-            passwordHistory = nextHistory,961-        ))962-        val rollback = entryList.toMutableList()963-        entryList[idx] = updated1050+        val (updated, rollback) = prepared!!9641051         persistOrRollback(rollback)9651052         updated9661053     }@@ -968,50 +1055,67 @@9681055     /** Soft-delete: writes a tombstone whose timestamp beats any in-flight edit. */9691056     suspend fun deleteEntry(id: String) = mutex.withLock {9701057         requireUnlocked()971-        val idx = entryList.indexOfFirst { it.id == id }972-        if (idx == -1 || entryList[idx].deletedAt != null) throw IllegalStateException("entry_not_found")973-        val current = entryList[idx]974-        val stamp = VaultCrypto.monotonicEntryTimestamp(current.modifiedAt)975-        val rollback = entryList.toMutableList()976-        entryList[idx] = current.copy(deletedAt = stamp, modifiedAt = stamp)977-        persistOrRollback(rollback)1058+        // H-03: lookup + tombstone write under stateLock so lock() cannot shrink1059+        // the list out from under the indexOfFirst.1060+        var rollback: MutableList<VaultEntry>? = null1061+        mutateState {1062+            val idx = entryList.indexOfFirst { it.id == id }1063+            if (idx == -1 || entryList[idx].deletedAt != null) throw IllegalStateException("entry_not_found")1064+            val current = entryList[idx]1065+            val stamp = VaultCrypto.monotonicEntryTimestamp(current.modifiedAt)1066+            rollback = entryList.toMutableList()1067+            entryList[idx] = current.copy(deletedAt = stamp, modifiedAt = stamp)1068+        }1069+        persistOrRollback(rollback!!)9781070     }9791071 9801072     suspend fun restoreEntry(id: String) = mutex.withLock {9811073         requireUnlocked()982-        val idx = entryList.indexOfFirst { it.id == id && it.deletedAt != null }983-        if (idx == -1) throw IllegalStateException("deleted entry not found")984-        val current = entryList[idx]985-        val rollback = entryList.toMutableList()986-        entryList[idx] = current.copy(deletedAt = null, modifiedAt = VaultCrypto.monotonicEntryTimestamp(current.modifiedAt))987-        persistOrRollback(rollback)1074+        var rollback: MutableList<VaultEntry>? = null1075+        mutateState {1076+            val idx = entryList.indexOfFirst { it.id == id && it.deletedAt != null }1077+            if (idx == -1) throw IllegalStateException("deleted entry not found")1078+            val current = entryList[idx]1079+            rollback = entryList.toMutableList()1080+            entryList[idx] = current.copy(deletedAt = null, modifiedAt = VaultCrypto.monotonicEntryTimestamp(current.modifiedAt))1081+        }1082+        persistOrRollback(rollback!!)9881083     }9891084 9901085     /** Permanent delete — no tombstone, no recovery. */9911086     suspend fun purgeEntry(id: String) = mutex.withLock {9921087         requireUnlocked()993-        val idx = entryList.indexOfFirst { it.id == id && it.deletedAt != null }994-        if (idx == -1) throw IllegalStateException("deleted entry not found")995-        val rollback = entryList.toMutableList()996-        entryList.removeAt(idx)997-        persistOrRollback(rollback)1088+        var rollback: MutableList<VaultEntry>? = null1089+        mutateState {1090+            val idx = entryList.indexOfFirst { it.id == id && it.deletedAt != null }1091+            if (idx == -1) throw IllegalStateException("deleted entry not found")1092+            rollback = entryList.toMutableList()1093+            entryList.removeAt(idx)1094+        }1095+        persistOrRollback(rollback!!)9981096     }9991097 10001098     /** Permanently empty the trash — hard-deletes every soft-deleted entry. */10011099     suspend fun purgeDeletedEntries(): Int = mutex.withLock {10021100         requireUnlocked()1003-        val rollback = entryList.toMutableList()1004-        val before = entryList.size1005-        entryList.removeAll { it.deletedAt != null }1006-        val removed = before - entryList.size1007-        if (removed > 0) persistOrRollback(rollback)1008-        removed1101+        // H-03: read+remove under stateLock so lock() can't reorder the remove.1102+        data class R(val rollback: MutableList<VaultEntry>, val removed: Int)1103+        val r = mutateState {1104+            val rollback = entryList.toMutableList()1105+            val before = entryList.size1106+            entryList.removeAll { it.deletedAt != null }1107+            R(rollback, before - entryList.size)1108+        }1109+        if (r.removed > 0) persistOrRollback(r.rollback)1110+        r.removed10091111     }10101112 10111113     /** Browser parity: number of active entries that dedupe would move to trash. */10121114     suspend fun countDuplicateEntries(): Int = mutex.withLock {10131115         requireUnlocked()1014-        countDuplicateEntriesLocked()1116+        // countDuplicateEntriesLocked reads entryList; H-03 fences the read so1117+        // lock() can't race the read with state writes.1118+        mutateState { countDuplicateEntriesLocked() }10151119     }10161120 10171121     /**@@ -1021,26 +1125,32 @@10211125      */10221126     suspend fun deduplicateEntries(): Int = mutex.withLock {10231127         requireUnlocked()1024-        if (decoyMode) throw IllegalStateException("deduplicate disabled in decoy mode")1025-        val active = entryList.filter { it.deletedAt == null }1026-        val keepIds = mutableSetOf<String>()1027-        active.groupBy { it.duplicateKey() }.values.forEach { group ->1028-            keepIds += group.maxBy { it.modifiedAt.takeIf { ts -> ts > 0 } ?: it.createdAt }.id1029-        }1030-1031-        val rollback = entryList.toMutableList()1032-        var removed = 01033-        entryList = entryList.map { entry ->1034-            if (entry.deletedAt == null && entry.id !in keepIds) {1035-                removed++1036-                val stamp = VaultCrypto.monotonicEntryTimestamp(entry.modifiedAt)1037-                entry.copy(deletedAt = stamp, modifiedAt = stamp)1038-            } else {1039-                entry1128+        // H-03: read the decoyMode flag and the entry list, then reassign1129+        // entryList, all under one stateLock.1130+        val decoy = mutateState { decoyMode }1131+        if (decoy) throw IllegalStateException("deduplicate disabled in decoy mode")1132+        data class R(val rollback: MutableList<VaultEntry>, val removed: Int)1133+        val ready = mutateState {1134+            val active = entryList.filter { it.deletedAt == null }1135+            val keepIds = mutableSetOf<String>()1136+            active.groupBy { it.duplicateKey() }.values.forEach { group ->1137+                keepIds += group.maxBy { it.modifiedAt.takeIf { ts -> ts > 0 } ?: it.createdAt }.id10401138             }1041-        }.toMutableList()1042-        if (removed > 0) persistOrRollback(rollback)1043-        removed1139+            val rollback = entryList.toMutableList()1140+            var removed = 01141+            entryList = entryList.map { entry ->1142+                if (entry.deletedAt == null && entry.id !in keepIds) {1143+                    removed++1144+                    val stamp = VaultCrypto.monotonicEntryTimestamp(entry.modifiedAt)1145+                    entry.copy(deletedAt = stamp, modifiedAt = stamp)1146+                } else {1147+                    entry1148+                }1149+            }.toMutableList()1150+            R(rollback, removed)1151+        }1152+        if (ready.removed > 0) persistOrRollback(ready.rollback)1153+        ready.removed10441154     }10451155 10461156     fun getEntries(): List<VaultEntry> = entryList.filter { it.deletedAt == null }@@ -1180,38 +1290,46 @@11801290         val tombMap = remoteTombstones.associate {11811291             it.id to SyncLimits.clampSyncTimestamp(it.deletedAt, mergeNow)11821292         }1183-        var applied = 01184-        val byId = entryList.associateBy { it.id }.toMutableMap()1293+        // H-03: build the new entryList under stateLock so a concurrent lock()1294+        // cannot zero derivedKey/entryList between the byId read and the merge.1295+        val applied = mutateState {1296+            var n = 01297+            val byId = entryList.associateBy { it.id }.toMutableMap()11851298 1186-        for (remote in clamped) {1187-            val tomb = tombMap[remote.id]1188-            if (tomb != null && tomb >= remote.modifiedAt) continue1189-            val local = byId[remote.id]1190-            if (local == null) {1191-                entryList.add(remote); byId[remote.id] = remote; applied++1192-            } else if (remote.modifiedAt > local.modifiedAt) {1193-                val i = entryList.indexOfFirst { it.id == local.id }1194-                if (i != -1) { entryList[i] = remote; byId[remote.id] = remote; applied++ }1299+            for (remote in clamped) {1300+                val tomb = tombMap[remote.id]1301+                if (tomb != null && tomb >= remote.modifiedAt) continue1302+                val local = byId[remote.id]1303+                if (local == null) {1304+                    entryList.add(remote); byId[remote.id] = remote; n++1305+                } else if (remote.modifiedAt > local.modifiedAt) {1306+                    val i = entryList.indexOfFirst { it.id == local.id }1307+                    if (i != -1) { entryList[i] = remote; byId[remote.id] = remote; n++ }1308+                }11951309             }1196-        }11971310 1198-        for ((id, deletedAt) in tombMap) {1199-            val local = byId[id] ?: continue1200-            if (local.deletedAt != null && local.deletedAt >= deletedAt) continue1201-            if (deletedAt < local.modifiedAt) continue1202-            val i = entryList.indexOfFirst { it.id == id }1203-            if (i != -1) { entryList[i] = local.copy(deletedAt = deletedAt, modifiedAt = deletedAt); applied++ }1311+            for ((id, deletedAt) in tombMap) {1312+                val local = byId[id] ?: continue1313+                if (local.deletedAt != null && local.deletedAt >= deletedAt) continue1314+                if (deletedAt < local.modifiedAt) continue1315+                val i = entryList.indexOfFirst { it.id == id }1316+                if (i != -1) { entryList[i] = local.copy(deletedAt = deletedAt, modifiedAt = deletedAt); n++ }1317+            }1318+            n12041319         }12051320 12061321         if (applied > 0) {12071322             persistSlotA(bumpVersion = false, snapshotReason = "sync_received")1208-            publish()1323+            mutateState { publish() }12091324         }12101325         applied12111326     }12121327 12131328     suspend fun updateSettings(settings: VaultSettings) = mutex.withLock {1214-        _settings.value = settings1329+        // _settings is a StateFlow (atomic write), but publish under stateLock so1330+        // any concurrent lock() observes either the old or the new value — not1331+        // ordering with the in-memory entries flip.1332+        mutateState { _settings.value = settings }12151333         store.writeSettings(settings)12161334     }12171335 @@ -1227,8 +1345,12 @@12271345      */12281346     suspend fun setRecoveryWords(words: List<String>): Boolean = mutex.withLock {12291347         requireUnlocked()1230-        recoveryWordHash = recoveryWordsHash(words)1231-        recoveryWordsSet = true1348+        // H-03: hash + escrow-related state fields set under stateLock so a1349+        // concurrent lock() cannot zero them in the middle of buildRecoveryEscrow.1350+        mutateState {1351+            recoveryWordHash = recoveryWordsHash(words)1352+            recoveryWordsSet = true1353+        }12321354         // Seal TWO escrows (MF-1): the browser-byte-compatible root-key escrow12331355         // (cross-platform recovery of the sync root key) and Android's whole-payload12341356         // escrow (offline forgot-password restore of entries). Both derive their key@@ -1275,14 +1397,17 @@12751397             try {12761398                 val plaintext = VaultCrypto.decrypt(unb64(escrow.blob), keyBytes, VaultCrypto.AAD_RECOVERY)12771399                 val payload = VaultCodec.decode(plaintext)1278-                decoyMode = false1279-                entryList = payload.entries.toMutableList()1280-                duressConfigured = payload.duressConfigured1281-                recoveryWordHash = payload.recoveryWordHash1282-                recoveryWordsSet = payload.recoveryWordsSet1283-                rootKey = if (payload.rootKeyB64.isNotBlank()) unb64(payload.rootKeyB64)1284-                          else generateRecoverableRootKey()1285-                _settings.value = store.loadSettings()1400+                // H-03: adoption is one atomic state-write — lock() cannot interleave.1401+                mutateState {1402+                    decoyMode = false1403+                    entryList = payload.entries.toMutableList()1404+                    duressConfigured = payload.duressConfigured1405+                    recoveryWordHash = payload.recoveryWordHash1406+                    recoveryWordsSet = payload.recoveryWordsSet1407+                    rootKey = if (payload.rootKeyB64.isNotBlank()) unb64(payload.rootKeyB64)1408+                              else generateRecoverableRootKey()1409+                    _settings.value = store.loadSettings()1410+                }12861411                 VaultCrypto.zero(plaintext)12871412                 return true12881413             } catch (_: Exception) {@@ -1298,13 +1423,15 @@12981423         // is exactly the browser's recovery semantics (`messages.ts:312-347`).12991424         slotA.rootKeyEscrow?.let { escrow ->13001425             val rk = unsealRootKeyEscrow(words, escrow) ?: return false1301-            decoyMode = false1302-            entryList = mutableListOf()1303-            duressConfigured = false1304-            recoveryWordHash = recoveryWordsHash(words)1305-            recoveryWordsSet = true1306-            rootKey = rk1307-            _settings.value = store.loadSettings()1426+            mutateState {1427+                decoyMode = false1428+                entryList = mutableListOf()1429+                duressConfigured = false1430+                recoveryWordHash = recoveryWordsHash(words)1431+                recoveryWordsSet = true1432+                rootKey = rk1433+                _settings.value = store.loadSettings()1434+            }13081435             return true13091436         }13101437         return false@@ -1323,7 +1450,10 @@13231450         words: List<String>,13241451         newPassword: String,13251452     ): Boolean = mutex.withLock {1326-        if (rootKey == null) return false // must have recovered first1453+        // H-03: read rootKey + entryList under stateLock before computing the new1454+        // plaintext, then re-publish + swap the derived key under stateLock so a1455+        // concurrent lock() cannot straddle the two fences.1456+        if (!mutateState { rootKey != null }) return false13271457         val priorA = store.loadSlotA() ?: return false13281458         var newKey: ByteArray? = null13291459         var plaintext: ByteArray? = null@@ -1350,10 +1480,15 @@13501480             // the session on a key that no longer matches disk.13511481             val priorB = store.loadSlotB()13521482             if (!commitVaultRotation(priorA, priorB, next)) return false1353-            derivedKey?.let(VaultCrypto::zero)1354-            derivedKey = newKey; newKey = null1355-            publish()1356-            _isUnlocked.value = true1483+            // H-03 (P1-2 codex): zero the old live key and install the new one1484+            // inside the same stateLock critical section so a concurrent lock()1485+            // can't observe the in-between.1486+            mutateState {1487+                derivedKey?.let(VaultCrypto::zero)1488+                derivedKey = newKey; newKey = null1489+                publish()1490+                _isUnlocked.value = true1491+            }13571492             true13581493         } catch (_: Exception) {13591494             false@@ -1467,7 +1602,15 @@14671602     // ---- Internals --------------------------------------------------------14681603 14691604     private fun requireUnlocked() {1470-        if (derivedKey == null) throw IllegalStateException("vault_locked")1605+        // H-03: read derivedKey atomically with [lock]'s reset; without it,1606+        // [lock] from a background lifecycle event can run between this read1607+        // and the caller's first state touch.1608+        stateLock.lock()1609+        try {1610+            if (derivedKey == null) throw IllegalStateException("vault_locked")1611+        } finally {1612+            stateLock.unlock()1613+        }14711614     }14721615 14731616     private fun countDuplicateEntriesLocked(): Int {@@ -1697,13 +1840,13 @@16971840     private fun persistOrRollback(rollback: MutableList<VaultEntry>) {16981841         try {16991842             if (!persistSlotA(bumpVersion = true)) {1700-                entryList = rollback1843+                mutateState { entryList = rollback }17011844                 throw IllegalStateException("storage_write_failed")17021845             }17031846         } catch (e: Exception) {1704-            entryList = rollback1847+            mutateState { entryList = rollback }17051848             throw e17061849         }1707-        publish()1850+        mutateState { publish() }17081851     }17091852 }