security(core/R-15): Gate 4 — journal, admission, rekey/recovery and cross-process serialization

[qnbs]

Program position

Child owner of #445 for R-15 Gate 4.

TARGET_RELEASE = v1.30.0
PREDECESSOR = Gate 3 terminal
LEGACY_P0_OWNERS = #359 + #360
PRODUCTION_AUTHORITY_SWITCH_ALLOWED = NO

Objective

Build the durable control plane that makes enable/disable/rotate/migrate operations crash-resumable, race-free and cross-process serialized.

Required state machine

Persist authenticated operation ID/version, source/target epochs, bounded inventory/checkpoints, per-record progress or equivalent cursor, prepared/committed authority generation, recovery-required state, and exact resume/abort/finalize semantics including shutdown/cancellation.

Admission / concurrency

• ordinary protected reads/writes and migration/rekey share one coherent admission model;
• no save/autosave writes into an obsolete epoch after migration passed a record;
• no plaintext legacy read bypasses locked/migrating policy;
• exclusive migration authority for critical phases;
• conflicting processes cannot both perform authority transitions;
• crash/restart deterministically resumes or fails closed;
• exact replays do not duplicate side effects.

Existing P0 reconciliation

• Desktop fs-data key-rotation migration is not crash-resumable (mixed-key state possible) #359 closes through journal/state-machine crash-resumability evidence;
• Desktop fs reads/writes don't participate in the encryption-migration admission lock (race window during disable/rotate) #360 closes through shared admission/fencing evidence;
• Gate 1b's deferred cross-process serialization closes here.

Acceptance

• exhaustive transition + crash-injection tests;
• cross-process/second-instance serialization proof;
• bounded memory/inventory behavior;
• no stranded mixed-key dataset without explicit recoverable state;
• exact-head/resulting-main proof;
• Desktop fs-data key-rotation migration is not crash-resumable (mixed-key state possible) #359/Desktop fs reads/writes don't participate in the encryption-migration admission lock (race window during disable/rotate) #360 dispositions recorded.

Non-goals

• all-class migration (Gate 5);
• packaged shadow qualification (Gate 6);
• production cutover (Gate 7).

[qnbs]

Linear control-plane mirror

• Linear: QNB-168
• Project: v1.30.0 — Complete Desktop At-Rest Encryption
• Project URL: https://linear.app/qnbs/project/v1300-complete-desktop-at-rest-encryption-1ea741fa2ae5

GitHub remains the implementation/evidence source of truth; Linear tracks sequencing, priority, dependencies and milestone progress.

[qnbs]

Related desktop-lock owner — 2026-10-01

Coordinate Gate 4 cross-process serialization/admission with #831. #831 is not an automatic Gate 4 blocker, but Gate 4 must not create a second incompatible native ownership primitive and should reuse/share a trustworthy process-ownership mechanism where the evidence supports it.