security(core/R-15): Gate 5 — fence every protected writer and complete inventory/migration readiness

[qnbs]

Program position

Child owner of #445 for R-15 Gate 5 — the largest migration-readiness surface before packaged shadow qualification.

TARGET_RELEASE = v1.30.0
PREDECESSOR = Gate 4 terminal
NO_GAP_INVARIANT = REQUIRED
PRODUCTION_AUTHORITY_SWITCH_ALLOWED = NO

Objective

Make the packaged desktop's full protected-data universe controllable and migratable with no unfenced writer gap.

Before a class's final migration inventory is captured, every current writer of that class must be routed through an admitted fence-participating adapter, deterministically quiesced/disabled for the migration window, or explicitly refused with truthful recovery behavior. Anything else blocks Gate 5 for that class.

Required protected-class coverage

Re-derive from live §3 inventory. At minimum disposition projects/manuscripts, snapshots, settings, images, binder bytes+metadata+asset-pair, Codex, RAG/vector indexes, quarantine/recovery, active-project marker, authority/catalog/epoch/commit metadata, migration journals, packaged WebView/IndexedDB legacy desktop sources, backups per contract boundary, credentials under their approved separate protected authority, and every new protected class added since the contract inventory.

No packaged-desktop PROTECTED class may be silently skipped, treated as harmless plaintext, or left unknown/unmigrated.

Migration proof

capture final fenced inventory
→ convert each admitted source
→ durably write target generation
→ verify envelope/AAD/digest/identity
→ update authenticated catalog/markers
→ retain prior recoverable source until target commit proof
→ only then permit cleanup

Acceptance

• per-class migration/refusal matrix complete;
• every current writer fenced/quiesced/refused;
• all-class fault-injection migration tests;
• no plaintext sibling/remnant outside contract-approved recovery/retention;
• legacy sources preserve-first;
• exact-head/resulting-main proof;
• Gate 5 terminal checkpoint on security(core/R-15): renderer-neutral encrypted desktop storage, durable migration & identity binding #445 and Linear.

Prefer multiple small PRs grouped by coherent data families. Do not force this gate into one oversized PR.

[qnbs]

Linear control-plane mirror

• Linear: QNB-169
• Project: v1.30.0 — Complete Desktop At-Rest Encryption
• Project URL: https://linear.app/qnbs/project/v1300-complete-desktop-at-rest-encryption-1ea741fa2ae5

GitHub remains the implementation/evidence source of truth; Linear tracks sequencing, priority, dependencies and milestone progress.

[qnbs]

Inventory clarifications — 2026-10-01

Two current-source relationships to preserve in Gate 5 planning:

• storage(cache): local AI model caches are not positively ownership-scoped, and Factory Reset leaves them behind #526 / local AI model caches: downloaded model/cache bytes without user content are DERIVED_REGENERABLE under the R-15 contract and have no current native R-15 migration. Explicitly disposition them; do not encrypt/migrate them as PROTECTED merely because they are local.
• desktop(fs): make project-lock recovery crash-safe and reconcile lock-conflict UX #831 / project-lock + Factory Reset race: remains a separate owner, but Gate 5 writer fencing/delete/reset admission must not race a live desktop writer.

Content-bearing inference caches remain PROTECTED if/when native persistence is admitted.

[qnbs]

Carried input from Gate 2 (#920, closed): legacy physical source-locator → RecordIdentity mapping belongs here, per contract §20 item 5 and §15.3 MigrationSourceAdapter. That covers today's snapshot <id>.json (canonical-decimal re-derivation, §5.4), global images, binder .bin/.meta.json pairs, codex/vectors, settings, the active-project marker, and WebView IDB/localStorage sources. Discovery must refuse non-canonical or ambiguously owned locators rather than guess (SOURCE_IDENTITY_UNBOUND / SOURCE_AUTHORITY_CONFLICT). Destination identities and §10.4.1 dispositions already exist in crates/worldscript-secure-storage (RecordIdentity, disposition(), seal_record/open_record, main 91582bbd).