Ingest integrity + sessionKey hardening, plus the gold-standard review pass from the last round now shipped. Driven by an independent go-reviewer pass (twice — once on the new features, once re-reviewing the fix for what it found).
Added
- Write-side SHA-256 manifest — first half of the native MemPalace ingest handshake. Every export write now records its SHA-256 in
outDir/.content-hashes.json, saved per-file (not batched) so an interrupted harvest never loses a hash for a file already on disk. Only the write side ships here — the read-back verification (a re-hash from MemPalace's own store, reported as an X/Y scorecard) needs a change in the separate mempalace-src ingest pipeline and stays open. - sessionKey/master-key zero-hardening. The raw AES master key and raw decrypted sessionKey plaintext are now explicitly zeroed (
zeroBytes, deferred) the moment their last read completes, narrowing (not closing — the returned string is still held for the session by design) the window covered by SECURITY.md's existing memory-forensics caveat.
Fixed (from the prior gold-standard review round)
- Gated autostart, chrome-profile single-instance race fix, residue-free uninstall (
cleanup-temp, pre-install sweep). - Installer: dark-panel rendering, Back button, license localization — visually re-verified this release against the actual compiled installer.
- CI: Windows PATH now inherited into the MSYS2 race-job shell.
docs/how-it-works.svg: OBSERVE box text was overflowing its border — widened the box instead of shrinking the font.
Known, deliberately deferred gap: the new SHA-256 manifest's cross-process locking only covers goroutines within one process — two schroedinger-sync.exe instances sharing an outDir (this tool's own supported supervise+manual-harvest combination) can still race a lost update. Currently inert (nothing reads the manifest yet); documented rather than rushed, matching this repo's existing precedent for .sync-state.json's identical unaddressed gap.
Full details in CHANGELOG.md.