- The Data Protection keychain rejects writes (-34018) without a keychain-access-groups entitlement and reads return null, so the old read-only-on-throw fallback never fired (#6)
- Use the classic login keychain on macOS, verify writes by reading back, and let the fallback copy win until it can be moved into secure storage
- Treat null from secure storage as 'no secret' instead of an error; add tests with a fake store reproducing the failure
- Document the pitfall in AGENTS.md

Co-authored-by: Cursor <cursoragent@cursor.com>