cursedbelt 4.0.0 → 4.1.1

package/dist/react/master-lock/MasterLockDialog.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"MasterLockDialog.d.ts","sourceRoot":"","sources":["../../../src/react/master-lock/MasterLockDialog.tsx"],"names":[],"mappings":"AAkBA,OAAO,EACN,KAAK,mBAAmB,EAMxB,MAAM,6BAA6B,CAAC;AAOrC,MAAM,WAAW,qBAAqB;IACrC,IAAI,EAAE,OAAO,CAAC;IACd,GAAG,EAAE,mBAAmB,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC;IACf;;qCAEiC;IACjC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,IAAI,CAAC;IACpB,yFAAyF;IACzF,SAAS,EAAE,MAAM,IAAI,CAAC;IACtB,WAAW,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC;CACtC;AAOD,wBAAgB,gBAAgB,CAAC,EAChC,IAAI,EACJ,GAAG,EACH,MAAM,EACN,SAAS,EACT,OAAO,EACP,SAAS,EACT,WAAW,GACX,EAAE,qBAAqB,+BAiNvB"}
+{"version":3,"file":"MasterLockDialog.d.ts","sourceRoot":"","sources":["../../../src/react/master-lock/MasterLockDialog.tsx"],"names":[],"mappings":"AAkBA,OAAO,EACN,KAAK,mBAAmB,EAKxB,MAAM,6BAA6B,CAAC;AAOrC,MAAM,WAAW,qBAAqB;IACrC,IAAI,EAAE,OAAO,CAAC;IACd,GAAG,EAAE,mBAAmB,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC;IACf;;qCAEiC;IACjC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,IAAI,CAAC;IACpB,yFAAyF;IACzF,SAAS,EAAE,MAAM,IAAI,CAAC;IACtB,WAAW,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC;CACtC;AAOD,wBAAgB,gBAAgB,CAAC,EAChC,IAAI,EACJ,GAAG,EACH,MAAM,EACN,SAAS,EACT,OAAO,EACP,SAAS,EACT,WAAW,GACX,EAAE,qBAAqB,+BAqOvB"}

package/dist/react/master-lock/MasterLockDialog.js

@@ -17,7 +17,7 @@ import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
  * password is saved nowhere" stays literally true through a rotation.
  */
 import { useState } from "react";
-import { MASTER_LOCK_PATHS, MAX_IDLE_MS, MIN_IDLE_MS, deriveMasterLockVerifier, newMasterLockKdfParams, } from "cursedbelt-core/master-lock";
+import { MASTER_LOCK_PATHS, MAX_IDLE_MS, MIN_IDLE_MS, deriveMasterLockVerifier, } from "cursedbelt-core/master-lock";
 import { ActionBar } from "../components/ActionBar";
 import { Button } from "../components/Button";
 import { FieldLabel } from "../components/FieldLabel";
@@ -76,13 +76,31 @@ export function MasterLockDialog({ open, kdf, idleMs, className, onClose, onChan
         setNote({ text: "Deriving…", tone: "ok" });
         try {
             const currentVerifier = await deriveMasterLockVerifier(current, kdf);
-            const nextKdf = newMasterLockKdfParams();
-            const verifier = await deriveMasterLockVerifier(next, nextKdf);
+            /*
+             * 🔴 BOTH verifiers derive under the app's EXISTING `kdf`, and the request carries
+             * no `kdf` at all.
+             *
+             * Until 2026-09-17 this minted a fresh salt (`newMasterLockKdfParams()`) and sent it
+             * along — the shape the wire had before accounts existed, when one app meant one
+             * password. Every account on an app now derives under ONE shared descriptor, so a
+             * fresh salt here would store a verifier hash nothing could ever match: the owner
+             * sets a new password, the rotation logs him out, and neither the old nor the new
+             * one opens the app. It would also invalidate every SIBLING account's stored hash
+             * at once — rotating account 2 would silently lock him out of account 1.
+             *
+             * `cursedbelt-server`'s guard refuses the old shape with `409 {"error":"stale-client"}`
+             * rather than honouring it, so this dialog did not corrupt anything; it simply
+             * stopped working, and the owner could not change his master password from inside
+             * any app. The salt never rotating is the accepted cost — it is 16 random bytes
+             * whose job is to stop precomputation across apps, and it does that for as long as
+             * it exists. `MasterLockChangeRequest` in `cursedbelt-core` carries the same note.
+             */
+            const verifier = await deriveMasterLockVerifier(next, kdf);
             const res = await fetch(MASTER_LOCK_PATHS.change, {
                 method: "POST",
                 credentials: "same-origin",
                 headers: { "content-type": "application/json" },
-                body: JSON.stringify({ currentVerifier, kdf: nextKdf, verifier }),
+                body: JSON.stringify({ currentVerifier, verifier }),
             });
             if (!res.ok) {
                 const body = (await res.json().catch(() => null));
@@ -91,7 +109,9 @@ export function MasterLockDialog({ open, kdf, idleMs, className, onClose, onChan
                         ? "That is not the current master password."
                         : body?.error === "unconfigured"
                             ? "This app's stored lock cannot be read — it needs re-seeding at the machine."
-                            : "The change was refused.",
+                            : res.status === 409
+                                ? "This page is out of date. Reload it and try again."
+                                : "The change was refused.",
                     tone: "error",
                 });
                 setBusy(false);

package/dist/react/master-lock/MasterLockDialog.js.map

@@ -1 +1 @@
-{"version":3,"file":"MasterLockDialog.js","sourceRoot":"","sources":["../../../src/react/master-lock/MasterLockDialog.tsx"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AACjC,OAAO,EAEN,iBAAiB,EACjB,WAAW,EACX,WAAW,EACX,wBAAwB,EACxB,sBAAsB,GACtB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AAC5C,OAAO,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AAkB5C,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,CAAC;AACpD,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,GAAG,MAAM,CAAC,CAAC;AAErD,MAAM,UAAU,gBAAgB,CAAC,EAChC,IAAI,EACJ,GAAG,EACH,MAAM,EACN,SAAS,EACT,OAAO,EACP,SAAS,EACT,WAAW,GACY;IACvB,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC3C,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC;IACrC,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC3C,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IACjG,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IACxC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAc,IAAI,CAAC,CAAC;IAEpD,MAAM,KAAK,GAAG,OAAO,KAAK,EAAE,IAAI,IAAI,KAAK,EAAE,IAAI,OAAO,KAAK,EAAE,CAAC;IAE9D,MAAM,WAAW,GAAG,KAAK,IAAI,EAAE;QAC9B,OAAO,CAAC,IAAI,CAAC,CAAC;QACd,OAAO,CAAC,IAAI,CAAC,CAAC;QACd,IAAI,CAAC;YACJ,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,iBAAiB,CAAC,QAAQ,EAAE;gBACnD,MAAM,EAAE,MAAM;gBACd,WAAW,EAAE,aAAa;gBAC1B,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,MAAM,CAAC,EAAE,CAAC;aAC9D,CAAC,CAAC;YACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAA+B,CAAC;YAChF,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,OAAO,IAAI,EAAE,MAAM,KAAK,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC;YAC5E,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACzB,iFAAiF;YACjF,mEAAmE;YACnE,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;YACpE,OAAO,CAAC,EAAE,IAAI,EAAE,6BAA6B,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9D,CAAC;QAAC,MAAM,CAAC;YACR,OAAO,CAAC,EAAE,IAAI,EAAE,6BAA6B,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QACjE,CAAC;gBAAS,CAAC;YACV,OAAO,CAAC,KAAK,CAAC,CAAC;QAChB,CAAC;IACF,CAAC,CAAC;IAEF,MAAM,cAAc,GAAG,KAAK,IAAI,EAAE;QACjC,IAAI,IAAI;YAAE,OAAO;QACjB,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrB,OAAO,CAAC,EAAE,IAAI,EAAE,4BAA4B,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;YAC/D,OAAO;QACR,CAAC;QACD,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YACtB,OAAO,CAAC,EAAE,IAAI,EAAE,qCAAqC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;YACxE,OAAO;QACR,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,CAAC;QACd,gFAAgF;QAChF,iFAAiF;QACjF,OAAO,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3C,IAAI,CAAC;YACJ,MAAM,eAAe,GAAG,MAAM,wBAAwB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YACrE,MAAM,OAAO,GAAG,sBAAsB,EAAE,CAAC;YACzC,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAC/D,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,iBAAiB,CAAC,MAAM,EAAE;gBACjD,MAAM,EAAE,MAAM;gBACd,WAAW,EAAE,aAAa;gBAC1B,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,eAAe,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;aACjE,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACb,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAA8B,CAAC;gBAC/E,OAAO,CAAC;oBACP,IAAI,EACH,IAAI,EAAE,KAAK,KAAK,OAAO;wBACtB,CAAC,CAAC,0CAA0C;wBAC5C,CAAC,CAAC,IAAI,EAAE,KAAK,KAAK,cAAc;4BAC/B,CAAC,CAAC,6EAA6E;4BAC/E,CAAC,CAAC,yBAAyB;oBAC9B,IAAI,EAAE,OAAO;iBACb,CAAC,CAAC;gBACH,OAAO,CAAC,KAAK,CAAC,CAAC;gBACf,OAAO;YACR,CAAC;YACD,+EAA+E;YAC/E,mDAAmD;YACnD,OAAO,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YACnD,SAAS,EAAE,CAAC;QACb,CAAC;QAAC,MAAM,CAAC;YACR,OAAO,CAAC,EAAE,IAAI,EAAE,oCAAoC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;YACvE,OAAO,CAAC,KAAK,CAAC,CAAC;QAChB,CAAC;IACF,CAAC,CAAC;IAEF,OAAO,CACN,KAAC,KAAK,IACL,IAAI,EAAE,IAAI,EACV,OAAO,EAAE,OAAO,EAChB,IAAI,EAAC,IAAI,EACT,KAAK,EAAC,iBAAiB,EACvB,OAAO,EAAE,KAAK,KACV,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EACpC,MAAM,EACL,KAAC,SAAS,IACT,SAAS,EACR,KAAC,MAAM,IACN,OAAO,EAAC,UAAU,EAClB,OAAO,EAAC,+BAA+B,EACvC,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,IAAI,sBAGN,EAEV,OAAO,EACN,KAAC,MAAM,IACN,OAAO,EAAC,SAAS,EACjB,OAAO,EAAC,gEAA2D,EACnE,OAAO,EAAE,IAAI,EACb,OAAO,EAAE,GAAG,EAAE,CAAC,KAAK,cAAc,EAAE,uCAG5B,GAET,YAGH,eAAK,SAAS,EAAC,yBAAyB,aACvC,aAAG,SAAS,EAAC,+BAA+B,4EACgB,wCAAoB,+DAE5E,EAEJ,eAAK,SAAS,EAAC,uBAAuB,aACrC,gBAAO,OAAO,EAAC,YAAY,YAC1B,KAAC,UAAU,0CAAqC,GACzC,EACR,KAAC,KAAK,IACL,EAAE,EAAC,YAAY,EACf,IAAI,EAAC,UAAU,EACf,YAAY,EAAC,kBAAkB,EAC/B,KAAK,EAAE,OAAO,EACd,QAAQ,EAAE,IAAI,EACd,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,GAClD,IACG,EACN,eAAK,SAAS,EAAC,uBAAuB,aACrC,gBAAO,OAAO,EAAC,SAAS,YACvB,KAAC,UAAU,sCAAiC,GACrC,EACR,KAAC,KAAK,IACL,EAAE,EAAC,SAAS,EACZ,IAAI,EAAC,UAAU,EACf,YAAY,EAAC,cAAc,EAC3B,KAAK,EAAE,IAAI,EACX,QAAQ,EAAE,IAAI,EACd,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,GAC/C,IACG,EACN,eAAK,SAAS,EAAC,uBAAuB,aACrC,gBAAO,OAAO,EAAC,YAAY,YAC1B,KAAC,UAAU,qCAAgC,GACpC,EACR,KAAC,KAAK,IACL,EAAE,EAAC,YAAY,EACf,IAAI,EAAC,UAAU,EACf,YAAY,EAAC,cAAc,EAC3B,KAAK,EAAE,OAAO,EACd,QAAQ,EAAE,IAAI,EACd,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,EACnD,OAAO,EAAE,GAAG,EAAE,CAAC,KAAK,cAAc,EAAE,GACnC,IACG,EACN,YAAG,SAAS,EAAC,+BAA+B,wHAGxC,EAEJ,aAAI,SAAS,EAAC,wBAAwB,GAAG,EAEzC,eAAK,SAAS,EAAC,uBAAuB,aACrC,gBAAO,OAAO,EAAC,SAAS,YACvB,KAAC,UAAU,kDAA6C,GACjD,EACR,eAAK,SAAS,EAAC,yBAAyB,aACvC,KAAC,KAAK,IACL,EAAE,EAAC,SAAS,EACZ,IAAI,EAAC,QAAQ,EACb,GAAG,EAAE,WAAW,EAChB,GAAG,EAAE,WAAW,EAChB,SAAS,EAAC,MAAM,EAChB,KAAK,EAAE,OAAO,EACd,QAAQ,EAAE,IAAI,EACd,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAC1D,EACF,KAAC,MAAM,IACN,OAAO,EAAC,WAAW,EACnB,OAAO,EAAC,oCAAoC,EAC5C,OAAO,EAAE,GAAG,EAAE,CAAC,KAAK,WAAW,EAAE,EACjC,QAAQ,EAAE,IAAI,qBAGN,IACJ,EACN,YAAG,SAAS,EAAC,+BAA+B,4IAGxC,IACC,EAEL,IAAI,CAAC,CAAC,CAAC,CACP,YACC,SAAS,EAAE,IAAI,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,SAAS,EACzE,IAAI,EAAC,QAAQ,YAEZ,IAAI,CAAC,IAAI,GACP,CACJ,CAAC,CAAC,CAAC,IAAI,IACH,GACC,CACR,CAAC;AACH,CAAC"}
+{"version":3,"file":"MasterLockDialog.js","sourceRoot":"","sources":["../../../src/react/master-lock/MasterLockDialog.tsx"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AACjC,OAAO,EAEN,iBAAiB,EACjB,WAAW,EACX,WAAW,EACX,wBAAwB,GACxB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AAC5C,OAAO,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AAkB5C,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,CAAC;AACpD,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,GAAG,MAAM,CAAC,CAAC;AAErD,MAAM,UAAU,gBAAgB,CAAC,EAChC,IAAI,EACJ,GAAG,EACH,MAAM,EACN,SAAS,EACT,OAAO,EACP,SAAS,EACT,WAAW,GACY;IACvB,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC3C,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC;IACrC,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC3C,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IACjG,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IACxC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAc,IAAI,CAAC,CAAC;IAEpD,MAAM,KAAK,GAAG,OAAO,KAAK,EAAE,IAAI,IAAI,KAAK,EAAE,IAAI,OAAO,KAAK,EAAE,CAAC;IAE9D,MAAM,WAAW,GAAG,KAAK,IAAI,EAAE;QAC9B,OAAO,CAAC,IAAI,CAAC,CAAC;QACd,OAAO,CAAC,IAAI,CAAC,CAAC;QACd,IAAI,CAAC;YACJ,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,iBAAiB,CAAC,QAAQ,EAAE;gBACnD,MAAM,EAAE,MAAM;gBACd,WAAW,EAAE,aAAa;gBAC1B,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,MAAM,CAAC,EAAE,CAAC;aAC9D,CAAC,CAAC;YACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAA+B,CAAC;YAChF,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,OAAO,IAAI,EAAE,MAAM,KAAK,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC;YAC5E,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACzB,iFAAiF;YACjF,mEAAmE;YACnE,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;YACpE,OAAO,CAAC,EAAE,IAAI,EAAE,6BAA6B,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9D,CAAC;QAAC,MAAM,CAAC;YACR,OAAO,CAAC,EAAE,IAAI,EAAE,6BAA6B,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QACjE,CAAC;gBAAS,CAAC;YACV,OAAO,CAAC,KAAK,CAAC,CAAC;QAChB,CAAC;IACF,CAAC,CAAC;IAEF,MAAM,cAAc,GAAG,KAAK,IAAI,EAAE;QACjC,IAAI,IAAI;YAAE,OAAO;QACjB,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrB,OAAO,CAAC,EAAE,IAAI,EAAE,4BAA4B,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;YAC/D,OAAO;QACR,CAAC;QACD,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YACtB,OAAO,CAAC,EAAE,IAAI,EAAE,qCAAqC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;YACxE,OAAO;QACR,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,CAAC;QACd,gFAAgF;QAChF,iFAAiF;QACjF,OAAO,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3C,IAAI,CAAC;YACJ,MAAM,eAAe,GAAG,MAAM,wBAAwB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YACrE;;;;;;;;;;;;;;;;;;eAkBG;YACH,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YAC3D,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,iBAAiB,CAAC,MAAM,EAAE;gBACjD,MAAM,EAAE,MAAM;gBACd,WAAW,EAAE,aAAa;gBAC1B,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC;aACnD,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACb,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAA8B,CAAC;gBAC/E,OAAO,CAAC;oBACP,IAAI,EACH,IAAI,EAAE,KAAK,KAAK,OAAO;wBACtB,CAAC,CAAC,0CAA0C;wBAC5C,CAAC,CAAC,IAAI,EAAE,KAAK,KAAK,cAAc;4BAC/B,CAAC,CAAC,6EAA6E;4BAC/E,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,GAAG;gCACnB,CAAC,CAAC,oDAAoD;gCACtD,CAAC,CAAC,yBAAyB;oBAC/B,IAAI,EAAE,OAAO;iBACb,CAAC,CAAC;gBACH,OAAO,CAAC,KAAK,CAAC,CAAC;gBACf,OAAO;YACR,CAAC;YACD,+EAA+E;YAC/E,mDAAmD;YACnD,OAAO,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YACnD,SAAS,EAAE,CAAC;QACb,CAAC;QAAC,MAAM,CAAC;YACR,OAAO,CAAC,EAAE,IAAI,EAAE,oCAAoC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;YACvE,OAAO,CAAC,KAAK,CAAC,CAAC;QAChB,CAAC;IACF,CAAC,CAAC;IAEF,OAAO,CACN,KAAC,KAAK,IACL,IAAI,EAAE,IAAI,EACV,OAAO,EAAE,OAAO,EAChB,IAAI,EAAC,IAAI,EACT,KAAK,EAAC,iBAAiB,EACvB,OAAO,EAAE,KAAK,KACV,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EACpC,MAAM,EACL,KAAC,SAAS,IACT,SAAS,EACR,KAAC,MAAM,IACN,OAAO,EAAC,UAAU,EAClB,OAAO,EAAC,+BAA+B,EACvC,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,IAAI,sBAGN,EAEV,OAAO,EACN,KAAC,MAAM,IACN,OAAO,EAAC,SAAS,EACjB,OAAO,EAAC,gEAA2D,EACnE,OAAO,EAAE,IAAI,EACb,OAAO,EAAE,GAAG,EAAE,CAAC,KAAK,cAAc,EAAE,uCAG5B,GAET,YAGH,eAAK,SAAS,EAAC,yBAAyB,aACvC,aAAG,SAAS,EAAC,+BAA+B,4EACgB,wCAAoB,+DAE5E,EAEJ,eAAK,SAAS,EAAC,uBAAuB,aACrC,gBAAO,OAAO,EAAC,YAAY,YAC1B,KAAC,UAAU,0CAAqC,GACzC,EACR,KAAC,KAAK,IACL,EAAE,EAAC,YAAY,EACf,IAAI,EAAC,UAAU,EACf,YAAY,EAAC,kBAAkB,EAC/B,KAAK,EAAE,OAAO,EACd,QAAQ,EAAE,IAAI,EACd,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,GAClD,IACG,EACN,eAAK,SAAS,EAAC,uBAAuB,aACrC,gBAAO,OAAO,EAAC,SAAS,YACvB,KAAC,UAAU,sCAAiC,GACrC,EACR,KAAC,KAAK,IACL,EAAE,EAAC,SAAS,EACZ,IAAI,EAAC,UAAU,EACf,YAAY,EAAC,cAAc,EAC3B,KAAK,EAAE,IAAI,EACX,QAAQ,EAAE,IAAI,EACd,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,GAC/C,IACG,EACN,eAAK,SAAS,EAAC,uBAAuB,aACrC,gBAAO,OAAO,EAAC,YAAY,YAC1B,KAAC,UAAU,qCAAgC,GACpC,EACR,KAAC,KAAK,IACL,EAAE,EAAC,YAAY,EACf,IAAI,EAAC,UAAU,EACf,YAAY,EAAC,cAAc,EAC3B,KAAK,EAAE,OAAO,EACd,QAAQ,EAAE,IAAI,EACd,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,EACnD,OAAO,EAAE,GAAG,EAAE,CAAC,KAAK,cAAc,EAAE,GACnC,IACG,EACN,YAAG,SAAS,EAAC,+BAA+B,wHAGxC,EAEJ,aAAI,SAAS,EAAC,wBAAwB,GAAG,EAEzC,eAAK,SAAS,EAAC,uBAAuB,aACrC,gBAAO,OAAO,EAAC,SAAS,YACvB,KAAC,UAAU,kDAA6C,GACjD,EACR,eAAK,SAAS,EAAC,yBAAyB,aACvC,KAAC,KAAK,IACL,EAAE,EAAC,SAAS,EACZ,IAAI,EAAC,QAAQ,EACb,GAAG,EAAE,WAAW,EAChB,GAAG,EAAE,WAAW,EAChB,SAAS,EAAC,MAAM,EAChB,KAAK,EAAE,OAAO,EACd,QAAQ,EAAE,IAAI,EACd,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAC1D,EACF,KAAC,MAAM,IACN,OAAO,EAAC,WAAW,EACnB,OAAO,EAAC,oCAAoC,EAC5C,OAAO,EAAE,GAAG,EAAE,CAAC,KAAK,WAAW,EAAE,EACjC,QAAQ,EAAE,IAAI,qBAGN,IACJ,EACN,YAAG,SAAS,EAAC,+BAA+B,4IAGxC,IACC,EAEL,IAAI,CAAC,CAAC,CAAC,CACP,YACC,SAAS,EAAE,IAAI,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,SAAS,EACzE,IAAI,EAAC,QAAQ,YAEZ,IAAI,CAAC,IAAI,GACP,CACJ,CAAC,CAAC,CAAC,IAAI,IACH,GACC,CACR,CAAC;AACH,CAAC"}

package/dist/react/master-lock/MasterLockProvider.d.ts

@@ -90,6 +90,25 @@ export interface MasterLockMenuItemsProps {
  * collections lock or other locks like that."*
  *
  * Renders nothing when no master password is configured for the app.
+ *
+ * ── 🔴 The second entry is a LINK now, not a dialog (2026-09-17) ─────────────────────────
+ * It used to call {@link MasterLockControl.openSettings}, and that dialog minted a FRESH `kdf`
+ * salt on every rotation — the shape the wire had before accounts existed. Every account on an
+ * app now derives under ONE shared descriptor, so honouring that salt would store a verifier
+ * hash nothing could ever match: the owner sets a new password, the rotation logs him out, and
+ * neither the old nor the new one opens the app. `cursedbelt-server`'s guard therefore answers
+ * that shape `409 {"error":"stale-client"}` — deliberately distinguishable from a wrong
+ * password, because it describes a broken CLIENT. So the entry did not merely look wrong; it
+ * refused, and the owner could lock a site and enroll a first password but could not CHANGE one.
+ *
+ * `cursedbelt-server` serves a richer replacement at `GET /__lock/accounts`, from the same guard
+ * that serves the lock page: server-rendered, content-negotiated, listing the accounts and
+ * adding/renaming them as well as rotating. This package does NOT link to it yet — the path
+ * constant lives in `cursedbelt-core@2`'s wire and this package is still on `^1.1.0`, so the
+ * link is a task, not a one-liner (`tasks/Not_Started`, filed 2026-09-17). What IS fixed here
+ * is the dialog itself: `MasterLockDialog` no longer mints a salt, so this entry works again
+ * rather than 409ing. `apps/collections` links to the page directly from its own rail in the
+ * meantime, and says why in a comment there.
  */
 export declare function MasterLockMenuItems({ close, itemClassName }: MasterLockMenuItemsProps): import("react").JSX.Element | null;
 export {};

package/dist/react/master-lock/MasterLockProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"MasterLockProvider.d.ts","sourceRoot":"","sources":["../../../src/react/master-lock/MasterLockProvider.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,OAAO,EACN,KAAK,SAAS,EAQd,MAAM,OAAO,CAAC;AAef,UAAU,sBAAsB;IAC/B,gFAAgF;IAChF,UAAU,EAAE,OAAO,CAAC;IACpB,wCAAwC;IACxC,MAAM,EAAE,MAAM,CAAC;IACf,gDAAgD;IAChD,OAAO,EAAE,MAAM,IAAI,CAAC;IACpB,iDAAiD;IACjD,YAAY,EAAE,MAAM,IAAI,CAAC;CACzB;AAID;;;;;GAKG;AACH,wBAAgB,aAAa,IAAI,sBAAsB,GAAG,IAAI,CAE7D;AAED,MAAM,WAAW,uBAAuB;IACvC,QAAQ,EAAE,SAAS,CAAC;IACpB,2EAA2E;IAC3E,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,IAAI,CAAC;CACtB;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,EAClC,QAAQ,EACR,eAAe,EACf,QAAQ,GACR,EAAE,uBAAuB,+BAqHzB;AAED,MAAM,WAAW,wBAAwB;IACxC,2FAA2F;IAC3F,KAAK,CAAC,EAAE,MAAM,IAAI,CAAC;IACnB;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,EAAE,wBAAwB,sCAkCrF"}
+{"version":3,"file":"MasterLockProvider.d.ts","sourceRoot":"","sources":["../../../src/react/master-lock/MasterLockProvider.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,OAAO,EACN,KAAK,SAAS,EAQd,MAAM,OAAO,CAAC;AAef,UAAU,sBAAsB;IAC/B,gFAAgF;IAChF,UAAU,EAAE,OAAO,CAAC;IACpB,wCAAwC;IACxC,MAAM,EAAE,MAAM,CAAC;IACf,gDAAgD;IAChD,OAAO,EAAE,MAAM,IAAI,CAAC;IACpB,iDAAiD;IACjD,YAAY,EAAE,MAAM,IAAI,CAAC;CACzB;AAID;;;;;GAKG;AACH,wBAAgB,aAAa,IAAI,sBAAsB,GAAG,IAAI,CAE7D;AAED,MAAM,WAAW,uBAAuB;IACvC,QAAQ,EAAE,SAAS,CAAC;IACpB,2EAA2E;IAC3E,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,IAAI,CAAC;CACtB;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,EAClC,QAAQ,EACR,eAAe,EACf,QAAQ,GACR,EAAE,uBAAuB,+BAqHzB;AAED,MAAM,WAAW,wBAAwB;IACxC,2FAA2F;IAC3F,KAAK,CAAC,EAAE,MAAM,IAAI,CAAC;IACnB;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,mBAAmB,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,EAAE,wBAAwB,sCAkCrF"}

package/dist/react/master-lock/MasterLockProvider.js

@@ -163,6 +163,25 @@ export function MasterLockProvider({ children, dialogClassName, onLocked, }) {
  * collections lock or other locks like that."*
  *
  * Renders nothing when no master password is configured for the app.
+ *
+ * ── 🔴 The second entry is a LINK now, not a dialog (2026-09-17) ─────────────────────────
+ * It used to call {@link MasterLockControl.openSettings}, and that dialog minted a FRESH `kdf`
+ * salt on every rotation — the shape the wire had before accounts existed. Every account on an
+ * app now derives under ONE shared descriptor, so honouring that salt would store a verifier
+ * hash nothing could ever match: the owner sets a new password, the rotation logs him out, and
+ * neither the old nor the new one opens the app. `cursedbelt-server`'s guard therefore answers
+ * that shape `409 {"error":"stale-client"}` — deliberately distinguishable from a wrong
+ * password, because it describes a broken CLIENT. So the entry did not merely look wrong; it
+ * refused, and the owner could lock a site and enroll a first password but could not CHANGE one.
+ *
+ * `cursedbelt-server` serves a richer replacement at `GET /__lock/accounts`, from the same guard
+ * that serves the lock page: server-rendered, content-negotiated, listing the accounts and
+ * adding/renaming them as well as rotating. This package does NOT link to it yet — the path
+ * constant lives in `cursedbelt-core@2`'s wire and this package is still on `^1.1.0`, so the
+ * link is a task, not a one-liner (`tasks/Not_Started`, filed 2026-09-17). What IS fixed here
+ * is the dialog itself: `MasterLockDialog` no longer mints a salt, so this entry works again
+ * rather than 409ing. `apps/collections` links to the page directly from its own rail in the
+ * meantime, and says why in a comment there.
  */
 export function MasterLockMenuItems({ close, itemClassName }) {
     const lock = useMasterLock();

package/dist/react/master-lock/MasterLockProvider.js.map

@@ -1 +1 @@
-{"version":3,"file":"MasterLockProvider.js","sourceRoot":"","sources":["../../../src/react/master-lock/MasterLockProvider.tsx"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,OAAO,EAEN,aAAa,EACb,WAAW,EACX,UAAU,EACV,SAAS,EACT,OAAO,EACP,MAAM,EACN,QAAQ,GACR,MAAM,OAAO,CAAC;AACf,OAAO,EACN,eAAe,EACf,iBAAiB,EAEjB,kBAAkB,GAClB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAEtD;kEACkE;AAClE,MAAM,aAAa,GAAG,MAAM,CAAC;AAC7B,6FAA6F;AAC7F,MAAM,OAAO,GAAG,KAAK,CAAC;AAatB,MAAM,iBAAiB,GAAG,aAAa,CAAgC,IAAI,CAAC,CAAC;AAE7E;;;;;GAKG;AACH,MAAM,UAAU,aAAa;IAC5B,OAAO,UAAU,CAAC,iBAAiB,CAAC,CAAC;AACtC,CAAC;AAcD;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,EAClC,QAAQ,EACR,eAAe,EACf,QAAQ,GACiB;IACzB,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,QAAQ,CAA0B,IAAI,CAAC,CAAC;IACpE,MAAM,CAAC,YAAY,EAAE,eAAe,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,MAAM,EAAE,MAAM,IAAI,eAAe,CAAC;IACjD,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,EAAE,UAAU,CAAC,IAAI,MAAM,EAAE,MAAM,KAAK,KAAK,CAAC;IAEtE,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IAE3B,SAAS,CAAC,GAAG,EAAE;QACd,IAAI,IAAI,GAAG,IAAI,CAAC;QAChB,KAAK,KAAK,CAAC,iBAAiB,CAAC,MAAM,EAAE,EAAE,WAAW,EAAE,aAAa,EAAE,CAAC;aAClE,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAE,GAAG,CAAC,IAAI,EAAgC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;aAC1E,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;YACd,IAAI,IAAI,IAAI,IAAI;gBAAE,SAAS,CAAC,IAAI,CAAC,CAAC;QACnC,CAAC,CAAC;aACD,KAAK,CAAC,GAAG,EAAE;YACX,yDAAyD;QAC1D,CAAC,CAAC,CAAC;QACJ,OAAO,GAAG,EAAE;YACX,IAAI,GAAG,KAAK,CAAC;QACd,CAAC,CAAC;IACH,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,EAAE;QACjC,IAAI,QAAQ;YAAE,QAAQ,EAAE,CAAC;;YACpB,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IACpC,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;IAEf,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE;QAChC,KAAK,KAAK,CAAC,iBAAiB,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,aAAa,EAAE,CAAC;aAChF,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC;aACtB,OAAO,CAAC,QAAQ,CAAC,CAAC;IACrB,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;IAEf,6EAA6E;IAC7E,SAAS,CAAC,GAAG,EAAE;QACd,IAAI,CAAC,KAAK;YAAE,OAAO;QACnB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAEnF,MAAM,UAAU,GAAG,GAAG,EAAE;YACvB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,YAAY,CAAC,OAAO,GAAG,GAAG,CAAC;YAC3B,IAAI,GAAG,GAAG,QAAQ,CAAC,OAAO,GAAG,SAAS;gBAAE,OAAO;YAC/C,QAAQ,CAAC,OAAO,GAAG,GAAG,CAAC;YACvB,KAAK,KAAK,CAAC,iBAAiB,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,aAAa,EAAE,CAAC,CAAC,KAAK,CACvF,GAAG,EAAE,CAAC,SAAS,CACf,CAAC;QACH,CAAC,CAAC;QAEF,qFAAqF;QACrF,oFAAoF;QACpF,oDAAoD;QACpD,MAAM,MAAM,GAAG,CAAC,aAAa,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,CAAU,CAAC;QAC1E,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC5B,UAAU,CAAC,gBAAgB,EAAE,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QACpF,CAAC;QAED,6EAA6E;QAC7E,MAAM,YAAY,GAAG,GAAuB,EAAE,CAC7C,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,gBAAgB,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC;QAEhE,MAAM,KAAK,GAAG,GAAG,EAAE;YAClB,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,CAAC,OAAO,IAAI,MAAM;gBAAE,OAAO;YACxD,8EAA8E;YAC9E,2EAA2E;YAC3E,8EAA8E;YAC9E,6EAA6E;YAC7E,8EAA8E;YAC9E,qEAAqE;YACrE,yEAAyE;YACzE,IAAI,kBAAkB,CAAC,YAAY,EAAE,CAAC;gBAAE,OAAO,UAAU,EAAE,CAAC;YAC5D,QAAQ,EAAE,CAAC;QACZ,CAAC,CAAC;QACF,mFAAmF;QACnF,mEAAmE;QACnE,MAAM,SAAS,GAAG,GAAG,EAAE;YACtB,IAAI,QAAQ,CAAC,eAAe,KAAK,SAAS;gBAAE,KAAK,EAAE,CAAC;QACrD,CAAC,CAAC;QACF,QAAQ,CAAC,gBAAgB,CAAC,kBAAkB,EAAE,SAAS,CAAC,CAAC;QACzD,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAE1C,OAAO,GAAG,EAAE;YACX,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC5B,UAAU,CAAC,mBAAmB,EAAE,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YACxE,CAAC;YACD,QAAQ,CAAC,mBAAmB,CAAC,kBAAkB,EAAE,SAAS,CAAC,CAAC;YAC5D,aAAa,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC,CAAC;IACH,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;IAE9B,MAAM,KAAK,GAAG,OAAO,CACpB,GAAG,EAAE,CAAC,CAAC;QACN,UAAU,EAAE,OAAO,CAAC,MAAM,EAAE,UAAU,CAAC;QACvC,MAAM;QACN,OAAO;QACP,YAAY,EAAE,GAAG,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC;KACzC,CAAC,EACF,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,CACrC,CAAC;IAEF,OAAO,CACN,MAAC,iBAAiB,CAAC,QAAQ,IAAC,KAAK,EAAE,KAAK,aACtC,QAAQ,EACR,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CACd,KAAC,gBAAgB,IAChB,IAAI,EAAE,YAAY,EAClB,GAAG,EAAE,MAAM,CAAC,GAAG,EACf,MAAM,EAAE,MAAM,KACV,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAC3D,OAAO,EAAE,GAAG,EAAE,CAAC,eAAe,CAAC,KAAK,CAAC,EACrC,SAAS,EAAE,QAAQ,EACnB,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GACpF,CACF,CAAC,CAAC,CAAC,IAAI,IACoB,CAC7B,CAAC;AACH,CAAC;AAYD;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CAAC,EAAE,KAAK,EAAE,aAAa,EAA4B;IACrF,MAAM,IAAI,GAAG,aAAa,EAAE,CAAC;IAC7B,IAAI,CAAC,IAAI,EAAE,UAAU;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,GAAG,GAAG,aAAa,IAAI,EAAE,CAAC;IAChC,OAAO,CACN,8BACC;gBACC,iFAAiF;gBACjF,6EAA6E;gBAC7E,4EAA4E;gBAC5E,0EAA0E;gBAC1E,IAAI,EAAC,QAAQ,EACb,SAAS,EAAE,GAAG,EACd,OAAO,EAAE,GAAG,EAAE;oBACb,KAAK,EAAE,EAAE,CAAC;oBACV,IAAI,CAAC,OAAO,EAAE,CAAC;gBAChB,CAAC,4CAGO,EACT;gBACC,gFAAgF;gBAChF,8DAA8D;gBAC9D,IAAI,EAAC,QAAQ,EACb,SAAS,EAAE,GAAG,EACd,OAAO,EAAE,GAAG,EAAE;oBACb,KAAK,EAAE,EAAE,CAAC;oBACV,IAAI,CAAC,YAAY,EAAE,CAAC;gBACrB,CAAC,sCAGO,IACP,CACH,CAAC;AACH,CAAC"}
+{"version":3,"file":"MasterLockProvider.js","sourceRoot":"","sources":["../../../src/react/master-lock/MasterLockProvider.tsx"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,OAAO,EAEN,aAAa,EACb,WAAW,EACX,UAAU,EACV,SAAS,EACT,OAAO,EACP,MAAM,EACN,QAAQ,GACR,MAAM,OAAO,CAAC;AACf,OAAO,EACN,eAAe,EACf,iBAAiB,EAEjB,kBAAkB,GAClB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAEtD;kEACkE;AAClE,MAAM,aAAa,GAAG,MAAM,CAAC;AAC7B,6FAA6F;AAC7F,MAAM,OAAO,GAAG,KAAK,CAAC;AAatB,MAAM,iBAAiB,GAAG,aAAa,CAAgC,IAAI,CAAC,CAAC;AAE7E;;;;;GAKG;AACH,MAAM,UAAU,aAAa;IAC5B,OAAO,UAAU,CAAC,iBAAiB,CAAC,CAAC;AACtC,CAAC;AAcD;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,EAClC,QAAQ,EACR,eAAe,EACf,QAAQ,GACiB;IACzB,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,QAAQ,CAA0B,IAAI,CAAC,CAAC;IACpE,MAAM,CAAC,YAAY,EAAE,eAAe,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,MAAM,EAAE,MAAM,IAAI,eAAe,CAAC;IACjD,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,EAAE,UAAU,CAAC,IAAI,MAAM,EAAE,MAAM,KAAK,KAAK,CAAC;IAEtE,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IAE3B,SAAS,CAAC,GAAG,EAAE;QACd,IAAI,IAAI,GAAG,IAAI,CAAC;QAChB,KAAK,KAAK,CAAC,iBAAiB,CAAC,MAAM,EAAE,EAAE,WAAW,EAAE,aAAa,EAAE,CAAC;aAClE,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAE,GAAG,CAAC,IAAI,EAAgC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;aAC1E,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;YACd,IAAI,IAAI,IAAI,IAAI;gBAAE,SAAS,CAAC,IAAI,CAAC,CAAC;QACnC,CAAC,CAAC;aACD,KAAK,CAAC,GAAG,EAAE;YACX,yDAAyD;QAC1D,CAAC,CAAC,CAAC;QACJ,OAAO,GAAG,EAAE;YACX,IAAI,GAAG,KAAK,CAAC;QACd,CAAC,CAAC;IACH,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,EAAE;QACjC,IAAI,QAAQ;YAAE,QAAQ,EAAE,CAAC;;YACpB,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IACpC,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;IAEf,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE;QAChC,KAAK,KAAK,CAAC,iBAAiB,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,aAAa,EAAE,CAAC;aAChF,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC;aACtB,OAAO,CAAC,QAAQ,CAAC,CAAC;IACrB,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;IAEf,6EAA6E;IAC7E,SAAS,CAAC,GAAG,EAAE;QACd,IAAI,CAAC,KAAK;YAAE,OAAO;QACnB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAEnF,MAAM,UAAU,GAAG,GAAG,EAAE;YACvB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,YAAY,CAAC,OAAO,GAAG,GAAG,CAAC;YAC3B,IAAI,GAAG,GAAG,QAAQ,CAAC,OAAO,GAAG,SAAS;gBAAE,OAAO;YAC/C,QAAQ,CAAC,OAAO,GAAG,GAAG,CAAC;YACvB,KAAK,KAAK,CAAC,iBAAiB,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,aAAa,EAAE,CAAC,CAAC,KAAK,CACvF,GAAG,EAAE,CAAC,SAAS,CACf,CAAC;QACH,CAAC,CAAC;QAEF,qFAAqF;QACrF,oFAAoF;QACpF,oDAAoD;QACpD,MAAM,MAAM,GAAG,CAAC,aAAa,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,CAAU,CAAC;QAC1E,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC5B,UAAU,CAAC,gBAAgB,EAAE,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QACpF,CAAC;QAED,6EAA6E;QAC7E,MAAM,YAAY,GAAG,GAAuB,EAAE,CAC7C,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,gBAAgB,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC;QAEhE,MAAM,KAAK,GAAG,GAAG,EAAE;YAClB,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,CAAC,OAAO,IAAI,MAAM;gBAAE,OAAO;YACxD,8EAA8E;YAC9E,2EAA2E;YAC3E,8EAA8E;YAC9E,6EAA6E;YAC7E,8EAA8E;YAC9E,qEAAqE;YACrE,yEAAyE;YACzE,IAAI,kBAAkB,CAAC,YAAY,EAAE,CAAC;gBAAE,OAAO,UAAU,EAAE,CAAC;YAC5D,QAAQ,EAAE,CAAC;QACZ,CAAC,CAAC;QACF,mFAAmF;QACnF,mEAAmE;QACnE,MAAM,SAAS,GAAG,GAAG,EAAE;YACtB,IAAI,QAAQ,CAAC,eAAe,KAAK,SAAS;gBAAE,KAAK,EAAE,CAAC;QACrD,CAAC,CAAC;QACF,QAAQ,CAAC,gBAAgB,CAAC,kBAAkB,EAAE,SAAS,CAAC,CAAC;QACzD,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAE1C,OAAO,GAAG,EAAE;YACX,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC5B,UAAU,CAAC,mBAAmB,EAAE,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YACxE,CAAC;YACD,QAAQ,CAAC,mBAAmB,CAAC,kBAAkB,EAAE,SAAS,CAAC,CAAC;YAC5D,aAAa,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC,CAAC;IACH,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;IAE9B,MAAM,KAAK,GAAG,OAAO,CACpB,GAAG,EAAE,CAAC,CAAC;QACN,UAAU,EAAE,OAAO,CAAC,MAAM,EAAE,UAAU,CAAC;QACvC,MAAM;QACN,OAAO;QACP,YAAY,EAAE,GAAG,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC;KACzC,CAAC,EACF,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,CACrC,CAAC;IAEF,OAAO,CACN,MAAC,iBAAiB,CAAC,QAAQ,IAAC,KAAK,EAAE,KAAK,aACtC,QAAQ,EACR,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CACd,KAAC,gBAAgB,IAChB,IAAI,EAAE,YAAY,EAClB,GAAG,EAAE,MAAM,CAAC,GAAG,EACf,MAAM,EAAE,MAAM,KACV,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAC3D,OAAO,EAAE,GAAG,EAAE,CAAC,eAAe,CAAC,KAAK,CAAC,EACrC,SAAS,EAAE,QAAQ,EACnB,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GACpF,CACF,CAAC,CAAC,CAAC,IAAI,IACoB,CAC7B,CAAC;AACH,CAAC;AAYD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,UAAU,mBAAmB,CAAC,EAAE,KAAK,EAAE,aAAa,EAA4B;IACrF,MAAM,IAAI,GAAG,aAAa,EAAE,CAAC;IAC7B,IAAI,CAAC,IAAI,EAAE,UAAU;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,GAAG,GAAG,aAAa,IAAI,EAAE,CAAC;IAChC,OAAO,CACN,8BACC;gBACC,iFAAiF;gBACjF,6EAA6E;gBAC7E,4EAA4E;gBAC5E,0EAA0E;gBAC1E,IAAI,EAAC,QAAQ,EACb,SAAS,EAAE,GAAG,EACd,OAAO,EAAE,GAAG,EAAE;oBACb,KAAK,EAAE,EAAE,CAAC;oBACV,IAAI,CAAC,OAAO,EAAE,CAAC;gBAChB,CAAC,4CAGO,EACT;gBACC,gFAAgF;gBAChF,8DAA8D;gBAC9D,IAAI,EAAC,QAAQ,EACb,SAAS,EAAE,GAAG,EACd,OAAO,EAAE,GAAG,EAAE;oBACb,KAAK,EAAE,EAAE,CAAC;oBACV,IAAI,CAAC,YAAY,EAAE,CAAC;gBACrB,CAAC,sCAGO,IACP,CACH,CAAC;AACH,CAAC"}

package/dist/styles-areas/master-lock.css

@@ -15,7 +15,7 @@
  *
  * An app that imports every area gets exactly what `cursedbelt/styles-utilities.css`
  * emits — proved rule by rule in src/stylesAreas.spec.ts, which is also what fails
- * when this file is stale. 125 candidate(s) scanned.
+ * when this file is stale. 147 candidate(s) scanned.
  *
  * Written by scripts/generateAreaStyles.ts (`bun run styles:areas`), which
  * `bun run build` runs. The map of what is in which area, and why the areas are

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "cursedbelt",
-	"version": "4.0.0",
+	"version": "4.1.1",
 	"license": "ISC",
 	"type": "module",
 	"description": "The React design system of the cursedbelt split — components, styles, theme. cursedbelt-core below it; server tier in cursedbelt-server.",
@@ -45,7 +45,7 @@
 		"e2e:resize-grip": "playwright test --config e2e/playwright.config.ts resize-grip-rail.spec.ts",
 		"e2e:touch": "playwright test --config e2e/playwright.config.ts --project=touch",
 		"done:serial": "bun run typecheck && bun run lint && bun run test && bun run build",
-		"paths": "bun ../../tools/check-paths.ts .",
+		"paths": "bun run scripts/paths.ts",
 		"verify": "bun run scripts/verify.ts",
 		"prepublishOnly": "bun run verify",
 		"styles:areas": "bun run scripts/generateAreaStyles.ts"
@@ -291,6 +291,24 @@
 			"source": "./src/react/components/SelectField.tsx",
 			"import": "./dist/react/components/SelectField.js"
 		},
+		"./react/list-selection": {
+			"types": "./dist/react/hooks/useListSelection.d.ts",
+			"bun": "./src/react/hooks/useListSelection.ts",
+			"source": "./src/react/hooks/useListSelection.ts",
+			"import": "./dist/react/hooks/useListSelection.js"
+		},
+		"./react/table-sort": {
+			"types": "./dist/react/hooks/useTableSort.d.ts",
+			"bun": "./src/react/hooks/useTableSort.ts",
+			"source": "./src/react/hooks/useTableSort.ts",
+			"import": "./dist/react/hooks/useTableSort.js"
+		},
+		"./react/multi-select-field": {
+			"types": "./dist/react/components/MultiSelectField.d.ts",
+			"bun": "./src/react/components/MultiSelectField.tsx",
+			"source": "./src/react/components/MultiSelectField.tsx",
+			"import": "./dist/react/components/MultiSelectField.js"
+		},
 		"./react/sharing": {
 			"types": "./dist/react/sharing/index.d.ts",
 			"bun": "./src/react/sharing/index.ts",

package/scripts/paths.ts

@@ -0,0 +1,106 @@
+#!/usr/bin/env bun
+/**
+ * `bun run paths` — the generation's whole-tree laws, run over THIS repo's tree.
+ *
+ * {@link TOOLS} is the list: `check-paths.ts` (the one law — exactly one file in a generation
+ * may contain a literal path) and `check-doc-citations.ts` (every `docs/<name>.md` this repo
+ * points a reader at must exist, with the sections it names). Both are generation-scoped rules
+ * a repo proves about ITSELF — rule 3, a repo's gate proves that repo — both are located the
+ * same way, and both have to fail this step rather than be skipped.
+ *
+ * ## 🔴 Why this is a wrapper and not `bun ../../tools/check-paths.ts .`
+ *
+ * That spelling assumes this checkout sits at a fixed depth under the generation root, and a
+ * WORKTREE never does: the working agreement puts worktrees outside every generation by
+ * construction, under the machine-wide worktrees root. Measured 2026-09-17 in a worktree,
+ * with no changes to any script — `error: Module not found "../../tools/check-paths.ts"`,
+ * and the gate stops on its FIRST step. Seventeen packages spelled it that way, and the failure
+ * mode is not the error — it is the workaround: an agent that cannot run its repo's gate moves
+ * back into the shared checkout another agent is holding, or lands without a green gate — and
+ * the second one is invisible afterwards.
+ *
+ * {@link findForgeRoot} walks up for `forge.env`, the same marker `tools/check-paths.ts` and
+ * the runner both use, so the three cannot disagree. {@link viaWorktree} is the worktree case:
+ * a worktree's `.git` is a FILE pointing at the primary checkout's git directory, so the
+ * primary is discoverable with no environment variable and no guess.
+ *
+ * 🔴 **No generation, no pass.** Answering "fine" because the check could not be located is how
+ * a rule stops being enforced without anybody deciding to stop enforcing it — so every failure
+ * to locate exits 1, and says which of the two walks came back empty.
+ *
+ * `tools/check-paths.ts` is what keeps this spelling honest across the roster: a repo whose
+ * `paths` script reaches a tool through a relative `../` module path fails the whole-generation
+ * run, which is the check that this whole file is the fix for.
+ */
+import { spawnSync } from "node:child_process";
+import { existsSync } from "node:fs";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+/** The generation's tools this repo runs over its own tree, in the order they should fail. */
+const TOOLS = ["check-paths.ts", "check-doc-citations.ts"];
+
+/** How far up either walk looks before giving up — a bound, so a misuse is `null` in ms. */
+const MAX_HOPS = 16;
+
+/** Walk up from `from` for a directory containing `marker`, or `null`. */
+function walkUp(from: string, marker: string): string | null {
+	let dir = resolve(from);
+	for (let hops = 0; hops < MAX_HOPS; hops++) {
+		if (existsSync(join(dir, marker))) return dir;
+		const up = dirname(dir);
+		if (up === dir) return null;
+		dir = up;
+	}
+	return null;
+}
+
+/** The directory holding `forge.env` above `from`, or `null` when that is not inside a generation. */
+function findForgeRoot(from: string): string | null {
+	return walkUp(from, "forge.env");
+}
+
+/** The generation above the checkout this WORKTREE was cut from, or `null` on anything unexpected. */
+function viaWorktree(from: string): string | null {
+	try {
+		const git = spawnSync("git", ["rev-parse", "--path-format=absolute", "--git-common-dir"], {
+			cwd: from,
+			encoding: "utf8",
+			timeout: 5_000,
+		});
+		if (git.status !== 0) return null;
+		const gitDir = (git.stdout ?? "").trim();
+		if (!gitDir || !gitDir.startsWith("/")) return null;
+		// `<primary>/.git` → `<primary>`, then the ordinary walk up.
+		return findForgeRoot(dirname(gitDir));
+	} catch {
+		return null;
+	}
+}
+
+const here = dirname(fileURLToPath(import.meta.url));
+/** This checkout — the nearest ancestor holding a `package.json`, so it is right in a worktree. */
+const repo = walkUp(here, "package.json");
+const root = findForgeRoot(here) ?? viaWorktree(here);
+
+if (!repo) {
+	console.error(`✗ no package.json above ${here}, so there is no repo to check.`);
+	process.exit(1);
+}
+if (!root) {
+	console.error("✗ this checkout is not inside a generation and is not a worktree of one, so");
+	console.error(`  tools/{${TOOLS.join(",")}} cannot be located. Run it from a checkout under a`);
+	console.error("  generation, or from a worktree cut from one — a skipped check is not a passed one.");
+	process.exit(1);
+}
+
+for (const name of TOOLS) {
+	const tool = join(root, "tools", name);
+	if (!existsSync(tool)) {
+		console.error(`✗ ${tool} does not exist. The generation at ${root} has no ${name},`);
+		console.error("  so this repo cannot prove it obeys that law. That is a failure, not a skip.");
+		process.exit(1);
+	}
+	const result = spawnSync("bun", [tool, repo, ...process.argv.slice(2)], { stdio: "inherit" });
+	if ((result.status ?? 1) !== 0) process.exit(result.status ?? 1);
+}

package/src/iframesMakeNoRealRequest.spec.ts

@@ -0,0 +1,92 @@
+/**
+ * 🔴 An `<iframe src>` in a spec must not put a request on a real socket (2026-09-17).
+ *
+ * happy-dom loads an iframe's `src` for real, and `happydom.ts` registers the window at
+ * `http://localhost/`, so `<IsolatedFrame src='/preview/abc'>` used to issue an actual
+ * request to `http://localhost/preview/abc`. Two things came of that, and both are
+ * expensive:
+ *
+ * 1. Nothing listens there, so the socket errored — after `afterEach(cleanup)` had
+ *    unmounted the frame, and therefore after the spec that caused it had finished.
+ *    `bun test --parallel=6` hands a late unhandled error to whatever file is running, and
+ *    the stack (`happy-dom/lib/fetch/Fetch.js:540`) names no cursedbelt code at all. One
+ *    session spent twenty minutes reading that error against a test which is 8 pass /
+ *    0 fail on its own.
+ * 2. If anything ever DOES listen on that host and path, the unit suite hits it. On a
+ *    machine that runs one shared dev host, "nothing is listening" is a property of the
+ *    afternoon, not of the test.
+ *
+ * `happydom.ts` fixes it with `settings.navigation.disableChildFrameNavigation` — see the
+ * comment there for the measured trap in the flag you would reach for first.
+ *
+ * ── Why a live server rather than reading the setting ───────────────────────
+ * The setting is one line in a preload nobody opens, and the symptom of losing it is an
+ * error attributed to an innocent file — the exact failure this repo just paid for. So the
+ * assertion is the behaviour, not the spelling: bind a real port, frame it, and prove the
+ * handler never ran. Verified failing by removing the setting from `happydom.ts`, where
+ * `hits` becomes 1.
+ */
+import { afterEach, describe, expect, test } from 'bun:test';
+import type { Server } from 'bun';
+
+type AnyServer = Server<undefined>;
+
+/** `globalThis.happyDOM`, which `@happy-dom/global-registrator` defines but does not type. */
+const happyDOM = (globalThis as unknown as {
+  happyDOM?: {
+    settings: { navigation: { disableChildFrameNavigation: boolean } };
+    waitUntilComplete: () => Promise<void>;
+  };
+}).happyDOM;
+
+let server: AnyServer | undefined;
+
+afterEach(() => {
+  server?.stop(true);
+  server = undefined;
+  document.body.innerHTML = '';
+});
+
+describe('an iframe src in a spec never reaches the network', () => {
+  test('framing a URL that IS being served does not call the server', async () => {
+    let hits = 0;
+    server = Bun.serve({
+      port: 0,
+      fetch: () => {
+        hits += 1;
+        return new Response('<p>framed</p>', { headers: { 'content-type': 'text/html' } });
+      },
+    });
+
+    const frame = document.createElement('iframe');
+    // A raw element, not a React render: this is about happy-dom's loader, and going
+    // through a component would only add that component's own `onLoad` state update.
+    frame.title = 'network probe';
+    frame.src = `http://127.0.0.1:${server.port}/preview/abc`;
+    document.body.append(frame);
+
+    // Drains happy-dom's async task manager — with navigation enabled the iframe's fetch
+    // IS such a task, so this waits for exactly the request we are claiming never happens.
+    await happyDOM?.waitUntilComplete();
+    await Bun.sleep(50);
+
+    expect(
+      hits,
+      'an <iframe src> in a spec made a real HTTP request. happy-dom loads iframe `src` ' +
+        'for real; `happydom.ts` sets `settings.navigation.disableChildFrameNavigation` to ' +
+        'stop it. Without that, the request outlives the test, fails on `afterEach(cleanup)` ' +
+        'unmounting the frame, and `--parallel=6` prints the NetworkError against whichever ' +
+        'innocent spec is running. Restore the setting rather than the URL.',
+    ).toBe(0);
+  });
+
+  test('the preload setting that makes that true is still on', () => {
+    // Cheap second opinion on the same fact: if the probe above ever goes green for an
+    // unrelated reason (a loader change, a port that would not bind), this still reds when
+    // the preload loses the setting.
+    expect(
+      happyDOM?.settings.navigation.disableChildFrameNavigation,
+      'happydom.ts must register with `settings: { navigation: { disableChildFrameNavigation: true } }`.',
+    ).toBe(true);
+  });
+});

package/src/react/components/IsolatedFrame.spec.tsx

@@ -1,15 +1,33 @@
 import { afterEach, describe, expect, test } from 'bun:test';
-import { cleanup, fireEvent, render } from '@testing-library/react';
+import { act, cleanup, fireEvent, render } from '@testing-library/react';
+import type { ReactElement } from 'react';
 import { IsolatedFrame } from './IsolatedFrame';
 
 afterEach(cleanup);
 
+/**
+ * `render` plus a microtask flush inside `act`, for the cases that pass a `src`.
+ *
+ * happy-dom still runs its iframe loader when `src` is set — `happydom.ts` only stops it
+ * reaching the NETWORK (`navigation.disableChildFrameNavigation`), and the refused
+ * navigation still resolves and fires a real `load` on the next tick. That lands on
+ * `IsolatedFrame`'s `onLoad` → `setLoadedSource`, i.e. a genuine state update arriving
+ * just after a synchronous test body has returned, which React reports as
+ * "An update to IsolatedFrame inside a test was not wrapped in act(...)" against whatever
+ * file is running. Flushing it here keeps that update inside the test that caused it.
+ */
+const renderFramed = async (ui: ReactElement) => {
+  const result = render(ui);
+  await act(async () => {});
+  return result;
+};
+
 // The fullscreen modal is Radix-Dialog-backed (focus-trap + portal) and asserted
 // in e2e against the studio; here we lock the props contract: which mode frames
 // what, the src/srcDoc precedence, the loading skeleton, and the error slot.
 describe('IsolatedFrame', () => {
-  test('desktop: frames the src url with the given accessible title', () => {
-    const { getByTitle } = render(
+  test('desktop: frames the src url with the given accessible title', async () => {
+    const { getByTitle } = await renderFramed(
       <IsolatedFrame mode='desktop' src='/preview/abc' title='App preview' />,
     );
     const frame = getByTitle('App preview') as HTMLIFrameElement;
@@ -17,8 +35,8 @@ describe('IsolatedFrame', () => {
     expect(frame.getAttribute('src')).toBe('/preview/abc');
   });
 
-  test('src wins over srcDoc when both are provided', () => {
-    const { getByTitle } = render(
+  test('src wins over srcDoc when both are provided', async () => {
+    const { getByTitle } = await renderFramed(
       <IsolatedFrame mode='desktop' src='/preview/abc' srcDoc='<p>inline</p>' title='pv' />,
     );
     const frame = getByTitle('pv') as HTMLIFrameElement;
@@ -62,8 +80,8 @@ describe('IsolatedFrame', () => {
     expect(queryByTitle('pv')).toBeNull();
   });
 
-  test('mobile: frames the src inside a fixed-size device bezel', () => {
-    const { getByTitle } = render(
+  test('mobile: frames the src inside a fixed-size device bezel', async () => {
+    const { getByTitle } = await renderFramed(
       <IsolatedFrame mode='mobile' src='/preview/abc' title='mobile pv' />,
     );
     const frame = getByTitle('mobile pv') as HTMLIFrameElement;
@@ -73,8 +91,8 @@ describe('IsolatedFrame', () => {
     expect(bezel.style.height).toBe('720px');
   });
 
-  test('fullscreen: frames the src inside a modal dialog', () => {
-    const { getByRole, getByTitle } = render(
+  test('fullscreen: frames the src inside a modal dialog', async () => {
+    const { getByRole, getByTitle } = await renderFramed(
       <IsolatedFrame mode='fullscreen' src='/preview/abc' title='fs pv' onClose={() => {}} />,
     );
     expect(getByRole('dialog')).toBeTruthy();

package/src/react/markdown/MarkdownDoc.spec.tsx

@@ -44,7 +44,7 @@ describe('MarkdownDoc', () => {
 
   test('javascript: and unknown-scheme links are neutralized to plain text', () => {
     const { container } = render(
-      <MarkdownDoc markdown={'[bad](javascript:alert(1)) and [weird](vbscript:x) and [ok](docs/x.md)'} />,
+      <MarkdownDoc markdown={'[bad](javascript:alert(1)) and [weird](vbscript:x) and [ok](docs/x.md)'} />, // check-doc-citations:ignore markdown fixture for the link sanitiser
     );
     const anchors = Array.from(container.querySelectorAll('a'));
     expect(anchors).toHaveLength(1);

package/src/react/master-lock/MasterLockDialog.tsx

@@ -22,7 +22,6 @@ import {
 	MAX_IDLE_MS,
 	MIN_IDLE_MS,
 	deriveMasterLockVerifier,
-	newMasterLockKdfParams,
 } from "cursedbelt-core/master-lock";
 import { ActionBar } from "../components/ActionBar";
 import { Button } from "../components/Button";
@@ -107,13 +106,31 @@ export function MasterLockDialog({
 		setNote({ text: "Deriving…", tone: "ok" });
 		try {
 			const currentVerifier = await deriveMasterLockVerifier(current, kdf);
-			const nextKdf = newMasterLockKdfParams();
-			const verifier = await deriveMasterLockVerifier(next, nextKdf);
+			/*
+			 * 🔴 BOTH verifiers derive under the app's EXISTING `kdf`, and the request carries
+			 * no `kdf` at all.
+			 *
+			 * Until 2026-09-17 this minted a fresh salt (`newMasterLockKdfParams()`) and sent it
+			 * along — the shape the wire had before accounts existed, when one app meant one
+			 * password. Every account on an app now derives under ONE shared descriptor, so a
+			 * fresh salt here would store a verifier hash nothing could ever match: the owner
+			 * sets a new password, the rotation logs him out, and neither the old nor the new
+			 * one opens the app. It would also invalidate every SIBLING account's stored hash
+			 * at once — rotating account 2 would silently lock him out of account 1.
+			 *
+			 * `cursedbelt-server`'s guard refuses the old shape with `409 {"error":"stale-client"}`
+			 * rather than honouring it, so this dialog did not corrupt anything; it simply
+			 * stopped working, and the owner could not change his master password from inside
+			 * any app. The salt never rotating is the accepted cost — it is 16 random bytes
+			 * whose job is to stop precomputation across apps, and it does that for as long as
+			 * it exists. `MasterLockChangeRequest` in `cursedbelt-core` carries the same note.
+			 */
+			const verifier = await deriveMasterLockVerifier(next, kdf);
 			const res = await fetch(MASTER_LOCK_PATHS.change, {
 				method: "POST",
 				credentials: "same-origin",
 				headers: { "content-type": "application/json" },
-				body: JSON.stringify({ currentVerifier, kdf: nextKdf, verifier }),
+				body: JSON.stringify({ currentVerifier, verifier }),
 			});
 			if (!res.ok) {
 				const body = (await res.json().catch(() => null)) as { error?: string } | null;
@@ -123,7 +140,9 @@ export function MasterLockDialog({
 							? "That is not the current master password."
 							: body?.error === "unconfigured"
 								? "This app's stored lock cannot be read — it needs re-seeding at the machine."
-								: "The change was refused.",
+								: res.status === 409
+									? "This page is out of date. Reload it and try again."
+									: "The change was refused.",
 					tone: "error",
 				});
 				setBusy(false);

package/src/react/master-lock/MasterLockProvider.spec.tsx

@@ -87,3 +87,42 @@ describe("the idle watcher", () => {
 		await waitFor(() => expect(locked).toBeGreaterThan(0), { timeout: IDLE_MS + 4_000 });
 	});
 });
+
+/**
+ * 🔴 The rotation's request body, pinned by reading the SHIPPED source.
+ *
+ * `MasterLockDialog` minted a fresh `kdf` salt on every rotation until 2026-09-17 — the wire
+ * shape from before accounts existed. Every account on an app now derives under one shared
+ * descriptor, so a fresh salt stores a verifier hash nothing can ever match: the owner sets a
+ * new password, the rotation logs him out, and neither the old nor the new one opens the app.
+ * `cursedbelt-server`'s guard answers that shape `409 stale-client` rather than honouring it,
+ * so the dialog did not corrupt anything — it simply refused, and the owner could not change
+ * his master password from inside any app for as long as it shipped.
+ *
+ * A rendering test cannot see this: the dialog renders identically either way and the bug is
+ * in two words of a fetch body. So this reads the module's own source, which is the only thing
+ * that would have caught the regression on the day it was written.
+ */
+describe("🔴 the rotation never mints a KDF", () => {
+	test("the dialog derives under the app's existing params and sends no kdf", async () => {
+		const raw = await Bun.file(
+			new URL("./MasterLockDialog.tsx", import.meta.url).pathname,
+		).text();
+		// 🔴 Comments STRIPPED before asserting. The note in the source explains the bug by
+		// naming `newMasterLockKdfParams()`, so a naive grep over the raw file fails on the
+		// documentation of the fix — which would teach the next person to delete the note.
+		const code = raw.replace(/\/\*[\s\S]*?\*\//g, "").replace(/\/\/.*$/gm, "");
+
+		// The body that goes to POST /__lock/change carries exactly the two verifiers.
+		expect(code).toContain("JSON.stringify({ currentVerifier, verifier })");
+		// Nothing in the file can produce a salt: the mint is not imported, so it is not in scope.
+		expect(code).not.toContain("newMasterLockKdfParams");
+		// Both verifiers derive under the SAME params — the ones the server published.
+		expect(code).toContain("deriveMasterLockVerifier(current, kdf)");
+		expect(code).toContain("deriveMasterLockVerifier(next, kdf)");
+		// `kdf` survives only as the PROP the server's params arrive on — never as a key in a
+		// request body. Pinned on the body itself above rather than by grepping the identifier,
+		// which would also hit that declaration.
+		expect(code).toContain("kdf: MasterLockKdfParams;");
+	});
+});

package/src/react/master-lock/MasterLockProvider.tsx

@@ -243,6 +243,25 @@ export interface MasterLockMenuItemsProps {
  * collections lock or other locks like that."*
  *
  * Renders nothing when no master password is configured for the app.
+ *
+ * ── 🔴 The second entry is a LINK now, not a dialog (2026-09-17) ─────────────────────────
+ * It used to call {@link MasterLockControl.openSettings}, and that dialog minted a FRESH `kdf`
+ * salt on every rotation — the shape the wire had before accounts existed. Every account on an
+ * app now derives under ONE shared descriptor, so honouring that salt would store a verifier
+ * hash nothing could ever match: the owner sets a new password, the rotation logs him out, and
+ * neither the old nor the new one opens the app. `cursedbelt-server`'s guard therefore answers
+ * that shape `409 {"error":"stale-client"}` — deliberately distinguishable from a wrong
+ * password, because it describes a broken CLIENT. So the entry did not merely look wrong; it
+ * refused, and the owner could lock a site and enroll a first password but could not CHANGE one.
+ *
+ * `cursedbelt-server` serves a richer replacement at `GET /__lock/accounts`, from the same guard
+ * that serves the lock page: server-rendered, content-negotiated, listing the accounts and
+ * adding/renaming them as well as rotating. This package does NOT link to it yet — the path
+ * constant lives in `cursedbelt-core@2`'s wire and this package is still on `^1.1.0`, so the
+ * link is a task, not a one-liner (`tasks/Not_Started`, filed 2026-09-17). What IS fixed here
+ * is the dialog itself: `MasterLockDialog` no longer mints a salt, so this entry works again
+ * rather than 409ing. `apps/collections` links to the page directly from its own rail in the
+ * meantime, and says why in a comment there.
  */
 export function MasterLockMenuItems({ close, itemClassName }: MasterLockMenuItemsProps) {
 	const lock = useMasterLock();

package/src/styles-areas/master-lock.css

@@ -15,7 +15,7 @@
  *
  * An app that imports every area gets exactly what `cursedbelt/styles-utilities.css`
  * emits — proved rule by rule in src/stylesAreas.spec.ts, which is also what fails
- * when this file is stale. 125 candidate(s) scanned.
+ * when this file is stale. 147 candidate(s) scanned.
  *
  * Written by scripts/generateAreaStyles.ts (`bun run styles:areas`), which
  * `bun run build` runs. The map of what is in which area, and why the areas are