Every shared lock was std::sync::Mutex with lock().unwrap() (~150 sites),
so a panic in any session's reader or callback poisoned the lock and the
next UI frame panicked too, dropping every open session. Locks are now
parking_lot::Mutex (no poisoning; already in the dependency tree), and a
panic hook reports worker panics as an error toast instead of the session
silently stopping (F3, F4).
- Secrets::delete_profile removes every profile credential kind from the OS
keychain as well as the vault (previously only the vault was purged, so
keychain passwords/tokens outlived the profile).
- write_private writes to a sibling temp file and renames it into place, so a
crash mid-write cannot truncate the vault or an export, and a pre-existing
world-readable file is replaced rather than reused.
- Argon2-derived vault/export keys are Zeroizing and wiped on drop.
- Recordings (which capture typed input), JSON exports and --data-dir
directories are created owner-only.
Andy Dixon