- Fix A (store.rs): checkpoint boundary persists wal.committed_seq (highest
fsync'd) instead of wal.seq() (next-to-assign), which skipped all WAL
entries since last checkpoint -> silent data loss on reboot.
- Fix B (commands.rs open): run decrypted program in isolated read_snapshot()
clone instead of put_raw plaintext over sealed envelope (stopped reboot-time
EnvelopeTooShort / clobber).
- Fix C (commands.rs keyinit): flush OS key cells to WAL via log_put so they
fold into base snapshot and survive reboot (keyinit #2 issues 0, not 2);
previously re-minted random material each boot -> sealed records unopenable.
- Regression guards durable_sealed_record_survives_restart +
open_does_not_clobber_sealed_record in cubesys/src/commands.rs.
- STARTUP-README: replace stale 'EPHEMERAL across restarts' caveat with the
fixed/verified durability note.
Verified live: systemctl restart cube-server (VM reboot path) -> sealed record
decrypts+executes after reboot; key cell byte-identical; keyinit idempotent.
CUBELinux-2
f6bd8bd01f