fix(privacy): protect private addresses adopted from sync

[chhoumann]

Summary

Protect raw private feed addresses on disk as soon as PodNotes adopts a synced copy from an older device. The writer now tracks pending protection separately from document equality and queues its normal save, with a fresh read and the existing refusal and readback merge rules.

Fixes #488

Verification

• Reproduced on master in isolated Obsidian 1.14.4 on Linux. Both triggers protected memory but left the raw sentinel on disk with zero saves. The final unit and E2E tests each fail in both privacy cases before the fix.
• After the fix, three incoming changes through each trigger produce one save each and no sentinel on disk. Public and protected adoptions produce zero writes. The unit tests also cover copied addresses, codec normalization, failed writes and refusal on the fresh read.
• count:writes matches master for idle time and two settings edits. Both builds record 0, 1, 2 completed writes.
• Passed npm run lint, npm run format:check, npm run typecheck, npm run build, npm run test, npm run test:tooling, and npm run docs:build under Node 22. The application suite has 2,757 passing tests and tooling has 35.
• npm run test:e2e passed all 230 tests from a fresh vault on 1.14.4. On 1.13.7, 229 passed and one existing transcript-layout test timed out, then passed alone. Independent final privacy verification passed all 3 tests on 1.14.4. All 3 also passed in the floor suite.
• npm run size reports 102,754 gzip bytes, up 47 from the measured master build and 246 below the limit.

The local fixture is http://priv3.supercast.com:<port>/feeds/FIX488_ADOPTED_SENTINEL. Logs, repeatable scripts, reviews and write observations record the full results.

Mutation checks

• Disabling the rewrite fails both positive privacy persistence tests.
• Rewriting every adoption fails the public/protected and library-id normalization zero-write tests.
• Using any codec difference to request a rewrite fails those same zero-write tests.
• Omitting the completed-write reset fails the retry test's next-flush assertion.

Release impact

No data shape, public API or URI change. Devices still on 2.21.1 can continue writing raw addresses. The existing reference policy allocates a device-local secret on each raw read, so the fresh read adds an unused reference until startup cleanup. Reusing matching addresses is a separate follow-up.

Docs at release

None.

Note

Fix protection of private addresses adopted from synced settings files

• When a synced file contains a raw private feed address, the reader now redacts it and marks the read result as rewrite-required, so the protected document gets written back to disk.
• DataFileWriter.applyExternalChange in writer.ts schedules that write even when the decoded document equals the in-memory settings, and no longer cancels the save timer while the rewrite is pending.
• DataFileWriter.writeMerged clears the rewritePending flag only after a successful write, and retries failed or refused writes instead of dropping the rewrite.
• Adds regression, writer, and end-to-end tests covering raw incoming addresses, equal decoded contents, public/protected feeds, and 2.21.1 documents.
• Behavioral Change: the persistence-repair redaction count in main.persistence.test.ts increases from five to six; public and already-protected documents still adopt without writing.

^{Macroscope summarized 3735fe8.}

[cloudflare-workers-and-pages]

Deploying podnotes with    Cloudflare Pages

Latest commit:	3735fe8
Status:	✅  Deploy successful!
Preview URL:	https://c9f8ee82.podnotes.pages.dev
Branch Preview URL:	https://fix-protect-adopted-address.podnotes.pages.dev

View logs