- Crypto backend: use native AES-GCM from `cryptography` when importable
(~1.5 GiB/s), falling back to the pure-Python implementation with a
byte-identical format and identical authentication failures.
- E2E shard: decrypted E2E text is indexed in an in-memory SQLite
database, persisted only as serialize() -> AES-256-GCM with an HKDF key
bound to the project and memory-secret identity, authenticated header,
fresh nonce, 0600 atomic writes. It loads only while the project is
unlocked; tampered, foreign, wrong-key or rotated shards fail closed and
rebuild. Search merges shard hits (search_source local_e2e) and reports
locked/unavailable/slow states explicitly.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
