[indent]

What the logs show. Over the last 24 h, 11 production logins logged DecryptMessageV2 failed on retry with missing my private key (409 lines; 100-300 a day for the past week). Each one reaches the user as "[Unable to decrypt LINE message.]". 10 of those 11 logins currently report CONNECTED. Two of them did get line-e2ee-key-missing right after a re-login that kept stale keys, but the next restart flipped them back to CONNECTED. One login has been failing for at least 5 days and never showed the prompt.

Cause. ForceFullE2EELogin is saved in metadata, but missingE2EEKeyMarked only lives in memory. After a restart, Connect sends CONNECTED. Then on the next missing-key failure, markMissingE2EEKey sees the flag already saved (needsSave == false) and returns before it sends the bridge state.

Change.

• sendConnectedStateIfCurrent sends line-e2ee-key-missing instead of CONNECTED while the flag is set, and marks the client so SSE reconnects don't overwrite it.
• markMissingE2EEKey now always sends the state the first time this client sees a missing key. It only skips the save.

Built with go build ./... and go vet ./pkg/connector/. go test -short ./pkg/connector/ passes.

Tag @indent to continue the conversation here.

[indent]

Issues

No issues found.

CI Checks

All CI checks passed on 302e9d9.

Review agents

Select any unchecked box below to run or rerun that agent.

Passed (1)

• Indent Review Agent · No issues found in the E2EE restart fix.

Full results

Indent Review Agent

• Summary: No issues found in the E2EE restart fix.
• Last ran on commit: 302e9d98
• Latest result

  {
    "summary": "No issues found in the E2EE restart fix.",
    "findings": []
  }