Move the keys when a membership changes, not just the flag

Adding somebody to a team granted them nothing readable and removing them
rotated nothing. Both were honest — the interface said so in as many words — and
both left the actual work to a button somebody had to remember to press, on a
machine that happened to hold the key. Adding now wraps every team vault this
machine can open to the new member, and removing revokes their grants and moves
each of those vaults to a fresh key that goes to whoever is left.

The rotation is where the design had to be decided rather than written. A vault
key is per generation and an item carries the generation it was sealed under, so
advancing the vault and withdrawing the old grants would make everything already
stored unreadable to everybody, including whoever pressed the button. So earlier
grants are kept: a member holds one per generation, /me serves them as
PriorKeyWraps, and VaultKeyring holds a key per generation — the newest for
writing, the item's own for reading, chosen per item on every read path. Sharing
issues one grant per generation held, because a recipient handed only the current
key would open the vault to find most of it undecryptable; revocation takes every
generation, because leaving the history behind leaves them able to read
everything written before the rotation.

The bump itself is one server transaction. POST /vaults/{id}/rekey must name
exactly current + 1 and the vault's xmin token makes that binding, so two admins
rotating at once do not both walk away believing they succeeded — the second is
refused and told to read the vault again. The server contributes the moment and
no cryptography: it cannot generate the key, cannot tell that the one it is
handed differs from the old one, and checks that the caller held the old one the
only way it can, by requiring a live grant at the current generation.

What this does not do is re-encrypt what is already stored, and the product says
so rather than the reassuring version: everything written from the rotation
onwards is unreadable to the person who left, and nothing about the past changes.
That half is deferred and is safe to add incrementally precisely because a vault
at mixed generations stays readable. ADR 0010 records the alternatives — revoking
the old grants, chaining each key under its successor, re-sealing every item in
one request against a server that caps a push at 500 operations — and why each
was rejected.

Two things fell out of the change rather than being asked for. The grant listing
would have shown a member once per generation, so it now returns one row per
holder carrying the best key they hold, which is what makes a row below the
vault's generation mean "still owed the new key". And MarkUnreadable gives up the
write target as well as reporting: a client whose vault was rotated elsewhere
would otherwise have gone on sealing items under its superseded key — readable to
its author, unreadable to everybody else, with nothing to show for it.

docs/adr/0010-vault-key-rotation.md

@@ -0,0 +1,122 @@
+# ADR 0010 — Rotation advances a generation; the keys before it are kept
+
+- Status: accepted
+- Date: 2026-08-03
+- Builds on: [ADR 0001](0001-e2ee-trust-model.md), [ADR 0009](0009-team-access-model.md)
+
+## Context
+
+ADR 0009 shipped removal as "revoke the grants and flag the vault", and named the missing half
+plainly: only a client holding the current vault key can produce the next one, so the server could
+record that a rotation was owed and nothing more. Nothing acted on the flag. In practice that meant
+removing somebody from a team left every vault they could read encrypted under the key they had, for
+ever — the interface said a rotation was owed and no button existed to perform one.
+
+Two things had to be decided before that flag could be acted on, and they are not independent.
+
+**When does the generation change?** A vault key is per vault *per generation* (`docs/crypto.md` §3),
+and a grant names the generation it opens. If two admins rotate at the same time, both wrap a key,
+both issue grants, and the vault ends up with two claimed "current" keys and a set of members split
+between them — half of whom cannot read what the other half writes, with nothing to point at as the
+cause.
+
+**What happens to everything already stored?** An item carries the generation it was sealed under, in
+its own row and in its AAD. A rotation that advanced the generation and left the old grants behind
+would make every item written before it unreadable to everybody, including the person who rotated. A
+rotation that re-encrypted every item would avoid that — and is a different, much larger operation:
+`crypto.md` §3 puts it at N × 32 bytes of re-wrapped data keys, which is cheap in bytes and is still
+a write to every row of a vault, in batches, against a server that caps a push at 500 operations and
+8 MB, with the connection/activity logs alone reaching five thousand entries per kind.
+
+## Decision
+
+**The rotation is the generation bump, and it is one server transaction. Grants for earlier
+generations are kept.**
+
+`POST /api/v1/vaults/{id}/rekey` takes the next generation and the new key sealed to the caller. In
+one transaction the vault's `key_generation` advances, the caller's grant for it is inserted, and the
+rekey flag is cleared. The request must name exactly `current + 1`, and the vault's `xmin`
+concurrency token makes that check binding rather than advisory — the second of two simultaneous
+rotations is refused and told to read the vault again. The server contributes the *moment*, which is
+the one part of a rotation a client cannot decide for itself; it contributes no cryptography, cannot
+tell that the key it is handed differs from the old one, and cannot tell whether the caller held the
+old one. That last part is checked the only way it can be: the caller must hold a live grant at the
+current generation, which is a row rather than a proof.
+
+Everything that follows from keeping the old grants:
+
+- **A member holds one grant per generation, and `VaultSummary` serves all of them.** The current
+  wrap stays where it was; the rest arrive as `PriorKeyWraps`, oldest first. `VaultKeyring` holds a
+  key per generation, hands out the newest for writing and the item's own for reading. Every read
+  path picks its key from the payload's `keyGeneration` rather than from the vault's.
+- **Sharing hands over the history.** `ShareVaultAsync` issues a grant for every generation the
+  sharing client holds, oldest first. Somebody added after a rotation who was given only the newest
+  key would open the vault to a list of items that will not decrypt — which reads as corruption, not
+  as a missing grant. The server accordingly accepts a grant for any generation the vault has
+  reached, and refuses one for a generation ahead of it: nothing is sealed under that, and accepting
+  it would let a client move the vault forward outside the transaction that is allowed to.
+- **Revocation takes every generation.** Removing a member, and `RevokeGrantAsync`, revoke all of a
+  recipient's grants rather than the current one. Leaving the history would leave them able to read
+  everything written before the rotation, which is exactly what the rotation was for.
+- **A member between the rotation and their re-wrap can read and cannot write.** They hold the
+  history and no current key, so the vault lists as unreadable and writes refuse. Writing under a
+  superseded key would produce items nobody else could open, and the author's own keyring — which
+  still holds that key — would show no sign of it.
+
+**Removing a member rotates automatically.** The teams screen removes the member, then rotates every
+team vault the machine can currently open and wraps each new key to the members who remain. Adding a
+member is the mirror image: every team vault this machine can open is wrapped to them as part of the
+add. Both report per vault, including what they could not do — a vault whose key this machine does
+not hold is skipped and stays flagged, because somebody else has to finish it.
+
+## What this deliberately does not do
+
+**It does not re-encrypt what is already stored.** After a rotation the vault's existing items remain
+sealed under the generations they were written with. The person who left keeps whatever plaintext
+they already pulled — that is the non-retroactive limit ADR 0001 records and no design here changes
+it — and, if they kept the old vault key and later obtained ciphertext they had not already
+downloaded, that ciphertext would still open to them.
+
+So the guarantee this buys is exact and worth stating in those words: **everything written from the
+rotation onwards is unreadable to them.** Nothing about the past changes. The product says that
+rather than the reassuring version, and the honest remediation for a departure is still to rotate the
+credentials themselves.
+
+Re-sealing the vault's existing items under the new key is the remaining half and is deferred. It is
+safe to add incrementally *because* of the decision above: mixed generations are readable, so a pass
+that migrates items one batch at a time cannot strand anything, and a pass that fails half way leaves
+a vault that still works. Building it the other way round — bumping the generation only once every
+item had been re-sealed — would have needed the whole vault to move in one transaction, which is a
+request-size limit dressed as an architecture.
+
+## Alternatives rejected
+
+- **Revoke the old grants on rotation.** Tidier, and it makes the grant list say exactly one thing
+  per member. It also makes every item written before the rotation unreadable to everybody, which is
+  data loss performed by a security feature.
+- **Chain the keys: store each old key sealed under its successor.** One wrap per rotation instead of
+  one grant per member per generation, and new members get the history for free. It needs a new table,
+  a new AAD purpose, and a recursive unwrap on the read path — and it makes the vault's whole history
+  reachable from the current key, which is a strictly larger blast radius than a set of grants that
+  can be revoked one at a time.
+- **Rotate atomically with every item re-sealed, in one request.** The safest shape on paper and the
+  one `crypto.md` implies. It caps rotation at the push limits — 500 operations and 8 MB — which a
+  vault with a year of connection log in it exceeds, and the failure mode is a vault that can never
+  be rotated at all.
+- **Let the server generate the new key.** It would make rotation a single call and would end the
+  product: a server that can produce a vault key can read the vault.
+
+## Consequences
+
+`vault_key_grant` grows by one row per member per rotation. The unique index is already per
+`(vault, generation, recipient)`, so this needed no migration; the rows are 110-byte seals and a vault
+rotated monthly for a decade with ten members holds twelve hundred of them.
+
+The sharing graph gains a dimension the operator can read: which generation each member holds, and so
+which of them have been re-wrapped since the last rotation. That is the same class of metadata ADR
+0009 already records as visible, and it is the same fact the sharing screen shows the members
+themselves.
+
+A client that never comes back holds keys to generations that no longer receive writes, which is the
+same exposure as any copy of a vault key on a machine that has been lost — bounded by the fact that
+the server will not serve them anything, and unbounded in the way every non-retroactive revocation is.