check / check (push) Waiting to run
Adding a PGP unlocker checked unlockers.d for a duplicate and, when the directory or an unlocker's metadata file could not be read, reported no duplicate and went on. The check now reads unlockers.d itself and stops with an error naming the path and cause; `unlocker list` keeps skipping unlockers it cannot read. The same flaw guarded removing the last unlocker and removing a vault (an unreadable secrets directory counted as no secrets) and vault import (an unreadable pub.age counted as no long-term key). Those now stop with an error too. `vault rm` and `unlocker rm` keep the state directory lock and now do their work in an unexported function, as `vault import` does. Model: opus-5-5