incident-log: pwvault web-vault EncString crash case (2026-09-09)

Full symptom/root-cause/repair record for the InvalidTypeSymm
web-vault crash so it is never re-derived.
https://projects.knownelement.com/issues/942

skills/agent-provisioning/references/incident-log.md

@@ -50,3 +50,25 @@ rabbit hole (see #939 correction).
 ---
 
 **Records:** Redmine #942 — https://projects.knownelement.com/issues/942 · Discourse docs home: https://community.turnsys.com (skill topic pending admin-key provisioning, tracked on #942)
+
+## 2026-09-09 — pwvault web-vault crash: EncString InvalidTypeSymm
+
+- Symptom: web vault (all browsers, incl. fresh private windows) spins
+  forever after successful password + authenticator 2FA login; zero items.
+  iPad native app + extension worked throughout; CLI (API key) worked.
+- Root cause: the account's `accountKeys.publicKeyEncryptionKeyPair.publicKey`
+  stored a RAW base64 public key ("MI…", not an EncString). The 2026.7.0
+  web client's strict SDK parser rejects it → `InvalidTypeSymm { enc_type:
+  "0", parts: 1 }` → unhandled Angular error aborts vault render.
+  Upstream: vaultwarden discussions #7334, #7464; issue #7469.
+- Repair: `UPDATE users SET public_key = NULL` (MySQL db for the app;
+  coo@ = user uuid 98954ef9-…), then client login regenerates the pair.
+  Cloudron app backup taken first via the backup API (backup_sites →
+  task poll). Verified end-to-end same day.
+- Diagnostic technique that found it: Firefox F12 → Console tab captured
+  the unhandled Angular exception; server logs + API probes showed
+  everything healthy; the crash was client-render only.
+- Related: CLI-style logins (client_id=cli) are offered only the recovery
+  code 2FA provider — authenticator TOTP codes from a vault seed are
+  rejected for CLI logins even with the authenticator correctly enrolled.
+  Automation uses API keys (bypass 2FA), not passwords+TOTP.