From f537f098535228a5c800092feff68dd58ff0d363 Mon Sep 17 00:00:00 2001
From: Wasabules <39313803+Wasabules@users.noreply.github.com>
Date: Tue, 27 Oct 2026 12:50:58 +0100
Subject: [PATCH] fix(encryption): a database left in the clear by a killed
 session asks for the password and is encrypted again

Unlocking decrypts the database to the file SQLite works on and deletes
the encrypted one; closing encrypts it again. A session that stopped in
between - a crash, a forced stop, a power cut - left only the clear
file. The next start found no encrypted file and opened it as if
encryption were off: without the password, and with no password to
encrypt it with when closing, so it stayed in the clear for good.

A database encryption is on for, found in the clear, now waits for the
password like an encrypted one (LogStore.leftClear). Unlocking checks
the password as usual - against the keyring, or, for an installation
older than the keyring, against the other files it encrypts, since no
encrypted database is there to fail on and a mistyped password would
encrypt everything under it - then opens the database as it is, with
nothing lost, and closing encrypts it again. The recovery key opens it
too. The unlock screen says what happened (IsDatabaseLeftClear, on
Backend; the window's own store when driving a sealing service), in
the 8 languages, and so does the user guide.

The test reproduces it: an encrypted database unlocked, its files
copied while the session runs, the copy started: locked, a wrong
password refused, the right one opens every message, closing leaves
only the encrypted file, which opens at the next start as any does.
---
 app_sealed.go                               |   1 +
 docs/USER_GUIDE.md                          |   5 +
 frontend/src/components/UnlockScreen.svelte |  14 +-
 frontend/src/lib/api.ts                     |   1 +
 frontend/src/lib/i18n/de.json               |   1 +
 frontend/src/lib/i18n/en.json               |   1 +
 frontend/src/lib/i18n/es.json               |   1 +
 frontend/src/lib/i18n/fr.json               |   1 +
 frontend/src/lib/i18n/it.json               |   1 +
 frontend/src/lib/i18n/ja.json               |   1 +
 frontend/src/lib/i18n/pt.json               |   1 +
 frontend/src/lib/i18n/zh.json               |   1 +
 frontend/wailsjs/go/main/App.d.ts           |   2 +
 frontend/wailsjs/go/main/App.js             |   4 +
 internal/engine/encryption.go               |  15 +++
 internal/engine/leftclear_test.go           | 136 ++++++++++++++++++++
 internal/remote/backend.go                  |   1 +
 internal/remote/client_gen.go               |   6 +
 internal/remote/switch_gen.go               |   4 +
 internal/storage/logstore.go                |  39 +++++-
 20 files changed, 230 insertions(+), 6 deletions(-)
 create mode 100644 internal/engine/leftclear_test.go

diff --git a/app_sealed.go b/app_sealed.go
index 730b2cf..42aa794 100644
--- a/app_sealed.go
+++ b/app_sealed.go
@@ -64,6 +64,7 @@ func (b sealedBackend) GetUnlockAttemptsRemaining() int { return b.store.GetUnlo
 func (b sealedBackend) GetUnlockLockoutSeconds() int    { return b.store.GetUnlockLockoutSeconds() }
 func (b sealedBackend) IsEncryptionEnabled() bool       { return b.store.IsEncryptionEnabled() }
 func (b sealedBackend) IsEncryptionLocked() bool        { return b.store.IsEncryptionLocked() }
+func (b sealedBackend) IsDatabaseLeftClear() bool       { return b.store.IsDatabaseLeftClear() }
 func (b sealedBackend) UnlockDatabase(password string) error {
 	return b.store.UnlockDatabase(password)
 }
diff --git a/docs/USER_GUIDE.md b/docs/USER_GUIDE.md
index 1991b5f..1917199 100644
--- a/docs/USER_GUIDE.md
+++ b/docs/USER_GUIDE.md
@@ -490,6 +490,11 @@ destinations' credentials and the sealed inbox key. The password itself is never
   change of password, or the creation of a recovery key, replaces its key, which encrypts
   everything again once.
 - Once this version has written a database, versions before 1.8 can no longer open it.
+- While SyslogStudio runs, the database it works on is decrypted; it is encrypted again when
+  SyslogStudio closes. If SyslogStudio stops without closing — a crash, a forced stop, a power cut —
+  the database is found unencrypted at the next start. SyslogStudio then says so on the unlock
+  screen and asks for the password as usual: the database opens as it was, and is encrypted again
+  when SyslogStudio closes. (Before 1.11, it was opened without the password and stayed unencrypted.)
 
 ### The recovery key
 
diff --git a/frontend/src/components/UnlockScreen.svelte b/frontend/src/components/UnlockScreen.svelte
index 54c9728..96c45b0 100644
--- a/frontend/src/components/UnlockScreen.svelte
+++ b/frontend/src/components/UnlockScreen.svelte
@@ -1,7 +1,7 @@
 <script lang="ts">
     import { onDestroy, onMount } from 'svelte';
     import { _ } from 'svelte-i18n';
-    import { unlockDatabase, getUnlockLockoutSeconds } from '../lib/api';
+    import { unlockDatabase, getUnlockLockoutSeconds, isDatabaseLeftClear } from '../lib/api';
     import { errorText, getRecoveryKey, resetEncryptionPassword, selectRecoveryKeyFile,
              unlockWithRecoveryKeyFile } from '../lib/backup';
 
@@ -19,6 +19,9 @@
 
     let password = '';
     let error = '';
+    // Found in the clear: a session ended without encrypting it again.
+    let leftClear = false;
+    isDatabaseLeftClear().then(v => (leftClear = v)).catch(() => {});
     let loading = false;
     let lockedOut = false;
     let lockoutSeconds = 0;
@@ -206,6 +209,9 @@
             </div>
         {:else}
             <p class="subtitle">{$_('encryption.unlockMessage')}</p>
+            {#if leftClear}
+                <p class="left-clear">{$_('encryption.leftClear')}</p>
+            {/if}
 
             <div class="input-group">
                 <!-- svelte-ignore a11y-autofocus -->
@@ -304,6 +310,12 @@
         margin: 0;
     }
 
+    .left-clear {
+        margin: 0 0 12px; padding: 8px 10px; max-width: 420px;
+        font-size: 12px; line-height: 1.5; text-align: left;
+        color: var(--text-primary); background: var(--warning-bg);
+        border: 1px solid var(--warning); border-radius: 6px;
+    }
     .subtitle {
         font-size: 13px;
         color: var(--text-secondary);
diff --git a/frontend/src/lib/api.ts b/frontend/src/lib/api.ts
index 7d20e6d..f460d6f 100644
--- a/frontend/src/lib/api.ts
+++ b/frontend/src/lib/api.ts
@@ -88,6 +88,7 @@ export const clearDatabase = (): Promise<void> => callGo('ClearDatabase');
 // --- Encryption ---
 export const isEncryptionEnabled = (): Promise<boolean> => callGo('IsEncryptionEnabled');
 export const isEncryptionLocked = (): Promise<boolean> => callGo('IsEncryptionLocked');
+export const isDatabaseLeftClear = (): Promise<boolean> => callGo('IsDatabaseLeftClear');
 export const unlockDatabase = (password: string): Promise<void> => callGo('UnlockDatabase', password);
 export const getUnlockLockoutSeconds = (): Promise<number> => callGo('GetUnlockLockoutSeconds');
 export const enableEncryption = (password: string): Promise<void> => callGo('EnableEncryption', password);
diff --git a/frontend/src/lib/i18n/de.json b/frontend/src/lib/i18n/de.json
index d6c8957..dc6ecc9 100644
--- a/frontend/src/lib/i18n/de.json
+++ b/frontend/src/lib/i18n/de.json
@@ -387,6 +387,7 @@
     "disableSuccess": "Verschlüsselung deaktiviert.",
     "unlockTitle": "Datenbank gesperrt",
     "unlockMessage": "Die Protokolldatenbank ist verschlüsselt. Geben Sie Ihr Passwort zum Entsperren ein.",
+    "leftClear": "Diese Datenbank wurde unverschlüsselt vorgefunden: SyslogStudio hatte sie entschlüsselt und wurde dann ohne Schließen beendet — Absturz, erzwungenes Beenden, Stromausfall. Geben Sie Ihr Passwort ein: Es wird geprüft, die Datenbank öffnet sich wie zuvor und wird beim Schließen von SyslogStudio wieder verschlüsselt.",
     "unlock": "Entsperren",
     "unlocking": "Wird entsperrt …",
     "lockedOutSeconds": "Zu viele Fehlversuche. Gesperrt für {seconds}s.",
diff --git a/frontend/src/lib/i18n/en.json b/frontend/src/lib/i18n/en.json
index 3b26b67..8d21272 100644
--- a/frontend/src/lib/i18n/en.json
+++ b/frontend/src/lib/i18n/en.json
@@ -389,6 +389,7 @@
     "disableSuccess": "Encryption disabled.",
     "unlockTitle": "Database Locked",
     "unlockMessage": "The log database is encrypted. Enter your password to unlock.",
+    "leftClear": "This database was found unencrypted: SyslogStudio had decrypted it and then stopped without closing — a crash, a forced stop, a power cut. Type your password: it is checked, the database opens as it was, and it is encrypted again when SyslogStudio closes.",
     "unlock": "Unlock",
     "unlocking": "Unlocking...",
     "warningTitle": "Important — Read carefully",
diff --git a/frontend/src/lib/i18n/es.json b/frontend/src/lib/i18n/es.json
index 60bb4b9..4b91dcd 100644
--- a/frontend/src/lib/i18n/es.json
+++ b/frontend/src/lib/i18n/es.json
@@ -387,6 +387,7 @@
     "disableSuccess": "Cifrado desactivado.",
     "unlockTitle": "Base de datos bloqueada",
     "unlockMessage": "La base de datos de registros está cifrada. Introduce tu contraseña para desbloquear.",
+    "leftClear": "Esta base de datos se encontró sin cifrar: SyslogStudio la había descifrado y se detuvo sin cerrarse — un fallo, un cierre forzado, un corte de luz. Escriba su contraseña: se comprueba, la base se abre tal como estaba y se vuelve a cifrar al cerrar SyslogStudio.",
     "unlock": "Desbloquear",
     "unlocking": "Desbloqueando…",
     "lockedOutSeconds": "Demasiados intentos fallidos. Bloqueado durante {seconds}s.",
diff --git a/frontend/src/lib/i18n/fr.json b/frontend/src/lib/i18n/fr.json
index 9cebd81..6de1a2e 100644
--- a/frontend/src/lib/i18n/fr.json
+++ b/frontend/src/lib/i18n/fr.json
@@ -389,6 +389,7 @@
     "disableSuccess": "Chiffrement désactivé.",
     "unlockTitle": "Base de données verrouillée",
     "unlockMessage": "La base de données est chiffrée. Entrez votre mot de passe pour la déverrouiller.",
+    "leftClear": "Cette base a été trouvée non chiffrée : SyslogStudio l’avait déchiffrée puis s’est arrêté sans se fermer — plantage, arrêt forcé, coupure de courant. Saisissez votre mot de passe : il est vérifié, la base s’ouvre telle qu’elle était et elle est chiffrée à nouveau à la fermeture de SyslogStudio.",
     "unlock": "Déverrouiller",
     "unlocking": "Déverrouillage...",
     "warningTitle": "Important — Lisez attentivement",
diff --git a/frontend/src/lib/i18n/it.json b/frontend/src/lib/i18n/it.json
index 8d65c6c..af9e1a1 100644
--- a/frontend/src/lib/i18n/it.json
+++ b/frontend/src/lib/i18n/it.json
@@ -387,6 +387,7 @@
     "disableSuccess": "Crittografia disabilitata.",
     "unlockTitle": "Database bloccato",
     "unlockMessage": "Il database dei log è cifrato. Inserisci la password per sbloccarlo.",
+    "leftClear": "Questo database è stato trovato non cifrato: SyslogStudio lo aveva decifrato e si è fermato senza chiudersi — un crash, un arresto forzato, un’interruzione di corrente. Inserisci la password: viene verificata, il database si apre com’era e viene cifrato di nuovo alla chiusura di SyslogStudio.",
     "unlock": "Sblocca",
     "unlocking": "Sblocco in corso…",
     "lockedOutSeconds": "Troppi tentativi falliti. Bloccato per {seconds}s.",
diff --git a/frontend/src/lib/i18n/ja.json b/frontend/src/lib/i18n/ja.json
index 9b7b5ca..a4417e6 100644
--- a/frontend/src/lib/i18n/ja.json
+++ b/frontend/src/lib/i18n/ja.json
@@ -387,6 +387,7 @@
     "disableSuccess": "暗号化を無効にしました。",
     "unlockTitle": "データベースがロックされています",
     "unlockMessage": "ログデータベースは暗号化されています。ロックを解除するにはパスワードを入力してください。",
+    "leftClear": "このデータベースは暗号化されていない状態で見つかりました。SyslogStudio が復号したあと、正常に終了せずに停止しました (クラッシュ、強制終了、停電など)。パスワードを入力してください。パスワードが確認されるとデータベースはそのまま開き、SyslogStudio の終了時に再び暗号化されます。",
     "unlock": "ロック解除",
     "unlocking": "ロック解除中…",
     "lockedOutSeconds": "失敗回数が多すぎます。{seconds}秒間ロックされます。",
diff --git a/frontend/src/lib/i18n/pt.json b/frontend/src/lib/i18n/pt.json
index e864500..a0d7cd1 100644
--- a/frontend/src/lib/i18n/pt.json
+++ b/frontend/src/lib/i18n/pt.json
@@ -387,6 +387,7 @@
     "disableSuccess": "Criptografia desativada.",
     "unlockTitle": "Banco de dados bloqueado",
     "unlockMessage": "O banco de dados de logs está criptografado. Digite sua senha para desbloquear.",
+    "leftClear": "Esta base de dados foi encontrada sem cifra: o SyslogStudio tinha-a decifrado e parou sem fechar — uma falha, uma paragem forçada, um corte de energia. Introduza a sua palavra-passe: é verificada, a base abre-se como estava e volta a ser cifrada quando o SyslogStudio fechar.",
     "unlock": "Desbloquear",
     "unlocking": "Desbloqueando…",
     "lockedOutSeconds": "Muitas tentativas com falha. Bloqueado por {seconds}s.",
diff --git a/frontend/src/lib/i18n/zh.json b/frontend/src/lib/i18n/zh.json
index 23f491a..14eb4e1 100644
--- a/frontend/src/lib/i18n/zh.json
+++ b/frontend/src/lib/i18n/zh.json
@@ -387,6 +387,7 @@
     "disableSuccess": "已禁用加密。",
     "unlockTitle": "数据库已锁定",
     "unlockMessage": "日志数据库已加密。请输入密码以解锁。",
+    "leftClear": "发现此数据库未加密：SyslogStudio 解密后未正常关闭就停止了（崩溃、强制停止或断电）。请输入密码：密码验证通过后，数据库按原样打开，并在 SyslogStudio 关闭时重新加密。",
     "unlock": "解锁",
     "unlocking": "正在解锁…",
     "lockedOutSeconds": "失败次数过多。已锁定 {seconds} 秒。",
diff --git a/frontend/wailsjs/go/main/App.d.ts b/frontend/wailsjs/go/main/App.d.ts
index 8dbf630..b616c0c 100644
--- a/frontend/wailsjs/go/main/App.d.ts
+++ b/frontend/wailsjs/go/main/App.d.ts
@@ -178,6 +178,8 @@ export function InstallSystemService(arg1:boolean,arg2:boolean):Promise<void>;
 
 export function IsCAKeyUnencrypted():Promise<boolean>;
 
+export function IsDatabaseLeftClear():Promise<boolean>;
+
 export function IsEncryptionEnabled():Promise<boolean>;
 
 export function IsEncryptionLocked():Promise<boolean>;
diff --git a/frontend/wailsjs/go/main/App.js b/frontend/wailsjs/go/main/App.js
index 471ed41..9bdde16 100644
--- a/frontend/wailsjs/go/main/App.js
+++ b/frontend/wailsjs/go/main/App.js
@@ -346,6 +346,10 @@ export function IsCAKeyUnencrypted() {
   return window['go']['main']['App']['IsCAKeyUnencrypted']();
 }
 
+export function IsDatabaseLeftClear() {
+  return window['go']['main']['App']['IsDatabaseLeftClear']();
+}
+
 export function IsEncryptionEnabled() {
   return window['go']['main']['App']['IsEncryptionEnabled']();
 }
diff --git a/internal/engine/encryption.go b/internal/engine/encryption.go
index fbba598..49bf2f5 100644
--- a/internal/engine/encryption.go
+++ b/internal/engine/encryption.go
@@ -60,6 +60,12 @@ func (e *Engine) IsEncryptionEnabled() bool {
 	return e.configStore.LoadStorage().EncryptionEnabled
 }
 
+// IsDatabaseLeftClear says the locked database was found in the clear, left
+// so by a session that ended without closing: the password encrypts it again.
+func (e *Engine) IsDatabaseLeftClear() bool {
+	return e.logStore != nil && e.logStore.LeftClear()
+}
+
 // IsEncryptionLocked returns true if the database is encrypted and not yet unlocked.
 func (e *Engine) IsEncryptionLocked() bool {
 	return e.logStore != nil && e.logStore.IsLocked()
@@ -113,6 +119,15 @@ func (e *Engine) UnlockDatabase(password string) error {
 	var prev string
 	var usedPrev bool
 	master, legacy, err := e.masterFor(password)
+	if err == nil && legacy && e.logStore.LeftClear() {
+		// No keyring to check it, and no encrypted database to fail on: the
+		// password is about to encrypt everything again, and a mistyped one
+		// would lock its owner out. The other files it encrypts say whether
+		// it is the one.
+		if rerr := e.readableWith(password); rerr != nil {
+			err = fmt.Errorf("wrong password: %w", rerr)
+		}
+	}
 	if err == nil {
 		prev, usedPrev, err = e.unlockStore(master)
 	}
diff --git a/internal/engine/leftclear_test.go b/internal/engine/leftclear_test.go
new file mode 100644
index 0000000..11adebf
--- /dev/null
+++ b/internal/engine/leftclear_test.go
@@ -0,0 +1,136 @@
+package engine
+
+import (
+	"io"
+	"os"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"SyslogStudio/internal/event"
+	"SyslogStudio/internal/models"
+	"SyslogStudio/internal/storage"
+)
+
+// copyDir copies what a running engine has on disk, as a process killed
+// mid-session leaves it: the database in the clear, its WAL, the keyring and
+// the configuration. Not the engine's lock, which dies with its process.
+func copyDir(t *testing.T, from, to string) {
+	t.Helper()
+	entries, err := os.ReadDir(from)
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, e := range entries {
+		if e.IsDir() || e.Name() == "engine.lock" {
+			continue
+		}
+		src, err := os.Open(filepath.Join(from, e.Name()))
+		if err != nil {
+			t.Fatal(err)
+		}
+		dst, err := os.Create(filepath.Join(to, e.Name()))
+		if err != nil {
+			src.Close()
+			t.Fatal(err)
+		}
+		_, err = io.Copy(dst, src)
+		src.Close()
+		dst.Close()
+		if err != nil {
+			t.Fatal(err)
+		}
+	}
+}
+
+func openAt(t *testing.T, dir string) *Engine {
+	t.Helper()
+	e := New(storage.NewConfigStoreAt(dir))
+	if err := e.Open(event.NewMockEventEmitter()); err != nil {
+		t.Fatal(err)
+	}
+	return e
+}
+
+// An encrypted database decrypted by a session that was then killed — a
+// crash, a forced stop, the power — was found in the clear at the next start,
+// opened without its password, and never encrypted again. It now waits for
+// the password, opens as it was, and is encrypted again when closed.
+func TestEncryption_LeftInTheClearByAKilledSession(t *testing.T) {
+	const password = "correct horse battery"
+	at := time.Now().Add(-time.Hour).UTC()
+	var msgs []models.SyslogMessage
+	for _, id := range []string{"a", "b", "c"} {
+		msgs = append(msgs, models.SyslogMessage{ID: id, Timestamp: at, ReceivedAt: at, Severity: models.SevNotice,
+			SeverityLabel: "Notice", FacilityLabel: "user", Message: "message " + id, RawMessage: "message " + id,
+			SourceIP: "10.0.0.1", Protocol: "UDP"})
+	}
+
+	encrypted, _ := openEngine(t, msgs)
+	dir := encrypted.DataDir()
+	if err := encrypted.EnableEncryption(password); err != nil {
+		t.Fatal(err)
+	}
+	encrypted.Close()
+
+	// Unlocked, then killed: copied while it runs.
+	running := openAt(t, dir)
+	if err := running.UnlockDatabase(password); err != nil {
+		t.Fatal(err)
+	}
+	crashed := t.TempDir()
+	copyDir(t, dir, crashed)
+	running.Close()
+	dbPath := storage.DBPathIn(crashed)
+	if _, err := os.Stat(dbPath + ".enc"); !os.IsNotExist(err) {
+		t.Fatalf("the killed session's copy still has its encrypted file: %v", err)
+	}
+
+	e := openAt(t, crashed)
+	if !e.IsEncryptionLocked() || !e.IsDatabaseLeftClear() {
+		t.Fatalf("found in the clear and opened: locked %v, left clear %v", e.IsEncryptionLocked(), e.IsDatabaseLeftClear())
+	}
+	if err := e.UnlockDatabase("not the password"); err == nil {
+		t.Fatal("a wrong password opened it")
+	}
+	if err := e.UnlockDatabase(password); err != nil {
+		t.Fatal(err)
+	}
+	if e.IsDatabaseLeftClear() {
+		t.Error("still said to be left in the clear once unlocked")
+	}
+	if got := e.QueryMessages(models.QueryOptions{PageSize: 10}).Total; got != len(msgs) {
+		t.Fatalf("%d messages after unlocking, want %d", got, len(msgs))
+	}
+	e.Close()
+	if _, err := os.Stat(dbPath + ".enc"); err != nil {
+		t.Fatalf("not encrypted again when closed: %v", err)
+	}
+	if _, err := os.Stat(dbPath); !os.IsNotExist(err) {
+		t.Fatalf("still in the clear after closing: %v", err)
+	}
+
+	// And it opens as any encrypted database does.
+	again := openAt(t, crashed)
+	defer again.Close()
+	if !again.IsEncryptionLocked() || again.IsDatabaseLeftClear() {
+		t.Fatalf("after closing: locked %v, left clear %v", again.IsEncryptionLocked(), again.IsDatabaseLeftClear())
+	}
+	if err := again.UnlockDatabase(password); err != nil {
+		t.Fatal(err)
+	}
+	if got := again.QueryMessages(models.QueryOptions{PageSize: 10}).Total; got != len(msgs) {
+		t.Fatalf("%d messages at the next unlock, want %d", got, len(msgs))
+	}
+}
+
+// A database in the clear with encryption off is just a database: it opens.
+func TestEncryption_ClearDatabaseWithEncryptionOffOpens(t *testing.T) {
+	e, dir := openEngine(t, nil)
+	e.Close()
+	again := openAt(t, dir)
+	defer again.Close()
+	if again.IsEncryptionLocked() || again.IsDatabaseLeftClear() {
+		t.Fatal("a database never encrypted waits for a password")
+	}
+}
diff --git a/internal/remote/backend.go b/internal/remote/backend.go
index 7fc95a8..54116dd 100644
--- a/internal/remote/backend.go
+++ b/internal/remote/backend.go
@@ -76,6 +76,7 @@ type Backend interface {
 	GetUnlockLockoutSeconds() int
 	IsEncryptionEnabled() bool
 	IsEncryptionLocked() bool
+	IsDatabaseLeftClear() bool
 	UnlockDatabase(password string) error
 	EnableEncryption(password string) error
 	DisableEncryption(password string) error
diff --git a/internal/remote/client_gen.go b/internal/remote/client_gen.go
index 1f2771f..c807e68 100644
--- a/internal/remote/client_gen.go
+++ b/internal/remote/client_gen.go
@@ -226,6 +226,12 @@ func (c *Client) IsEncryptionLocked() bool {
 	return r0
 }
 
+func (c *Client) IsDatabaseLeftClear() bool {
+	var r0 bool
+	c.logLost("IsDatabaseLeftClear", c.call("IsDatabaseLeftClear", []any{}, &r0))
+	return r0
+}
+
 func (c *Client) UnlockDatabase(password string) error {
 	err := c.call("UnlockDatabase", []any{password})
 	return err
diff --git a/internal/remote/switch_gen.go b/internal/remote/switch_gen.go
index 77d896c..7b0f68a 100644
--- a/internal/remote/switch_gen.go
+++ b/internal/remote/switch_gen.go
@@ -164,6 +164,10 @@ func (s *Switch) IsEncryptionLocked() bool {
 	return s.Current().IsEncryptionLocked()
 }
 
+func (s *Switch) IsDatabaseLeftClear() bool {
+	return s.Current().IsDatabaseLeftClear()
+}
+
 func (s *Switch) UnlockDatabase(password string) error {
 	return s.Current().UnlockDatabase(password)
 }
diff --git a/internal/storage/logstore.go b/internal/storage/logstore.go
index 0497b1a..8a74f91 100644
--- a/internal/storage/logstore.go
+++ b/internal/storage/logstore.go
@@ -63,6 +63,11 @@ type LogStore struct {
 
 	locked             bool   // true if encrypted db exists but not yet unlocked
 	encryptionPassword string // in-memory only, set when unlocked or encryption enabled
+	// leftClear is a database encryption is on for, found in the clear: a
+	// session decrypted it and ended without closing (a crash, a kill, the
+	// power), so it was never encrypted again. It waits for the password
+	// like an encrypted one, is opened as it is, and encrypted when closed.
+	leftClear bool
 
 	// gate lets the flush write while nothing rewrites the whole database:
 	// flushes hold it shared, a VACUUM or an index rebuild exclusively — and
@@ -103,6 +108,14 @@ func NewLogStore(config models.StorageConfig, emitter event.EventEmitter) (*LogS
 		slog.Info("encrypted database found, awaiting unlock", "path", dbPath+".enc")
 		return &LogStore{config: config, emitter: emitter, locked: true}, nil
 	}
+	// Opened in the clear without its password, it was never encrypted again:
+	// the next close had no password to encrypt it with.
+	if config.EncryptionEnabled {
+		if _, err := os.Stat(dbPath); err == nil {
+			slog.Warn("database left in the clear by a session that did not close, awaiting unlock", "path", dbPath)
+			return &LogStore{config: config, emitter: emitter, locked: true, leftClear: true}, nil
+		}
+	}
 
 	return openDatabase(dbPath, config, emitter)
 }
@@ -178,9 +191,14 @@ func (ls *LogStore) UnlockAndOpen(password string) error {
 		p.Percent = p.Percent * 0.70
 		ls.emitCryptoProgress(p)
 	}
-	// The current format is decrypted a chunk at a time; a file written
-	// before it, whole, as it always was.
-	if vault.IsVaultFile(encPath) {
+	switch {
+	case ls.leftClear && !EncryptedFileExists(dbPath):
+		// Nothing to decrypt: the database is there, as the interrupted
+		// session left it. The password, checked by the caller, encrypts
+		// it again when the store closes.
+	case vault.IsVaultFile(encPath):
+		// The current format is decrypted a chunk at a time; a file
+		// written before it, whole, as it always was.
 		size := fileSize(encPath)
 		_, err := vault.DecryptFile(encPath, dbPath, password, func(done int64) {
 			scaledProgress(CryptoProgress{Phase: "decrypting", Percent: percentOf(done, size), SizeMB: float64(size) / (1 << 20)})
@@ -188,8 +206,10 @@ func (ls *LogStore) UnlockAndOpen(password string) error {
 		if err != nil {
 			return err
 		}
-	} else if err := DecryptFileWithProgress(encPath, dbPath, password, scaledProgress); err != nil {
-		return err
+	default:
+		if err := DecryptFileWithProgress(encPath, dbPath, password, scaledProgress); err != nil {
+			return err
+		}
 	}
 
 	// Decryption succeeded — remove encrypted file
@@ -219,6 +239,7 @@ func (ls *LogStore) UnlockAndOpen(password string) error {
 	ls.buffer = make([]models.SyslogMessage, 0, 256)
 	ls.stopCh = make(chan struct{})
 	ls.locked = false
+	ls.leftClear = false
 	ls.encryptionPassword = password
 	ls.ftsReadyCh = make(chan struct{})
 	ls.mu.Unlock()
@@ -261,6 +282,14 @@ func (ls *LogStore) IsReady() bool {
 	return ls.ftsReady
 }
 
+// LeftClear says the locked database was found in the clear: a session that
+// had decrypted it ended without closing. Unlocking it encrypts it again.
+func (ls *LogStore) LeftClear() bool {
+	ls.mu.Lock()
+	defer ls.mu.Unlock()
+	return ls.locked && ls.leftClear
+}
+
 // IsLocked returns true if the database is encrypted and not yet unlocked.
 func (ls *LogStore) IsLocked() bool {
 	ls.mu.Lock()