Exercises the pass-2 path end to end — key lookup, decrypt into tmpfs rather than the on-disk cache, results written into tmpfs and returned as an encrypted .hrb the server stores without a key. The .hek stays out of the repo.
ryan