A Firefox import logged "Reading browser cookie key from the keychain" with the executable path even though it never touches a keychain, putting a false security-sensitive event in the audit trail; the log now sits behind the Chromium engine check. Also narrows isLockHeld to the Windows probe its doc describes (its only caller already guards on win32) and deletes entryExists, which that dead branch was the last use of.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>