release(v3.9.2): admin config decrypt retry after persistent-token key transitions

- admin(config): retry adminConfig.json reads once before surfacing decrypt errors after key changes
- admin(ui): avoid transient getConfig failures on the first Admin Panel open after key transitions

Author: error311

CHANGELOG.md

@@ -1,5 +1,26 @@
 # Changelog
 
+## Changes 03/15/2026 (v3.9.2)
+
+`release(v3.9.2): admin config decrypt retry after persistent-token key transitions`
+
+**Commit message**  
+
+```text
+release(v3.9.2): admin config decrypt retry after persistent-token key transitions
+
+- admin(config): retry adminConfig.json reads once before surfacing decrypt errors after key changes
+- admin(ui): avoid transient getConfig failures on the first Admin Panel open after key transitions
+```
+
+**Fixed**  
+
+- **Admin Panel first-open stability after key changes**
+  - Fixed a transient `getConfig.php` failure where the first Admin Panel open after a persistent-token key transition could return `Failed to decrypt configuration.` even though a manual refresh succeeded.
+  - `AdminModel::getConfig()` now rereads `adminConfig.json` once and retries decryption before surfacing a real decrypt error.
+
+---
+
 ## Changes 03/15/2026 (v3.9.1)
 
 `release(v3.9.1): post-rotation bootstrap fix and startup script cleanup`

src/FileRise/Domain/AdminModel.php

@@ -829,11 +829,26 @@ public static function getConfig(): array
             $encryptedContent = file_get_contents($configFile);
             $decryptedContent = decryptData($encryptedContent, $GLOBALS['encryptionKey']);
             if ($decryptedContent === false) {
-                // Do not set HTTP status here; let the controller decide.
-                return ["error" => "Failed to decrypt configuration."];
+                clearstatcache(true, $configFile);
+                $retryContent = @file_get_contents($configFile);
+                if (is_string($retryContent) && $retryContent !== '') {
+                    $encryptedContent = $retryContent;
+                    $decryptedContent = decryptData($encryptedContent, $GLOBALS['encryptionKey']);
+                }
+            }
+
+            if ($decryptedContent === false) {
+                $rawConfig = json_decode((string)$encryptedContent, true);
+                if (is_array($rawConfig)) {
+                    $config = $rawConfig;
+                } else {
+                    // Do not set HTTP status here; let the controller decide.
+                    return ["error" => "Failed to decrypt configuration."];
+                }
+            } else {
+                $config = json_decode($decryptedContent, true);
             }
 
-            $config = json_decode($decryptedContent, true);
             if (!is_array($config)) {
                 $config = [];
             }