secureKeyBootDiagnostics function

List<String> secureKeyBootDiagnostics({ required SecureKeyPreloadReport report, required Set<String> referencedKeyNames, required bool debug, String? storeLabel, })

The boot key-snapshot diagnostics (gh-1059): the lines the executable prints after preload. With debug (--debug-secrets / truthy FA_DEBUG_KEYS) one [keys] line per preload outcome plus a summary — found / absent / error: <diagnostic> — so a degraded keychain is diagnosable instead of silently empty. INDEPENDENT of debug:

• one warning fires when the store answered but NONE of the config-referenced referencedKeyNames resolved — the "every provider boots keyless with no log trail" state — naming the count;
• a per-name warning fires whenever any referenced name classified error (gh-1059 review: a boot where 7 of 8 keys fail to read but one resolves is just as keyless for those 7) — the store ANSWERED and failed, exactly the state worth naming.

Implementation

List<String> secureKeyBootDiagnostics({
  required SecureKeyPreloadReport report,
  required Set<String> referencedKeyNames,
  required bool debug,
  String? storeLabel,
}) {
  final lines = <String>[];
  final label = storeLabel ?? 'secure store';
  if (!report.storeAvailable) {
    // Referenced store keys with no backend resolve 0 too — the boot is
    // keyless for them all the same ("never stay invisible").
    return _storeUnavailableLines(
      label: label,
      debug: debug,
      referencedKeyNames: referencedKeyNames,
    );
  }
  if (debug) {
    lines.addAll(
      _debugKeyLines(
        report: report,
        referencedKeyNames: referencedKeyNames,
        label: label,
      ),
    );
  }
  final resolvedReferenced = _referencedNamesWithStatus(
    referencedKeyNames,
    report,
    SecureKeyReadStatus.found,
  );
  if (referencedKeyNames.isNotEmpty && resolvedReferenced.isEmpty) {
    final hint = _bootWarningHint(debug, 'the per-name reads');
    lines.add(
      'warning: ${referencedKeyNames.length} provider key(s) referenced by '
      'the config (custom providers / roles) resolved NOTHING from the '
      '$label — those providers boot keyless; re-enter a key or $hint '
      '(the stored values were not touched)',
    );
  }
  // gh-1059 review: `error` means the store answered and FAILED — the
  // exact state worth naming, even when other referenced keys resolved.
  final erroredReferenced = _referencedNamesWithStatus(
    referencedKeyNames,
    report,
    SecureKeyReadStatus.error,
  ).toList()..sort();
  if (erroredReferenced.isNotEmpty) {
    final hint = _bootWarningHint(debug, 'the errors');
    lines.add(
      'warning: ${erroredReferenced.length} provider key(s) referenced by '
      'the config failed to read from the $label: '
      '${erroredReferenced.join(', ')} — those providers boot keyless; '
      're-enter a key or $hint (the stored values were not touched)',
    );
  }
  return lines;
}