fix(secrets-cli): KEK doctor — fresh-row verdicts, degraded rewrap guard test, vanished-row visibility

ZB.MOM.WW.Secrets/tests/ZB.MOM.WW.Secrets.Tests/Cli/Interactive/KekDoctorTests.cs

@@ -86,11 +86,31 @@ public sealed class KekDoctorTests : IAsyncLifetime, IDisposable
         Assert.True(report.Healthy);
         Assert.Equal(_kekA.KekId, report.SessionKekId);
         Assert.Equal(2, report.Rows.Count);
+        Assert.Equal(2, report.Total); // no rows vanished → Total equals Rows.Count.
         Assert.All(report.Rows, r => Assert.Equal(RowKekStatus.Ok, r.Status));
         // Rows ordered by name: "ldap/b" precedes "sql/a".
         Assert.Equal(["ldap/b", "sql/a"], report.Rows.Select(r => r.SecretName));
     }
 
+    [Fact]
+    public async Task Diagnose_verdict_reads_fresh_row_kek_not_stale_metadata()
+    {
+        // Seed under A; a first diagnosis on session A reports Ok.
+        await SeedAsync("sql/a", "value-a", _kekA);
+        KekDoctorReport first = await new KekDoctor().DiagnoseAsync(Session(_kekA), CancellationToken.None);
+        Assert.Equal(RowKekStatus.Ok, Assert.Single(first.Rows).Status);
+
+        // Re-seal the SAME row under B (simulates a concurrent re-wrap/re-set moving its KEK). A second
+        // diagnosis on session A must classify from the FRESH row.KekId (B) → WrongKek surfacing B's id,
+        // never a false Corrupt from probing a row the session cannot open.
+        await SeedAsync("sql/a", "value-a", _kekB);
+        KekDoctorReport second = await new KekDoctor().DiagnoseAsync(Session(_kekA), CancellationToken.None);
+
+        KekDiagnosis row = Assert.Single(second.Rows);
+        Assert.Equal(RowKekStatus.WrongKek, row.Status);
+        Assert.Equal(_kekB.KekId, row.RowKekId);
+    }
+
     [Fact]
     public async Task Diagnose_reports_wrong_kek_rows_with_their_kekid()
     {
@@ -149,6 +169,15 @@ public sealed class KekDoctorTests : IAsyncLifetime, IDisposable
         Assert.Contains("key", ex.Message, StringComparison.OrdinalIgnoreCase);
     }
 
+    [Fact]
+    public async Task RewrapAll_throws_on_degraded_session()
+    {
+        InvalidOperationException ex = await Assert.ThrowsAsync<InvalidOperationException>(
+            () => new KekDoctor().RewrapAllAsync(DegradedSession(), _kekA, CancellationToken.None));
+
+        Assert.Contains("key", ex.Message, StringComparison.OrdinalIgnoreCase);
+    }
+
     [Fact]
     public async Task RewrapAll_moves_wrong_kek_rows_onto_session_kek()
     {