test(secrets-cli): structural no-plaintext assert (base64 '+' JSON-escaping flake) + override doc note

2026-07-19 09:46:26 -04:00
parent 779f8a8d78
commit 6ad710bdbd
2 changed files with 10 additions and 3 deletions
@@ -99,7 +99,10 @@ public sealed class BundleService
    /// verbatim replicate would be silently rejected by the LWW gate, so that single case is written
    /// through <see cref="ISecretStore.UpsertAsync"/> instead — a local-write that restamps the row as
    /// current, which is exactly what makes the operator's forced choice durable rather than flipped
-    /// back on the next reconciliation.
+    /// back on the next reconciliation. Note the narrowed remnant of this: a
+    /// <paramref name="conflictOverride"/> that forces an <em>older, tombstoned</em> bundle row over a
+    /// newer live local row resurrects it, because that forced <see cref="ISecretStore.UpsertAsync"/>
+    /// path clears the tombstone.
    /// </para>
    /// </remarks>
    /// <param name="session">The full session to import into.</param>