fix(startup): lead the damaged-store screen with the repair, not retry

A reporter on #1732 ran three successive builds against a preference store of
10336 bytes, every one of them zero, and reported each as "still failing". The
gate classified it correctly every time and the consented repair would have
cleared it in-process, but nothing on the failure screen said so: Retry was
first, styled `FilledButton`, and autofocused, while `Repair storage` sat beside
it as a tonal afterthought. Retry re-reads the same document, so for a
corrupt-store failure it is an action that cannot succeed however many times it
is pressed — and it was the one the screen recommended.

Repair now takes the primary styling, the focus node and first position whenever
it is offered, and the body text says plainly that retrying will not help.
Retry keeps its place for every other failure, where a locked database or a
denied directory really can change between attempts.

The consent dialog was also promising an outcome it could not always deliver.
Servers and profiles survive a repair only because their tokens are ciphertext
in the database and the key that decrypts them lives in the store, so a store
the key cannot be read out of signs the user out of everything — exactly the
all-zero case. `PrefsRecovery.previewSalvage` reads the damaged file without
touching it, and the dialog now names the real cost from that. The retained copy is
labelled as holding credentials unless the bytes prove otherwise: what the
salvage recovered says nothing about what the file still contains, because a
store truncated mid-value keeps most of a vault key in plaintext while the
salvage pattern — which needs the value's closing quote — matches nothing at
all. Only an all-zero file drops the warning, so the one case that cries wolf
is the one that provably holds no secret.

`describe()` finally carries whether a repair was on offer. That line is the
difference between a report a maintainer can act on and two days of guessing
whether the button was even on screen.

close #1732

test/widgets/startup_failure_view_test.dart

@@ -21,6 +21,7 @@ Future<void> _pumpView(
   WidgetTester tester, {
   required bool restartRequired,
   Future<bool> Function()? onExitRequested,
+  bool repairable = true,
 }) async {
   await tester.pumpWidget(
     TranslationProvider(
@@ -30,7 +31,7 @@ Future<void> _pumpView(
             failure: _record(),
             restartRequired: restartRequired,
             onRetry: () {},
-            onRepair: () async {},
+            onRepair: repairable ? () async {} : null,
             requestExit: ({AppExitApplication? exitApplicationForTesting}) async =>
                 onExitRequested == null ? false : await onExitRequested(),
           ),
@@ -41,6 +42,14 @@ Future<void> _pumpView(
   await tester.pump();
 }
 
+/// Whether [key] resolves to the filled (primary) Material button.
+bool _isPrimary(WidgetTester tester, Key key) => tester.widget(find.byKey(key)) is FilledButton;
+
+/// Whether [key]'s enclosing focusable currently holds focus.
+bool _hasFocus(WidgetTester tester, Key key) =>
+    tester.widget<Focus>(find.ancestor(of: find.byKey(key), matching: find.byType(Focus)).first).focusNode?.hasFocus ??
+    false;
+
 void main() {
   setUpAll(() => LocaleSettings.setLocaleSync(AppLocale.en));
 
@@ -53,6 +62,31 @@ void main() {
     expect(find.byKey(startupFailureRestartKey), findsNothing);
   });
 
+  testWidgets('repair leads the screen whenever it is offered', (tester) async {
+    await _pumpView(tester, restartRequired: false);
+
+    // Retry re-reads the same damaged document, so it can never clear this
+    // failure. Presenting it as the primary, autofocused action is what left
+    // the #1732 reporter pressing it and concluding the fix had not shipped.
+    expect(_isPrimary(tester, startupFailureRepairKey), isTrue);
+    expect(_isPrimary(tester, startupBootstrapRetryKey), isFalse);
+    await tester.pump();
+    expect(_hasFocus(tester, startupFailureRepairKey), isTrue);
+    expect(find.text(t.startup.failedBodyRepairable), findsOneWidget);
+  });
+
+  testWidgets('retry leads when no repair can address the failure', (tester) async {
+    await _pumpView(tester, restartRequired: false, repairable: false);
+
+    // A locked database or a denied directory can genuinely change between
+    // attempts, so Retry keeps both the primary styling and the focus there.
+    expect(find.byKey(startupFailureRepairKey), findsNothing);
+    expect(_isPrimary(tester, startupBootstrapRetryKey), isTrue);
+    await tester.pump();
+    expect(_hasFocus(tester, startupBootstrapRetryKey), isTrue);
+    expect(find.text(t.startup.failedBody), findsOneWidget);
+  });
+
   testWidgets('a pending restart withdraws every action that would touch the store', (tester) async {
     await _pumpView(tester, restartRequired: true);
 

test/widgets/startup_repair_outcome_test.dart

@@ -59,6 +59,71 @@ void main() {
     expect(find.text(backup.path), findsOneWidget);
   });
 
+  testWidgets('a backup with nothing in it still offers deletion but claims no secrets', (tester) async {
+    // The #1732 store was 10336 zero bytes. Telling the user that copy holds
+    // their sign-ins is false, and a warning that cries wolf is the one they
+    // will ignore on the launch where the file really is sensitive.
+    await _openDialog(
+      tester,
+      PrefsRepairOutcome(
+        backupPath: backup.path,
+        backupHoldsCredentials: false,
+        vaultKeySalvaged: false,
+        sessionsSalvaged: 0,
+        sessionsLost: 0,
+      ),
+    );
+
+    expect(find.text(t.startup.backupTitle), findsOneWidget);
+    expect(find.text(backup.path), findsOneWidget);
+    expect(find.text(t.startup.backupWarning), findsNothing);
+    expect(find.text(t.startup.deleteBackup), findsOneWidget);
+  });
+
+  group('consent copy', () {
+    test('a store with no recoverable vault key promises nothing it cannot keep', () {
+      final message = repairConsentMessage(oneCredential: false, signInsSurvive: false);
+
+      // The #1732 store salvaged nothing. Saying "servers and profiles
+      // normally stay signed in" here would be contradicted by the outcome
+      // dialog moments later.
+      expect(message, contains(t.startup.repairBodyCommon));
+      expect(message, contains(t.startup.repairBodySignInsLost));
+      expect(message, isNot(contains(t.startup.repairBodySignInsKept)));
+    });
+
+    test('a salvageable store keeps the cheaper promise', () {
+      final message = repairConsentMessage(oneCredential: false, signInsSurvive: true);
+
+      expect(message, contains(t.startup.repairBodySignInsKept));
+      expect(message, isNot(contains(t.startup.repairBodySignInsLost)));
+    });
+
+    test('the single-credential repair names its own narrower scope', () {
+      final message = repairConsentMessage(oneCredential: true, signInsSurvive: true);
+
+      expect(message, contains(t.startup.repairBodyOneCredential));
+      expect(message, isNot(contains(t.startup.repairBodyCommon)));
+    });
+
+    test('trackers and Seerr get the same cautious sentence either way', () {
+      // Their sessions are plaintext preference entries, salvaged one by one
+      // and left untouched by the single-credential repair, so they neither
+      // survive nor die with the vault key. Neither branch may borrow that
+      // value's verdict for them.
+      for (final signInsSurvive in [true, false]) {
+        expect(
+          repairConsentMessage(oneCredential: false, signInsSurvive: signInsSurvive),
+          contains(t.startup.repairBodySessionsUncertain),
+        );
+      }
+      expect(
+        repairConsentMessage(oneCredential: true, signInsSurvive: false),
+        contains(t.startup.repairBodySessionsUncertain),
+      );
+    });
+  });
+
   testWidgets('deleting the backup removes the file and stops showing its path', (tester) async {
     final deleted = <String>[];
     await _openDialog(