Harden secret provisioning and lifecycle controls

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a0217e-8c4c-7383-be6b-f50a6e485306

tests/test_existing_lane_admission.py

@@ -36,13 +36,13 @@ class RecordingApplyClient:
 
 class RecordingProvisionClient:
     def __init__(self):
-        self.puts = []
+        self.patches = []
 
     def ensure_kv_mount(self, _mount):
         raise AssertionError("existing mount must not be created during provision")
 
-    def kv_put(self, mount, path, field, value):
-        self.puts.append((mount, path, field, value))
+    def kv_patch_fields(self, mount, path, values):
+        self.patches.append((mount, path, values))
 
 
 def _existing_mount_entry():
@@ -97,8 +97,43 @@ def test_provision_existing_mount_never_attempts_mount_creation(tmp_path):
     os.chmod(value_file, 0o600)
     client = RecordingProvisionClient()
     provision_from_file(client, entry, "api_token", value_file)
-    assert client.puts == [
-        ("platform", "workloads/example/runtime", "api_token", "test-only-value")
+    assert client.patches == [
+        (
+            "platform",
+            "workloads/example/runtime",
+            {"api_token": "test-only-value"},
+        )
+    ]
+
+
+def test_provision_existing_multi_field_path_uses_merge_safe_backend(tmp_path):
+    data = copy.deepcopy(VALID)
+    data.update(
+        {
+            "stage": "prod",
+            "mount": "platform",
+            "path": "workloads/example/runtime",
+            "mount_management": "existing",
+            "fields": ["api_token", "webhook_secret"],
+            "workload_delivery": [
+                {"mode": "external-secrets", "owner": "rapp-example"}
+            ],
+        }
+    )
+    entry = validate_entry(data)
+    value_file = tmp_path / "value"
+    value_file.write_text("test-only-value", encoding="utf-8")
+    os.chmod(value_file, 0o600)
+    client = RecordingProvisionClient()
+
+    provision_from_file(client, entry, "api_token", value_file)
+
+    assert client.patches == [
+        (
+            "platform",
+            "workloads/example/runtime",
+            {"api_token": "test-only-value"},
+        )
     ]