When a Skarbiec read fails

What Stado does when a credential read through Skarbiec fails, failure by failure. How Stado reads credentials is on Skarbiec and Stado.

Failure	Result
Missing item or field	The exact operation fails; Stado does not guess a replacement.
No item carries the role read (stado credentials get <role>)	Refused as not found, naming the consumer and the tag stado:role:<role>: the item may exist untagged or outside the consumer's grant. Tag it with stado credentials item retag --host <vault owner> <item> --tags stado:role:<role> (retag replaces the item's tags, so list the ones it keeps beside it), or grant the consumer the item that carries it. --field does not help here; it is suggested only when the vault answers a whole-item read with 400 because it serves one field at a time.
Consumer lacks the field grant	Skarbiec returns an authorization refusal; widening the caller is not an automatic repair.
Token file missing, empty, or not owner-only	Stado refuses before sending the request.
skarbiec.local missing or unsafe	Endpoint resolution fails closed; reconcile the service directory.
Skarbiec unavailable	Secret-dependent operations fail; unrelated queue and compute work may continue when it needs no secret. The object API answers each request whose bearer it cannot compare with 503 and the server's own wait line as cause, and never holds it behind another request's read (A request that would stand behind the vault).
Skarbiec's audit journal lock wedges credential reads	stado repair skarbiec --step audit-lock --target <vault host> --apply restarts Skarbiec when its health names the audit journal lock, and the Stado process that serves the object API when that API reports "object":false, and succeeds once Skarbiec reports ok and the object boundary "object":true; an unhealthy Skarbiec whose health names no audit-lock failure, or an object API that answers no boundary verdict, is refused, and with both already healthy it changes nothing (Declared repair). Its readiness reads wait within the directory refresh interval this host's resolver declares, which Stado hands it as SKARBIEC_READY_WITHIN_SECONDS; with no interval declared the repair is refused as stado.repair.skarbiec.bound-undeclared, and with one that cannot be read as stado.repair.skarbiec.bound-unread.
Requested store differs from persisted selector	All ordinary access stops until verified migration completes.
An item listing that omits an item's deleted flag	Refused as an invalid item-list response. Skarbiec's item list states the flag for every item and the file store has no trash, so a listing without it is not read as all live.
stado credentials migrate meets a source item listed without a type	Refused by item id before anything is copied: the destination would have to store it under a type nobody stated.
stado credentials migrate names the store already in use	The selector is committed and nothing is copied: credentials already live in <locator>: the selector is kept and nothing was copied.
Replica has the same item id but is outside the declared topology	It is not used as a fallback. Repair service placement or synchronization.
Runtime secret is stale	stado service auth check identifies the failing boundary; --repair performs one declared synchronization and recheck.

No path silently reads a checked-in .env, a cloud CLI login, an unrelated local vault, or a provider's ambient credential chain merely because the declared Skarbiec read failed.