정책은 한 번 정해

# BEFORE - one app, fail-fast. Defensible reasoning: silently
# writing plaintext is worse than not running at all.
def require_enabled() -> None:
    if not _key_available():
        raise RuntimeError(
            "encryption key missing; refusing to start"
        )

# ...called at startup. A machine without the key has a stopped app.


# AFTER - the family posture, chosen deliberately: graceful
# everywhere. The question this answers is not cryptographic, it is
# "what should happen to somebody whose machine is not fully
# provisioned yet" - and the answer is that they can still read
# yesterday's notes.
class Veil:
    def __init__(self, service: str, account: str, env_var: str):
        self._key = _load_key(service, account, env_var)
        if self._key is None:
            log.warning(
                "no encryption key for %s/%s - writing plaintext. "
                "Lines encrypted on another machine will pass "
                "through unreadable.", service, account,
            )

    def encrypt_line(self, text: str) -> str:
        return _encrypt(text, self._key) if self._key else text

    def maybe_decrypt_line(self, line: str) -> str:
        """Opaque pass-through, never an exception: a line this
        machine cannot read still belongs in the file, and a fold
        that raises on it would take the whole record down."""
        if not self._key or not _looks_encrypted(line):
            return line
        try:
            return _decrypt(line, self._key)
        except Exception:
            return line


# What the unification COST, and the part worth budgeting for: it
# forced a decision that two authors had each been making by default
# - and produced one for the third app, which had never had to make
# it. The code change was small. Choosing the family's posture toward
# a half-provisioned machine was the actual work.