Function worker_secret_reads 

pub fn worker_secret_reads(
    context: &str,
    unit_tables: &HashMap<String, UnitTable>,
    unit_consumes: &HashMap<String, Vec<String>>,
    unit_consumes_aliases: &HashMap<String, HashMap<String, String>>,
    unit_flattened: &HashMap<String, HashMap<String, String>>,
) -> SecretReads

Everything a Worker reads through bynk.Secrets: its own handlers (services and agents) and every provider its composition root builds (#1976).

The provider set mirrors what bynk-emit’s emit_worker_compose instantiates — every local provider, every capability a handler or local provider is given, every derived instance — closed transitively over each provider’s own given, resolved in the provider’s own unit exactly as instantiate_provider_ts_expr resolves it. Walking only handler bodies missed a Secrets.get("X") one given away, while the manifest still said read_complete: true.

An external provider — an adapter’s binding — given bynk’s Secrets reads names no pass can see: its body is TypeScript. Such a Worker’s list is not a census, so complete goes false. No warning is raised for it: nothing is computed, the reads are simply out of the compiler’s sight.