chore: refine complementation recovery tuple handling

Agent-Logs-Url: https://github.com/securefolderfs-community/SecureFolderFS/sessions/7f21ec24-91c8-445f-b546-67ee44448ae4

Co-authored-by: d2dyno1 <53011783+d2dyno1@users.noreply.github.com>

Author: Copilot

src/Core/SecureFolderFS.Core/Routines/Operational/ModifyComplementationRoutine.cs

@@ -148,15 +148,15 @@ private void ReplaceComplementation(
             var newComplementKey = ExportKey(RequireCredential(credentials.NewComplementCredential, "New complement credentials are required."));
             byte[]? complementSecret = null;
             byte[]? softwareEntropy = null;
-            (byte[] ComplementSecret, byte[] SoftwareEntropy) recoveredSecret;
+            (byte[] ComplementSecret, byte[] SoftwareEntropy) recoveredData;
 
             try
             {
-                recoveredSecret = credentials.CurrentComplementCredential is not null
+                recoveredData = credentials.CurrentComplementCredential is not null
                     ? RecoverComplementSecretFromShare(currentComplementKey = ExportKey(credentials.CurrentComplementCredential), oldAuthentication.Complementation ?? throw new InvalidOperationException("Complementation method is missing."))
                     : RecoverComplementSecretFromPrimary(currentPrimaryKey = ExportKey(RequireCredential(credentials.CurrentPrimaryCredential, "Current primary or complement credentials are required.")), oldAuthentication);
-                complementSecret = recoveredSecret.ComplementSecret;
-                softwareEntropy = recoveredSecret.SoftwareEntropy;
+                complementSecret = recoveredData.ComplementSecret;
+                softwareEntropy = recoveredData.SoftwareEntropy;
 
                 ReEncryptKeystore(complementSecret, softwareEntropy);
                 _sharesDataModel = CreateShares(VaultParser.V4WrapComplementSecret(complementSecret, newComplementKey, GetVaultId(), newComplementMethod));
@@ -211,13 +211,13 @@ private void ChangePrimaryAndPreserveComplementation(
             byte[]? oldComplementSecret = null;
             byte[]? newComplementSecret = null;
             byte[]? softwareEntropy = null;
-            (byte[] ComplementSecret, byte[] SoftwareEntropy) recoveredSecret;
+            (byte[] ComplementSecret, byte[] SoftwareEntropy) recoveredData;
 
             try
             {
-                recoveredSecret = RecoverComplementSecretFromShare(currentComplementKey, oldComplementMethod);
-                oldComplementSecret = recoveredSecret.ComplementSecret;
-                softwareEntropy = recoveredSecret.SoftwareEntropy;
+                recoveredData = RecoverComplementSecretFromShare(currentComplementKey, oldComplementMethod);
+                oldComplementSecret = recoveredData.ComplementSecret;
+                softwareEntropy = recoveredData.SoftwareEntropy;
                 newComplementSecret = DeriveComplementSecret(newPrimaryKey, GetPrimaryMethod(newAuthentication));
 
                 newComplementKey = string.Equals(oldComplementMethod, newComplementMethod, StringComparison.Ordinal)
@@ -252,8 +252,8 @@ private void ChangePrimaryAndPreserveComplementation(
             }
             catch
             {
-                Zero(softwareEntropy);
                 Zero(complementSecret);
+                Zero(softwareEntropy);
                 throw;
             }
         }
@@ -272,14 +272,14 @@ private void ChangePrimaryAndPreserveComplementation(
             }
             catch (CryptographicException) when (fallbackException is not null)
             {
-                Zero(softwareEntropy);
                 Zero(complementSecret);
+                Zero(softwareEntropy);
                 throw fallbackException;
             }
             catch
             {
-                Zero(softwareEntropy);
                 Zero(complementSecret);
+                Zero(softwareEntropy);
                 throw;
             }
         }