What material this Mac holds for each credential, per role

The presence map. Answers what EXISTS, never what the values are: a role reports configured, absent or unreadable and the response has no field a secret could occupy.

unreadable is distinct from absent on purpose. It means a pending transaction or an unreadable Keychain item, and reporting that as absence would invite a re-entry that overwrites material still on disk. Declared roles are listed even when unreadable, because omitting one renders a role mid-transaction as one the user never configured.