No-silent-failure contract: audit + enforce try/catch→appEvents+friendly toast, required-field validation toasts, swallowed-catch elimination, error→live-PM DM
Fleet brainstorm bs-mra1eg36m6d (Elazar, 2026-07-07): two silent-failure UX bugs on venus/cmfpost exposed drift of the standing no-silent-failure contract. Pluto leg: (1) read-only census of every 'use server' mutation + every required-field form for the anti-pattern class (no try/catch, swallowed catch with no appEvents write + no rethrow, server action error the client ignores/no toast, required field with no validation-toast); output file:line inventory + counts ranked admin-mutation-paths first; (2) remediate; (3) verify Pluto's applog-listen error→live-PM DM rail covers all LOGGED errors (it does today) and that the write-guarantee closes the swallowed-unlogged gap. Cross-links mars + venus sibling WIs. Pluto already runs the target pipeline (appEvents + applog real-time DM + PM triage) — this VERIFIES not assumes.
Questions
Activity
-
Unblocked — MARS-408 wrapper slice available. Dispatched coder-pluto-cc (vendor slice + retrofit 30 guard-escape actions via vector A) + audit pre-impl/diff/PTD gate. Class-A lean protocol.
-
coder-pluto-cc / coder
-
Audit pre-impl BLESSED (verified vs source) with 1 hardening condition. COUNT corrected 30->31: banner is 2 (saveBanner+clearBanner, getBanner=read), not 1 — same file/class, not scope expansion. Final target = 31: administrar 19, support 5, perfil 3, notification 2, banner 2. CONDITION: classify must key off const-sourced denial strings (or a typed ActionError code), NOT string literals — extract SIN_PERMISOS_MESSAGE + NO_AUTENTICADO_MESSAGE like VIEW_AS_READONLY_MESSAGE, else a future guard-message edit silently drops classify to ERROR tier and cap-denials start paging (the exact regression this WI prevents).
-
Transport+timing decision (Elazar via pm-mars): SHIP the server leg now (guard-escape->appEvents write->typed {ok,error}->toast; transport-agnostic, the urgent silent-failure fix). HOLD the onFriction CLIENT telemetry-write leg + PLUTO-533/534 until after Fri Jul-10 (token reset), and route them via SERVER-ACTION transport (not /api). Server leg released to coder; friction leg built as server-action-shaped stub, not live-wired.
-
SERVER LEG SHIPPED — silent-failure fix live. SHA 70df514 v2.5.0, audit PASS pre-impl+diff+PTD, live /api/app-version==2.5.0 dpl_5ashxK3K3rP3ZdAdTDzz7hAjuKzm READY. All 31 guard-escape mutations now wrap the guard INSIDE the try -> guaranteed appEvents error-tier write + typed {ok,error} + client toast; no user-silent failure path remains. banner gains its missing appEvents write (+latent RangeError fixed); notification IDOR preserved; 3 denial classes consistent at tier:null (single info/authz forensic row, off the pager rail, PLUTO-514/461 discipline intact). Vendored MARS-408 cores byte-for-byte. Client friction-telemetry leg deferred to PLUTO-535 (post-Jul-10, server-action transport).