fix: reconcile production fixes onto the reorganized main

Dockerfile

@@ -272,6 +272,27 @@ FROM browsers AS core-browser
 
 ARG PDPP_REFERENCE_REVISION=unknown
 
+# Image provenance. Without these the deployed artifact cannot say what source
+# it was built from, and identifying production means md5-diffing files against
+# candidate worktrees. Sampling files that way is actively misleading: a file
+# unchanged between two commits matches BOTH, so a sample that happens to miss
+# the changed files "confirms" the wrong commit. Labels remove the guesswork.
+#
+# PDPP_BUILD_DIRTY must be set from `git status --porcelain` at build time. A
+# silently-dirty build tree is how bad images shipped before, so an unclean
+# tree is recorded in the artifact rather than left to memory.
+ARG PDPP_BUILD_REVISION=unknown
+ARG PDPP_BUILD_SOURCE=unknown
+ARG PDPP_BUILD_CREATED=unknown
+ARG PDPP_BUILD_DIRTY=unknown
+ARG PDPP_BUILD_COMPOSITION=unknown
+
+LABEL org.opencontainers.image.revision="${PDPP_BUILD_REVISION}" \
+      org.opencontainers.image.source="${PDPP_BUILD_SOURCE}" \
+      org.opencontainers.image.created="${PDPP_BUILD_CREATED}" \
+      pdpp.build.dirty="${PDPP_BUILD_DIRTY}" \
+      pdpp.build.composition="${PDPP_BUILD_COMPOSITION}"
+
 # PDPP_LOCAL_TRANSFORMER_SUPERVISOR_RESTART_CONTRACT is baked in (unlike the
 # root docker-compose.yml `reference` service, which sets it explicitly in
 # compose env) because this image stage is deployed exclusively through

apps/console/src/app/(console)/audit/error.tsx

@@ -3,16 +3,60 @@
 // Copyright The PDP-Connect Contributors
 // SPDX-License-Identifier: Apache-2.0
 
-import { SegmentError } from "../components/segment-error.tsx";
+import { useEffect } from "react";
+import { createRetryCounter, nextRetryDelayMs } from "../components/read-resilient-retry.ts";
+import { ListLoadingSkeleton } from "../components/route-loading.tsx";
+
+/**
+ * Audit-segment error boundary (App Router convention) — SLVP bar: Stripe,
+ * Linear, Vercel, and Plaid never tell an owner "we hit a transient read
+ * interruption, retrying." The page renders, or it quietly shows last-known
+ * state. The owner never learns the backend hiccuped.
+ *
+ * Root cause of the throw this boundary catches (`Error: The destination
+ * stream closed early`): the read itself is fine — React's Flight/RSC
+ * streaming writer reacting to the HTTP response closing before the stream
+ * finished flushing. It is a client-transport race below the data layer, not
+ * a backend outage — see `sources/error.tsx` for the full original writeup.
+ *
+ * `/audit` has no client-cached last-known-read marker, so this boundary
+ * shows the plain skeleton with no staleness caption rather than fabricate a
+ * timestamp.
+ *
+ * Self-contained on purpose: a `"use client"` boundary must not import
+ * server-only modules, since the dashboard shell transitively pulls in
+ * `lib/owner-token.ts` (`server-only`).
+ */
+
+/**
+ * Consecutive-failure counter, held at MODULE scope rather than component
+ * state — see `read-resilient-retry.ts` for why a `useState` counter would
+ * silently reset every catch and never actually back off.
+ */
+const retryCounter = createRetryCounter();
+
+export default function AuditError({ error, reset }: { error: Error & { digest?: string }; reset: () => void }) {
+  useEffect(() => {
+    // Logged for operator diagnostics only — never surfaced to the owner.
+    console.error(error);
+  }, [error]);
+
+  useEffect(() => {
+    // Unbounded, capped backoff: every mount (i.e. every failed attempt)
+    // schedules the next retry at a delay that grows with the module-scoped
+    // counter. There is deliberately no ceiling on the counter itself — a
+    // persistent failure degrades to a slow quiet heartbeat, never a dead end.
+    const delay = nextRetryDelayMs(retryCounter.attempts);
+    const id = setTimeout(() => {
+      retryCounter.attempts += 1;
+      reset();
+    }, delay);
+    return () => clearTimeout(id);
+  }, [reset]);
 
-export default function AuditError(props: { error: Error & { digest?: string }; reset: () => void }) {
   return (
-    <SegmentError
-      {...props}
-      backHref="/audit"
-      backLabel="Back to audit"
-      description="The audit view ran into an error while reading from your reference deployment. Reading failed; nothing changed. Try again, or check your reference deployment status."
-      title="Couldn't load your audit log"
-    />
+    <div data-testid="audit-read-recovering">
+      <ListLoadingSkeleton label="audit events" rows={8} />
+    </div>
   );
 }

apps/console/src/app/(console)/audit/read-resilience.invariants.test.ts

@@ -0,0 +1,88 @@
+// Copyright The PDP-Connect Contributors
+// SPDX-License-Identifier: Apache-2.0
+
+/**
+ * Read-resilience acceptance invariants for the audit segment, mirroring
+ * `sources/read-resilience.invariants.test.ts`. See that file and
+ * `syncs/read-resilience.invariants.test.ts` for the full standard this
+ * pattern enforces; this file pins the same properties for `/audit`.
+ */
+
+import assert from "node:assert/strict";
+import { readFile } from "node:fs/promises";
+import test from "node:test";
+import { fileURLToPath } from "node:url";
+
+const HERE = fileURLToPath(new URL(".", import.meta.url));
+const ERROR_FILE = `${HERE}error.tsx`;
+
+const BLOCK_COMMENT_RE = /\/\*[\s\S]*?\*\//g;
+
+/**
+ * Strip `/* ... *‍/` block comments before checking for retired owner-facing
+ * copy. The boundary's doc comment legitimately QUOTES the retired phrases
+ * (to explain what this pattern replaces and why) — that is documentation,
+ * not rendered JSX text, so it must not trip the ban.
+ */
+function withoutBlockComments(src: string): string {
+  return src.replace(BLOCK_COMMENT_RE, "");
+}
+
+const RETIRED_COULDNT_RE = /Couldn't/;
+const RETIRED_ERROR_HEADING_RE = /Read error/;
+const RETIRED_TRY_AGAIN_RE = /Try again/;
+const RETIRED_INTERRUPTION_COPY_RE = /transient read interruption/i;
+const RETIRED_READ_FAILURE_FRAMING_RE = /read failure/i;
+const RETIRED_BACK_LINK_RE = /Back to audit/;
+const RETIRED_SEGMENT_ERROR_IMPORT_RE = /from\s+["']\.\.\/components\/segment-error\.tsx["']/;
+
+const USES_LOADING_SKELETON_RE = /<ListLoadingSkeleton\b/;
+const IMPORTS_LOADING_SKELETON_RE = /from\s+["']\.\.\/components\/route-loading\.tsx["']/;
+const RECOVERING_TESTID_RE = /data-testid="audit-read-recovering"/;
+const SERVER_ONLY_IMPORT_RE = /^import[\s\S]*?from\s+["'][^"']*(owner-token|server-only|data-source|ref-client)/m;
+const CALLS_RESET_RE = /reset\(\)/;
+const UNBOUNDED_RETRY_SCHEDULES_NEXT_RE = /setTimeout\([\s\S]*reset\(\)/;
+const MODULE_SCOPE_COUNTER_RE = /const retryCounter = createRetryCounter\(\)/;
+const NO_REACT_STATE_COUNTER_RE = /useState\(/;
+const IMPORTS_SHARED_RETRY_RE = /from\s+["']\.\.\/components\/read-resilient-retry\.ts["']/;
+const NO_TERMINAL_GIVE_UP_FLAG_RE = /gaveUp|autoRetried|maxAttemptsReached/;
+
+test("the boundary source contains none of the retired owner-facing failure copy outside doc comments", async () => {
+  const rawSrc = await readFile(ERROR_FILE, "utf8");
+  const src = withoutBlockComments(rawSrc);
+  assert.doesNotMatch(src, RETIRED_COULDNT_RE);
+  assert.doesNotMatch(src, RETIRED_ERROR_HEADING_RE);
+  assert.doesNotMatch(src, RETIRED_TRY_AGAIN_RE);
+  assert.doesNotMatch(src, RETIRED_INTERRUPTION_COPY_RE);
+  assert.doesNotMatch(src, RETIRED_READ_FAILURE_FRAMING_RE);
+  assert.doesNotMatch(src, RETIRED_BACK_LINK_RE);
+  assert.doesNotMatch(rawSrc, RETIRED_SEGMENT_ERROR_IMPORT_RE);
+});
+
+test("the boundary renders the same loading skeleton the route's loading.tsx uses, not a bespoke banner", async () => {
+  const src = await readFile(ERROR_FILE, "utf8");
+  assert.match(src, IMPORTS_LOADING_SKELETON_RE);
+  assert.match(src, USES_LOADING_SKELETON_RE);
+  assert.match(src, RECOVERING_TESTID_RE);
+  // loading.tsx uses ListLoadingSkeleton label="audit events" rows={8}.
+  assert.match(src, /ListLoadingSkeleton label="audit events" rows=\{8\}/);
+});
+
+test("the boundary retries unbounded on a capped backoff held at module scope, with no manual-retry terminal state", async () => {
+  const src = await readFile(ERROR_FILE, "utf8");
+  assert.match(src, CALLS_RESET_RE);
+  assert.match(src, UNBOUNDED_RETRY_SCHEDULES_NEXT_RE);
+  assert.match(src, IMPORTS_SHARED_RETRY_RE);
+  assert.match(src, MODULE_SCOPE_COUNTER_RE);
+  assert.doesNotMatch(
+    src,
+    NO_REACT_STATE_COUNTER_RE,
+    "the retry counter must live at module scope, not React state, or backoff never grows across remounts"
+  );
+  assert.doesNotMatch(src, NO_TERMINAL_GIVE_UP_FLAG_RE, "no gated give-up state — retry must be unbounded");
+});
+
+test("the boundary is self-contained: no server-only import", async () => {
+  const src = await readFile(ERROR_FILE, "utf8");
+  assert.doesNotMatch(src, SERVER_ONLY_IMPORT_RE);
+});

apps/console/src/app/(console)/components/read-resilient-retry.test.ts

@@ -0,0 +1,41 @@
+// Copyright The PDP-Connect Contributors
+// SPDX-License-Identifier: Apache-2.0
+
+/**
+ * Behavioral tests for the shared read-resilient-boundary backoff primitive.
+ * See `read-resilient-retry.ts` for why the retry counter this module
+ * supports must be created once per segment boundary at module scope.
+ */
+
+import assert from "node:assert/strict";
+import test from "node:test";
+import {
+  createRetryCounter,
+  nextRetryDelayMs,
+  RETRY_BASE_DELAY_MS,
+  RETRY_MAX_DELAY_MS,
+} from "./read-resilient-retry.ts";
+
+test("nextRetryDelayMs starts at the base delay for the first attempt", () => {
+  assert.equal(nextRetryDelayMs(0), RETRY_BASE_DELAY_MS);
+});
+
+test("nextRetryDelayMs doubles per attempt until the cap", () => {
+  assert.equal(nextRetryDelayMs(1), RETRY_BASE_DELAY_MS * 2);
+  assert.equal(nextRetryDelayMs(2), RETRY_BASE_DELAY_MS * 4);
+  assert.equal(nextRetryDelayMs(3), RETRY_BASE_DELAY_MS * 8);
+});
+
+test("nextRetryDelayMs is capped at RETRY_MAX_DELAY_MS and never exceeds it, however large the attempt", () => {
+  const atCap = nextRetryDelayMs(10);
+  const wayPastCap = nextRetryDelayMs(1000);
+  assert.equal(atCap, RETRY_MAX_DELAY_MS);
+  assert.equal(wayPastCap, RETRY_MAX_DELAY_MS);
+});
+
+test("createRetryCounter returns an independent counter each call — no shared state between boundaries", () => {
+  const a = createRetryCounter();
+  const b = createRetryCounter();
+  a.attempts = 5;
+  assert.equal(b.attempts, 0, "mutating one boundary's counter must not affect another's");
+});

apps/console/src/app/(console)/components/read-resilient-retry.ts

@@ -0,0 +1,52 @@
+// Copyright The PDP-Connect Contributors
+// SPDX-License-Identifier: Apache-2.0
+
+/**
+ * Shared unbounded-capped-backoff retry primitive for segment error
+ * boundaries (App Router `error.tsx` convention).
+ *
+ * SLVP bar (Stripe, Linear, Vercel, Plaid): none of those products tell a
+ * user "couldn't load X" with a Try again button because a stream hiccuped.
+ * When a segment's server read throws `Error: The destination stream closed
+ * early` — React's RSC streaming writer reacting to the HTTP response closing
+ * while the Flight stream was still being written, not a failed data read —
+ * the boundary must retry quietly and indefinitely rather than parking on a
+ * failure card. See `sources/error.tsx` for the fully-annotated original of
+ * this pattern; this module factors ONLY the backoff arithmetic, which is
+ * byte-identical across every segment that adopts it. Each segment's own
+ * skeleton and copy stay in that segment's `error.tsx` — factoring those out
+ * too would hide the per-route visual contract behind a generic wrapper.
+ *
+ * The retry counter MUST live at module scope, never in React state: Next.js
+ * remounts the error boundary fresh on every catch (a new error instance
+ * re-enters the boundary), so a `useState` counter would silently reset to 0
+ * on every failure and the backoff would never grow past its base delay. A
+ * `RetryCounter` created by `createRetryCounter()` at each `error.tsx`
+ * module's top level (NOT inside this shared module, and NOT shared between
+ * routes) gives each segment boundary its own independent counter with
+ * exactly the right lifetime: "how many times has this boundary caught in a
+ * row since the page was last freshly loaded."
+ */
+
+/** First retry is near-immediate — long enough to dodge a tight synchronous loop. */
+export const RETRY_BASE_DELAY_MS = 300;
+/** Backoff ceiling: keep retrying at a calm, bounded cadence forever rather than escalating without limit. */
+export const RETRY_MAX_DELAY_MS = 15_000;
+
+/**
+ * A single segment boundary's consecutive-failure counter. Create exactly one
+ * of these per `error.tsx` module (at module scope, not inside the component)
+ * and reuse it across every catch that module handles.
+ */
+export type RetryCounter = { attempts: number };
+
+/** Create a fresh, independent module-scoped retry counter for one segment boundary. */
+export function createRetryCounter(): RetryCounter {
+  return { attempts: 0 };
+}
+
+/** Capped exponential backoff. Never returns a delay the owner would perceive as "given up". */
+export function nextRetryDelayMs(attempt: number): number {
+  const scaled = RETRY_BASE_DELAY_MS * 2 ** attempt;
+  return Math.min(scaled, RETRY_MAX_DELAY_MS);
+}

apps/console/src/app/(console)/components/source-setup-catalog.tsx

@@ -117,7 +117,26 @@ function SourceAcquisitionPaths({ paths }: { paths: readonly ConnectorAcquisitio
   );
 }
 
+/**
+ * Development-tier method line, resolved before the `not_available_here`
+ * short-circuit below. `sourceSetupAvailability` reports `not_available_here`
+ * for every Development entry regardless of whether it renders an add
+ * action (see `sourceSetupAction`'s scaffold check), so that check alone
+ * would print "No proven setup path is available" directly above a real
+ * "Add account" button for a self-testable entry -- contradicting the
+ * action right next to it.
+ */
+function developmentMethodLine(entry: ConnectorCatalogEntry): string {
+  if (entry.isKnownScaffold) {
+    return "Not implemented yet: this connector cannot collect data.";
+  }
+  return "Setup path implemented, not yet proven against a live account.";
+}
+
 function sourceMethodLine(entry: ConnectorCatalogEntry, existingSourceCount: number): string {
+  if (entry.publicTier === "development") {
+    return developmentMethodLine(entry);
+  }
   if (sourceSetupAvailability(entry) === "not_available_here") {
     return "No proven setup path is available in this dashboard.";
   }
@@ -352,6 +371,41 @@ function ExperimentalSetupSummary({
   );
 }
 
+/**
+ * Development-tier connectors are registered and shipped, but this dashboard
+ * does not offer them in the main list or the Preview disclosure above --
+ * either no live run has proven the setup path yet (real, self-testable), or
+ * the connector is a scaffold with no real collection code yet (never gets
+ * an add action). Collapsed by default, same precedent as Preview, one tier
+ * more cautious: an owner running their own instance can see everything that
+ * exists and tell "not proven yet" apart from "not built yet", instead of a
+ * connector silently vanishing between "shipped" and "visible".
+ */
+function DevelopmentSetupSummary({
+  entries,
+  existingSourcesByConnector,
+}: {
+  entries: readonly ConnectorCatalogEntry[];
+  existingSourcesByConnector?: Readonly<Record<string, readonly ExistingSourceSetupLink[]>>;
+}) {
+  if (entries.length === 0) {
+    return null;
+  }
+  return (
+    <details className="rounded-sm border border-border/80 border-dashed bg-muted/10 p-3" data-testid="development-setup-summary">
+      <summary className="pdpp-caption cursor-pointer text-muted-foreground">Development ({entries.length})</summary>
+      <div className="mt-3 grid gap-3">
+        <p className="pdpp-caption text-muted-foreground">
+          These connectors are registered on this instance but not yet offered above. Some have a real, implemented
+          setup path with no live-account run yet -- test them with non-critical data. Others are scaffolds with no
+          collection code yet and have no add action here.
+        </p>
+        <SourceSetupCardList entries={entries} existingSourcesByConnector={existingSourcesByConnector} />
+      </div>
+    </details>
+  );
+}
+
 function SourceSetupCardList({
   entries,
   existingSourcesByConnector,
@@ -393,7 +447,16 @@ export function SourceSetupCatalog({
   const filtered = filterSourceCatalog(catalog, query);
   const available = filtered.filter((entry) => entry.publicTier === "supported" && isRunnableAddOffer(entry));
   const experimental = filtered.filter((entry) => entry.publicTier === "preview" && isRunnableAddOffer(entry));
+  // Every Development-tier entry belongs here -- real-but-unproven and known
+  // scaffolds alike. Visibility is the point: an owner running this instance
+  // must be able to tell a scaffold apart from a connector nobody has tested
+  // yet, not have either one silently omitted. `SourceSetupCard` itself
+  // already withholds the add action for a scaffold (`sourceSetupAction`
+  // returns null), so listing every Development entry here cannot render a
+  // dead-end "Add" button.
+  const development = filtered.filter((entry) => entry.publicTier === "development");
   const actionable = [...available, ...experimental];
+  const anyMatch = actionable.length > 0 || development.length > 0;
   return (
     <Section description="Add sources this dashboard can set up now." title="Add data">
       <form action={action} className="mb-4 grid gap-2 sm:grid-cols-[minmax(0,1fr)_auto]">
@@ -405,7 +468,7 @@ export function SourceSetupCatalog({
           Search
         </IcButton>
       </form>
-      {actionable.length > 0 ? (
+      {anyMatch ? (
         <div className="grid gap-5">
           {available.length > 0 ? (
             <SourceSetupCardList entries={available} existingSourcesByConnector={existingSourcesByConnector} />
@@ -416,6 +479,7 @@ export function SourceSetupCatalog({
           )}
 
           <ExperimentalSetupSummary entries={experimental} existingSourcesByConnector={existingSourcesByConnector} />
+          <DevelopmentSetupSummary entries={development} existingSourcesByConnector={existingSourcesByConnector} />
         </div>
       ) : (
         <p className="pdpp-caption rounded-md border border-border/80 border-dashed p-4 text-muted-foreground">