fix(components): route error states through ErrorNotice (batch components-1)

[CrysisDeu]

Summary

Batch components-1 of the dashboard error-state sweep. Every hand-written error surface the audit lists for these 22 files under website/src/components/ now renders through the shared ErrorNotice (AUTOSDE errors-use-error-notice, blocking), and the batch's silent failures (query/mutation with no error render, toast-only reports) get an in-page notice.

Source: the audit report research/error-states-audit.md (a KiroCrew workspace research document produced by workflow wf_000025; it is not committed to this repo), section 5 "Batch components-1" plus the matching rows in sections 1 and 3. No linked issue: driven by the audit report.

askAgent decisions follow the rule: on where the hand-off loses nothing (load/list/status failures, actions on persisted inputs, crash fallbacks); off with a No hand-off: comment naming the concrete draft next to unsaved input.

Sites migrated

File	Sites	Decision
AgentDropdownList.tsx	default-agent write failure in ManageAgentsFooter	askAgent (pop-up holds no draft)
AgentImportFlow.tsx	scan failure, full-panel source_unreadable, ×4 completionError (full-panel ×2, stage 1, stage 4), stage-1 unreadable, stage-3 applyMutation — + silent: completionError now also renders on stages 2 and 3	askAgent on full-panel/stage-4; No hand-off on stages 1–3 (wizard selections / conflict strategy)
AgentSelector.tsx	roster load failure	askAgent, retry kept
AppHost.tsx	crash fallback message (the bare stack <p> is dropped — the journal carries it), bundle-load failure	askAgent
ApprovalCard.tsx	existing ErrorNotice had no decision	askAgent (per critic: card holds no draft; composer draft is persisted per slot)
ArtifactBody.tsx	sandbox mint failure (docSilent stays status), image load failure	askAgent
ArtifactPanel.tsx	detail load failure	askAgent
AutoNudgePopover.tsx	save/stop failure — + silent: cron watches query isError (+ Retry)	No hand-off (goal / idle / max-cycle inputs)
AwsConsentGate.tsx	identityDetail (identity probe failed)	delegated askAgent prop, same as the sibling notices
BottomTerminalPanel.tsx	silent: useDeleteTerminalSession rejection — rendered from the always-mounted panel root via a small close-error store, so a delete rejected after the LAST tab closed still lands on an ErrorNotice; a boolean flag mirrored to localStorage purely as a cross-window transport (never read at launch), set by the hook itself. The DELETE is keepalive, so the popout's last-tab request outlives the window; that tab waits for the settle with a visible closing state on its chip, so the rejection is recorded before the frame returns to main	askAgent
ChatInput.tsx	approval notice split (expired = status, failed submit = ErrorNotice), auto-compact load failure, auto-compact write failure now also in-popover — + silent: optimizer failure	No hand-off (composer draft)
ChatPane.tsx	upload error; agent/model switch failure now also in-pane — + silent: transcript hydration isError (+ Retry)	No hand-off (composer input)
CliPanel.tsx	send-to-chat redaction failure, clipboard copy failure — each on its own flex line (basis-full) beneath the two toolbar actions (also text-red-500/text-green-500 → tokens)	askAgent
CommandPalette.tsx	provider search failure	askAgent, retry kept
CommentThreads.tsx	ReplyBox error, thread resolve error	No hand-off (reply draft)
CommentsSidebar.tsx + FileArtifactComments.tsx	remote_sync_error; silent: comments query error and every comment write (post/reply/resolve/review/reopen/delete/edit) now captured and rendered beside the composer — and, while the sidebar is closed, in the always-mounted popovers node	No hand-off (comment composer draft)
CrewWakeSection.tsx	row action error; schedules load failure (+ Retry, matching the webhooks section)	row: No hand-off (inline JobForm); load: askAgent={!creating}
CrewWebhookSection.tsx	webhooks load failure	askAgent, retry kept
EmbedTabStrip.tsx	silent: createSlotMutation rejection — own wrapping row beneath the tab strip	askAgent
ExcalidrawBlock.tsx	renderer exception	askAgent
ExecutionsView.tsx	silent: jobs list isError, TraceRow query error	askAgent

One file outside website/src/components/ is touched on purpose: pages/chat/SidePanel.tsx, the other consumer of useDeleteTerminalSession, now routes its rejected PTY delete into the same close-error store (a two-line change; the pages batches had already merged without it, so nothing downstream would catch it).

Not touched, deliberately: ChatInput's /side refused-press path (owned by #8730); website/AUTOSDE.yaml (settings-1 PR owns it); App.tsx toast body (out of batch — the toast stays as transient feedback, the in-page notices above are the error surface).

Rule-gap notes (for the settings-1 rule edit, not changed here)

• Toast/store-notice as the only report of a failed write (setAgentSwitchNotice from ChatPane / ChatInput) — the rule's toast carve-out names useNotify only; a Redux notice rendered in App.tsx is the same shape.
• role="status" slot shared by status and failure copy (ChatInput approvalNotice) — a warn-toned status region that also carries a rejected-request message. Split here; the rule text does not name this shape.
• Error assigned first, rendered through a neutral container (ExecutionsView jobs list silently dropping the "deleted" annotation; EmbedTabStrip "+" appearing dead) — silent failures rather than mis-styled ones.

Pattern harvest

Rule candidate: review-prompt
Pattern: an error state set behind a surface that is unmounted or bypassed when the failure lands (last tab closed, sidebar collapsed, early empty-state return, slot-gated setState) — errors-use-error-notice checks the render site exists, not that it is mounted at failure time.

Strings

13 new keys (components.autoNudgePopover.retry, components.chatInput.optimize_failed_elsewhere, components.bottomTerminalPanel.closing_terminal, components.crewWakeSection.retry, components.autoNudgePopover.watches_load_failed, bottomTerminalPanel.close_failed, chatInput.optimize_failed, chatPane.history_load_failed, chatPane.retry, commentsSidebar.comment_change_failed, commentsSidebar.comments_load_failed, embedTabStrip.new_chat_failed, executionsView.jobs_load_failed) in en.manual.json + the 11 translation catalogs, en-XA regenerated. Existing strings reused everywhere else.

Tests

• src/test/ChatInput.approval.test.tsx: the non-404 approval failure now asserts the ErrorNotice (approval-decision-error, role="alert") instead of role="status", which is now reserved for the expired-approval status copy.
• Every migrated notice carries a testId so future assertions target it unambiguously.
• Local: tsc -b clean, eslint clean on all touched files, I18N_BASE_REF=origin/main npm run i18n:check all green. Test suites left to CI per the batch rules.

Screenshot evidence

Capture harness website/capture/error-notice-components-1.{tsx,html} + website/scripts/capture-error-notice-components-1.mjs mounts the real components with fetch rejected. The script asserts an "Ask the agent" link is present in every after frame and absent in every before frame (--before, run against origin/main with the same harness), so a pair cannot be two frames of one build.

	Before (origin/main)	After (this PR)
CrewWebhookSection — GET /api/webhooks rejected
CrewWakeSection — GET /api/crons rejected
ManageAgentsFooter — default-agent write rejected
ExecutionsView — job list rejected (silent on main)

[github-actions]

Design Review (Fable 5) — ✅ PASS

Design-level review of b6a3c6849e24b91279976893d24d133faec0d902 — updated in place on each push. A BLOCK verdict blocks PR readiness; PASS/CONCERNS are advisory.

The diff is fully reviewed: a disciplined batch migration to ErrorNotice with per-site hand-off decisions, plus one genuinely new piece of machinery (the terminal close-error store). The capture harness and temp-screenshots/ follow established repo conventions, the description matches the diff bidirectionally (including the one out-of-batch SidePanel.tsx touch, which is accounted for), and the askAgent on/off calls consistently follow the documented draft-loss contract in ErrorNotice.tsx.

The one design-shaped item: the popout's last-tab close now awaits the PTY DELETE settling (void del.mutateAsync(id)...finally(...)) with the close control disabled and no timeout — a fetch to a hung gateway has no bound, so the popout can sit in "closing" indefinitely, all to surface a rejection the server-side reaper already backstops. Escapable (close the window; keepalive still carries the DELETE), so it's a suggestion, not a blocker.

Design-Verdict: PASS

A disciplined, contract-following batch migration; every hand-off decision is grounded in the ErrorNotice draft-loss rule, and the one new mechanism is contained and justified.

Suggestions

• Bound the popout last-tab settle wait (closeTab's mutateAsync(...).finally(...) in BottomTerminalPanel.tsx) with a timeout that falls through to teardown: a fetch to a hung gateway never settles, the close control is disabled meanwhile, and the failure being awaited is already backstopped by the server-side reaper — losing the notice after a few seconds is the cheaper outcome.

[DESIGN-REVIEWED] b6a3c68

[github-actions]

First Principles Review (Fable 5) — 🟡 CONCERNS

Premise-level review of b6a3c6849e24b91279976893d24d133faec0d902 — why this exists and whether the shipped surface is the smallest honest version. Updated in place on each push. A BLOCK verdict blocks PR readiness; PASS/CONCERNS are advisory.

All evidence gathered. The sweep is mandated by the blocking errors-use-error-notice AUTOSDE rule; the capture harness and committed screenshots follow the documented temp-screenshots/README.md convention; the close-error store mirrors the storage-event pattern already used for useBottomTerminal's own state. The one item a human should weigh is the popout last-tab apparatus, whose payoff is a notice about a condition its own copy says self-heals.

First-Principles-Verdict: CONCERNS

Every migration is rule-mandated, but the terminal-close apparatus is sized for one popout edge case whose failure its own copy calls self-healing.

What this change ships

Intent: make every error in these 22 components render the shared, agent-hand-off-capable notice instead of a dead-end red line — a FIX (defect: silent/dead-end error surfaces, per the blocking errors-use-error-notice rule). More than 10 items; the 10 most visible:

1. 22 components' hand-written error text now renders ErrorNotice, mostly with "Ask the agent" — justified (blocking rule)
2. Previously silent failures (jobs list, hydration, comments, optimizer, watches, new-chat "+") now show notices — justified (rule covers query/mutation errors)
3. Terminal close failure gets a cross-window store, localStorage key, keepalive DELETE — oversized (see Watch)
4. Popout's last tab now waits with a "Closing terminal…" spinner before returning — rides along, serves item 3's edge
5. Approval strip split: expired = status, failed submit = alert — justified
6. Agent/model switch and auto-compact failures now report twice (toast and in-pane) — duplicate surface, declared
7. Optimizer failure surfaces on whichever composer is on screen — justified silent-failure close
8. AppHost crash stack <p> dropped from the UI (journal keeps it) — declared
9. CliPanel text-red-500/text-green-500 → tokens, failures on own row — derived, rides along declared
10. 13 strings × 12 catalogs, capture harness + committed screenshots — repo convention (temp-screenshots/README.md)

Watch

• The popout-last-tab apparatus (wait-for-settle, closingId spinner, mc-terminal-close-error localStorage mirror, unique-value trick, closing_terminal key ×12) exists so one edge case can display "Couldn't stop this terminal's shell… It will be cleaned up automatically" — the server-side reaper the code itself names makes the harm near zero, while the surface (a storage key, two exported store functions, a module-level listener) is permanent. The dock case needs only the flag plus the always-mounted root.
• Switch/auto-compact failures now have two spellings (Redux toast in App.tsx + in-pane ErrorNotice); the description defers the toast's fate to the settings-1 rule edit — until that lands, both must stay in sync.

Subtractions

• Shrink the terminal-close feature to keepalive (the real leak fix) + the hook's onError flag + the BottomTerminalPanel root notice: drop closingId/the popout wait in closeTab, the localStorage mirror in useBottomTerminal.ts:307-330, and the closing_terminal string, accepting a lost notice for the one popout-last-tab rejection the reaper cleans anyway.
• Drop dispatch(setAgentSwitchNotice(msg)) at the three sites that now also set an in-pane notice (ChatPane.tsx switchAgent/switchModel, ChatInput.tsx auto-compact) once the settings-1 rule edit confirms the in-pane notice is the surface — one report per failure.

[FIRST-PRINCIPLES-REVIEWED] b6a3c68

[github-actions]

UX Review (Fable 5) — 🟡 CONCERNS

UX-level review of b6a3c6849e24b91279976893d24d133faec0d902 — updated in place on each push. A BLOCK verdict blocks PR readiness; PASS/CONCERNS are advisory.

The diff is a consistent migration of 22 components onto the established shared ErrorNotice surface, with careful draft-protection reasoning per site. The blind reader parsed all four screenshotted surfaces correctly (warning banner, error notices, Retry, "Ask the agent" as a chat hand-off), and the before-frames confirm the fixed dead-ends (shot-06: "leaves me stuck… no Retry and no link"). The remaining question is coverage: only 4 of the ~22 migrated surfaces are screenshotted, and the reader flagged a real vocabulary collision around "agent".

UX-Verdict: CONCERNS

Solid migration the blind reader comprehended everywhere shown — but 4 screenshots cover 22 changed surfaces, and "agent" now means two things side by side.

Watch

• "Ask the agent" hand-off now sits inside agent-management surfaces ("Could not change the default agent" + "Manage agents…", "WHAT WAKES THIS AGENT"). The blind reader: "the word 'agent' seems to mean two different things… I can't tell if those are the same thing." Every error on those panels reproduces the collision; friction, not failure. Smallest fix: a clarifying title on the notice in ManageAgentsFooter (e.g. "Setting the default failed"), so "Ask the agent" reads as help, not as the agent being managed.
• FileArtifactComments.tsx: with the sidebar closed, a rejected comment write posted from a popover reports into a fixed bottom-right overlay — feedback lands away from the popover the user is looking at, and the load-error notice there has no dismiss and no retry, so it persists until an unprompted refetch succeeds.

Evidence gaps

• Terminal close flow (BottomTerminalPanel): the chip's "Closing terminal…" spinner state and the close-failed notice rendering from the hidden panel root — a short recording or screenshots of both states.
• ChatPane history-load failure + Retry, and the in-pane switch-error notice — one screenshot each.
• ChatInput optimize-failed notice, approval-decision error (vs. expired status strip), auto-compact write error in the popover — screenshots.
• FileArtifactComments bottom-right corner overlay (sidebar closed) — screenshot.
• AgentImportFlow stage notices, AutoNudgePopover watches failure + Retry, CliPanel toolbar failure lines, EmbedTabStrip create failure, AppHost crash fallback — extend the capture harness or note as representative-shape coverage.

Suggestions

• comments-sidebar-load-error / artifact-comments-load-error: add a Retry button beside the notice, matching CrewWakeSection/CrewWebhookSection on the same pattern.

[UX-REVIEWED] b6a3c68

[github-actions]

Opus 4.8 Review — ✅ no blocking findings

Reviewed b6a3c6849e24b91279976893d24d133faec0d902 — this comment is updated in place on each push.

Review details

I've read the instruction set, the single candidate, the base-branch rule snapshot, and the diff for the relevant hunks.

Falsifying Candidate 1 (errors-use-error-notice, blocking rule, matches src/**/*.tsx):

The claim is that the stage-1 agent-import-completion-error ErrorNotice carries neither askAgent nor its own adjacent No hand-off comment. Re-deriving from the code:

• The stage-1 block opens with {/* No hand-off: the stage-1 source/category selections (selectedSources, selectedCategories) are unsaved wizard state. */} — a stage-level statement naming a concrete draft, immediately above the notices it governs.
• The identical pattern recurs in stage 3 (one No hand-off comment above apply-error, with the completion-error notice sharing it below), and stage 2 / the top-of-panel version each carry their own comment. This is a deliberate, consistent authorial convention where the stage-level comment covers every notice rendered in that stage's unsaved-wizard-state.
• The rule's own reviewer guidance is explicit: block on a missing decision, not its direction, and "Doubt a comment's claim in a thread; do not overrule it." Here the decision (askAgent off) and its rationale (a named concrete draft) are documented at the stage boundary and clearly apply to the completion notice.

Whether "carrying" a No hand-off comment is satisfied by a stage-level comment that names a concrete draft is a defensible-compliant reading — the candidate itself concedes this. The (c) "observable wrong outcome" is only "a reviewer could flag it," which is exactly the "could/might" case the falsification bar rejects. It does not clear 80.

No grounded new finding survives Step 2.

No findings.

[OPUS-REVIEWED] b6a3c68

Verdict parsed from the review's SHA-scoped output markers for commit b6a3c6849e24b91279976893d24d133faec0d902.

False positive or not applicable? A repository writer can comment:
/ai-review override fable b6a3c6849e24b91279976893d24d133faec0d902: <one-sentence reason>

[github-actions]

GPT 5.6 Review — ✅ no blocking findings (all downgraded on adjudication)

GPT 5.6 flagged blocking issues on b6a3c6849e24b91279976893d24d133faec0d902; Opus 4.8 adjudication downgraded every one of them to advisory. Adjudication downgraded all 1 blocking finding(s) to advisory: the remedy each one requires is disproportionate to the harm it prevents. Read them as advice, not as merge conditions.

This comment is updated in place on each push.

Review details

BLOCKING -- website/src/components/CliPanel.tsx:210 -- Terminal close failures disappear when the feature is disabled

onError: () => setTerminalCloseFailed(true),
Persisted terminal tab + terminal disabled → SidePanel close DELETE rejects → conditional notice host is absent → no error is shown.
Anchor: errors-use-error-notice
Fix: Render the close notice from an app-shell host mounted regardless of terminal enablement.
[BLOCK-MERGE-DOWNGRADED] b6a3c68
[GPT-REVIEWED] b6a3c68

Adjudication (Opus 4.8) — is blocking on each finding proportionate?

F1 concerns whether a terminal-close DELETE failure surfaces to the user when the terminal feature is disabled and its always-mounted notice host is therefore absent.

• Conditions confirmed: notice host gated on feature flag — website/src/App.tsx:4196 (terminalEnabled && !terminalPoppedOut && <BottomTerminalPanel />), flag from App.tsx:1230; the close DELETE that can reject — website/src/pages/chat/SidePanel.tsx:450 / website/src/components/CliPanel.tsx:204-205; flag set with no mounted renderer — website/src/components/CliPanel.tsx:210.
• Recovery: the PTY kill is explicitly best-effort with a server-side orphan reaper backstop (website/src/components/CliPanel.tsx:191-192), so the only lost outcome is a UI notice in a rare (feature-disabled + lingering persisted terminal tab + rejected DELETE) combination; the leaked shell self-corrects.
• Harm rung: LOW. Remedy = hoisting an always-mounted app-shell notice host that exists solely for this disabled-feature edge, a permanent per-reader maintenance cost that exceeds a suppressed, non-resource-leaking notification.

[ADJUDICATION] b6a3c68 total=1 uphold=0 downgrade=1
DOWNGRADE F1 website/src/components/CliPanel.tsx:210 reason=disproportionate-remedy
[GPT-ADJUDICATED] b6a3c68

False positive or not applicable? A repository writer can comment:
/ai-review override gpt b6a3c6849e24b91279976893d24d133faec0d902: <one-sentence reason>

[CrysisDeu]

Disposition — UX Review (head b6a3c6849)

One rationale per finding in the latest UX comment.

1. "Ask the agent" beside agent-management copy — accepted as follow-up, not this batch. The label is the shared AskAgentButton string used by every ErrorNotice in the dashboard; changing it (or adding per-surface titles that re-explain the hand-off) is a product-copy decision for the settings-1 copy/rule PR, where it can be applied uniformly instead of only on the three surfaces this batch happens to touch. The hover tooltip ("Open a chat with this error's full context attached") stays.

2. FileArtifactComments overlay placement / no dismiss or Retry on the load-error notice — accepted as trade-off. The fixed corner is the only always-mounted host while the sidebar is closed (the popovers are anchored to a selection and unmount on cancel); the load notice clears itself on the next successful read, and the mutation notice carries dismiss. Adding Retry to comments_load_failed is a one-liner I am leaving for the pages batch that will consume the same CommentsSidebar props on ArtifactDetailPage, so both hosts gain it in one change.

3. Evidence gaps (terminal close flow, ChatPane, ChatInput, FileArtifactComments overlay, AgentImportFlow, AutoNudgePopover, CliPanel, EmbedTabStrip, AppHost) — accepted as trade-off. The harness covers the four surfaces that render standalone with only fetch stubbed and asserts hand-off present-after / absent-before. The others need a live chat slot, Redux slot context, a wizard state machine or a popout window; each renders the same ErrorNotice shown in the four frames and carries a testId. A second evidence PR extending the harness to those hosts is the right vehicle.

4. (Applied on this head from earlier rounds): ManageAgentsFooter block variant; CrewWakeSection Retry; AutoNudgePopover watches Retry; jobs_load_failed reworded to name the missing thing; slot-aware optimize_failed_elsewhere; executions-light-after.png recaptured at the shipped copy.

[CrysisDeu]

Disposition — First Principles Review (head b6a3c6849)

1. Popout-last-tab apparatus (settle wait, closingId spinner, localStorage mirror, closing_terminal string) for a reaper-healed edge — accepted as trade-off, kept. Your earlier round's keepalive suggestion is adopted and is the real leak fix. What remains exists because the blocking lane upheld errors-use-error-notice on exactly this corner twice (heads 3ea600ec1, 3f7e0b1f7): a rejection after the popout returns to main must still render an ErrorNotice. The current form is the smallest that satisfies that — no delegated-delete protocol, no queue, one boolean flag as cross-window transport, and a visible closing state so the wait is not a dead click. Dropping the wait re-opens the upheld finding; I am not trading a blocking-lane pass for an advisory subtraction.

2. Two spellings of switch/auto-compact failures (Redux toast + in-pane notice) — accepted as trade-off until the settings-1 rule edit. The in-pane ErrorNotice is the declared error surface; the toast dispatch is the half to delete once that rule text says whether a Redux notice falls under the toast carve-out. Both currently carry the same agentSwitchFailureMessage(e) string, so they cannot drift.

3. (Applied): useDeleteTerminalSession opts parameter dropped — the store write is baked into the hook; SidePanel.tsx sibling routed through it.

[CrysisDeu]

Disposition — Design Review (head b6a3c6849, PASS)

1. Suggestion: bound the popout last-tab settle wait with a timeout that falls through to teardown — declined, with the reason on record. A bounded wait was the shape at head 3f7e0b1f7; the blocking lane upheld errors-use-error-notice against it because a rejection arriving after the cap has no surface. keepalive now bounds the request at the browser's own limit rather than an arbitrary local one, the close control shows a closing state meanwhile, and the server-side reaper backstops the shell either way.