ONE-DOOR unit 6: error and path handling tightened at the edges #73

Error and path handling is tightened at the edges.

• The admin-thread publish error envelope is validated with the existing site error boundary before dashboard error shaping, keeping fixed repair guidance and redacting private errors.
• Runtime filetree changes use the same notification function as the build effects (one event implementation).
• Save completion refuses paths outside its site, and room reconciliation reuses the validated relative path, removing two panic paths.
• Server-rendered editor filetree failures are built through ApiError::from, so internal paths and OS errors get the common redaction.

---

ONE-DOOR, unit 6 (subunits 6a, 6b, 6c, 6g combined, replacing their per-subunit PRs). Plan: https://tangled.org/notplants-bot.bsky.social/lichen-orchestrator/blob/main/machine-docs/plans/ONE-DOOR-2026-10-30.md

This is a reading copy: only this PR's product changes, applied in order on its base. Nothing here is to be merged.

Source PRs on lichen.page.review (product), in order, with their original descriptions #

• #3591 s/968-od-u6a-boundary-product — preserve dashboard publish guidance across the process boundary

  Validate the admin-thread publish error envelope with the existing site error boundary before dashboard error shaping, preserving fixed repair guidance while redacting private errors.

• #3595 s/970-od-u6b-filetree-product — keep one filetree notification implementation

  Route runtime filetree changes through the same notification function used by build effects, removing the second event implementation caught by the ownership guard.

• #3597 s/972-od-u6c-save-path-product — Validate save notification paths without panicking

  Save completion refuses paths outside its site; room reconciliation reuses its validated relative path for storage lookup and notifications, removing two prohibited panic paths.

• #3605 s/982-od-u6g-ssr-error-product — Keep editor filetree failures behind the common error boundary

  Construct server-rendered editor filetree failures through ApiError::from so internal filesystem paths and OS errors receive the same redaction as other errors.

Commits #

• bbe20e011 ONE-DOOR unit 6: subunit 6a
• fef0eebf7 ONE-DOOR unit 6: subunit 6b
• f9a2e2ad5 ONE-DOOR unit 6: subunit 6c
• 7118a664a ONE-DOOR unit 6: subunit 6g

Count and shas #

count-product-code-lines 6e637184e312..7118a664aef6: NET -6 · counted +17 -23 · moved out of the counted set +0 · comment-only deletions flagged 0 · macros flagged 0 · tests-folder code flagged 0

Base 6e637184e312df13515d075cee22700c55e9090e (tip of s/967-od-u5b-runtime-tests). Head 7118a664aef6a60ead3c7f7bbbfa3da5151350eb. 5 files changed.

Check #

Files that differ from s/982-od-u6g-ssr-error-product (later tests PRs or merges touched them, or the diff was resolved): crates/lichen-server/src/forwarder/publish.rs.

Files that a tests PR of this unit also changed (so a test-only edit could in principle sit in them): crates/lichen-server/src/forwarder/publish.rs.

Resolved/noted: Subunit 6c's source branch gained a formatting commit (06b25ae8f, touching sync/resync.rs) after its first PR; it is included, so the files match the approved product branch. forwarder/publish.rs differs from the last source branch because a tests PR of this unit (6a) changed that product file; that edit is not included here.