The UI reports a failed read as an empty result, and the empty result gives advice

[rainmanjam]

From the poka-yoke audit of 2026-09-04. Lens: contact. Today: rung 3, for three files only. Device reaches: rung 2 (Warning). Silent.

The mistake available

Add a read to a dialog and use the empty array as the failure value.

ui/src/components/DestinationDialog.tsx:727,731,732,741,749:

api.listAccounts().then(setAccounts).catch(() => setAccounts([]));
api.listRenditions().then(setRenditions).catch(() => setRenditions([]));

ui/src/lib/readState.ts exists precisely to make that unwriteable. Its header
calls itself "a CONTROL rather than a warning" because mayClaim is a type
guard. This file never imports it.

What happens — and it drives the operator to act

• A failed listRenditions() renders, at :1502, the sentence "No shared
  encodes yet. Create one on the Renditions page first." and disables the
  shared-encode radio. That is a positive claim, and it sends the operator to
  build a second real encode they do not need.
• A failed listAccounts() replaces the account picker with a "Connect
  {platform} account" button linking to the OAuth consent flow
  (:1306-1310) — a re-authorisation for an account that is already linked,
  which also discards the half-filled dialog.

Today

Rung 3, and only for three files. ui/src/lib/readState.test.ts:51,72,73,74
enforces the rule by asserting that specific source string literals are
absent from SettingsPage.tsx and AutomationPage.tsx. That is a
hand-maintained list of filenames — training, not a device. It does not know
DestinationDialog.tsx exists.

Device → rung 2, Warning

An ESLint no-restricted-syntax rule matching a .catch() whose body is a
single setX([]) or setX(null), run as a required check.

Control would mean the read helpers in ui/src/lib/api.ts returning
ReadState<T>, so an empty array has no spelling on a failed read. strict: true
is on and there are only six anys repo-wide, so the type system is available —
but it touches every caller.

What stops the Warning today: there is no ESLint config in the repository
at all.

[rainmanjam]

Device built — PR #722. Rung 2, Warning.

All five reads in DestinationDialog.tsx carry a ReadState now. The arrays are
derived with rowsOf, so every consumer that only wants rows is untouched;
mayClaim guards the two places that say something, and readFailed gives each
a sentence distinguishing "we could not ask" from "there are none".

The enforcement was the actual finding, and it is replaced. A list of three
filenames with source strings asserted absent from each is training, not a
device — this issue's own words — and readState.shape.test.ts walks every
.ts/.tsx under ui/src and matches on the shape instead.

It immediately found nine more instances the audit never named. Most turn
out to be null used as a genuine third state with the consumer already
branching on it; each is now a stated decision in an excuse map keyed by file
and setter — a file-level key would have covered this dialog's other three
by accident, which is exactly how the previous enforcement missed it.

One of the nine was a real bug. Dashboard's metadata composer holds
MetaTarget[] | null and if (targets === null) return null hides it entirely,
but the catch stored [] — so a failed read rendered the composer with zero
platforms, a claim that this broadcast has nowhere to push metadata.

The guard bans okRead([]) inside a catch as well as a bare []: adopting
ReadState and then storing a successful-looking empty read is the same mistake
wearing the fix, and the type no longer objects. Found by mutation — the
first version of the guard passed that spelling.

On the ESLint premise. This issue says "there is no ESLint config in the
repository at all", which is half right: there is no ESLint, but npm run lint
runs oxlint and is a required check. oxlint has no no-restricted-syntax
(it needs a selector engine), so the rule went where the repo already puts rules
of this class — a build-time guard, with positive and negative controls over its
own pattern, because the regex is the device and one that quietly stopped
matching would leave every assertion passing over nothing.

Four mutations red.