Make dashboard honest across real-world states - #160

Effect in one sentence

Makes Dashboard and Work fail closed across real daemon, legacy, partial, malformed, paged, loading, error, and extreme-number states without inventing guidance or losing the next recorded review item.

Stack position

5 of 6: #153 → #155 → #157 → #159 → #160 (this hardening layer) → #161.

This branch is based on #159, not main. Because the stacked base predates current main, #159 carries the exact already-merged #164 macOS process-identity fix so the full local Python suite is green; those four control-process files are not new review scope here.

Central behavior

• /v1/attention publishes complete counts plus a revision-bound, server-ranked queue. The additive snapshot alias keeps the immediate predecessor desktop contract working.
• Swift rejects conflicting aliases, malformed totals/counts/reasons/IDs, padded or duplicate identities, impossible offsets, non-progressing pages, premature blockers, and revision drift before Dashboard or Work can act on them.
• Failed checks and failed steps remain ahead of blockers; the client never promotes a blocker while a reported failure-class row is still unseen.
• A changed page revision invalidates the Dashboard head as well as the Work queue. Same-revision refreshes preserve already validated pages.
• Initial receipt loading, authoritative empty, initial error, retained-data error, statusless activity, and old-daemon route absence remain distinct. Receipt-list cancellation publishes nothing and cannot starve the active window refresh.
• Project context, client identity, open-vocabulary provenance, and task titles are whitespace-normalized before presentation. Missing optional facts stay missing instead of rendering blank context or copy lines.
• Usage/reset formatting rejects negative, non-finite, overflowing, and out-of-range provider values instead of trapping or manufacturing copy.

Real-state coverage

The reviewed matrix includes complete and partial queues, pagination overflow, revision drift, old daemons, statusless sessions, stale and retained errors, initial receipt loading, empty stores, malformed envelopes, sparse usage, extreme token/cost/reset values, and light/dark minimum/reference layouts. In these states the app never turns unavailable or incomplete evidence into All clear, No active work, a fabricated next step, a blank recorded fact, or a fabricated zero.

Review order

1. src/agentacct/api.py, tests/test_receipt_api.py, and V1Model.swift — attention revision, compatibility alias, ordering, and validation contract.
2. DashboardStore.swift — request generations, cancellation/overlap ownership, retained-state policy, and fail-closed page publication.
3. DashboardPane.swift, WorkPane.swift, SourcesPane.swift, UsageCapacity.swift, Theme.swift, and MenuPresentation.swift — user-visible truth, optional-context normalization, and numeric boundaries.
4. Interaction/harness tests, fixture states, and canonical light/dark references.

Verification at current head fbd6c69

• Full Python suite on this branch tree: 2,652 passed, 1 external Starlette deprecation warning.
• tests/test_receipt_api.py: 19 passed.
• Current-head DashboardInteractionTests: 49 passed, including blank/padded context and provenance coverage.
• Stack-tip full Swift suite after merging this exact head: 155 executed, 5 expected opt-in visual skips, 0 failures.
• ./Scripts/visual-snapshots verify DashboardVisualRegressionTests: all Dashboard references match the pinned canonical renderer.
• swift build -c release: passed.
• git diff --check against Add truth-bounded dashboard decision signals #159: clean.
• Current-head GitHub CI: Python 3.11/3.12/3.13 and macOS app/snapshot jobs all passed.
• Independent final code/scenario audits: GO, no remaining blocker.

Scope

This layer changes truth-state handling, server-ranked review paging, local navigation state, and boundary safety. Maximum accessibility-text reflow remains isolated in #161. No PR in this stack is merged by this change.