[TheJakeBraun]

The remaining audit findings, plus the toolbar complaint that started this session.

Membership writes are now proved, not assumed

Every configuration write reads back, because Apple acknowledges an out-of-spec profile with a 2xx and silently drops it. Membership writes had no such check — "attached" was reported on the response code alone, and a member inlined into a blueprint create was reported attached purely because the create returned 2xx.

ApplyBlueprints now re-reads the relationships it wrote and confirms the tenant holds what each write claimed.

The cost is per relationship, not per member: attaching twenty configs to one blueprint is one extra GET. A verification whose cost scaled with the number of writes would discourage its own use on an API that rate-limits this hard — there's a test pinning that.

A read that fails downgrades the row to NOT VERIFIED rather than failing it: a GET that errored says nothing about the POST, the same posture the configuration read-back takes.

get blueprint was the last caller swallowing relationship errors

rels[rel], _ = ... rendered a 429 or 403 as an empty member list — in the table and in the --json abgui's inspector consumes. An affirmatively false answer from the screen you open to see what a blueprint carries. ListPackages is permission-gated and legitimately 403s, so this fired on a real condition.

The toolbar adapts instead of always shouting

Labelling every control was the first answer to "hovering says no text", and it traded one problem for another — the toolbar outgrew the window and clipped its last item at ~1090px.

Width is now spent where a word resolves an ambiguity:

titled	icon + tooltip
Verify Configs, Apply… — near-identical checkmarks, one reads local files, the other writes the tenant	Refresh, Workspace, Edit, Membership
New, Delete — generic glyphs on tenant writes

Every control has help text either way, which is what the original complaint was actually about.

Panes own their load state

One isLoading/loadError shared by every screen meant one screen's fetch was another screen's spinner and another screen's error: a slow Devices fetch spun Configurations, and an OS Releases failure — raisable from inside a device detail sheet — rendered on whatever list sat behind it. A generation counter existed purely to stop overlapping reads clobbering each other's message.

Each pane now answers loading(_:)/failure(_:) for itself. The shared isLoading is gone entirely — the plan has isPlanning, the seed has isSeeding. The dashboard reads back the failure of the load it just ran rather than whatever last touched a shared slot.

Main-actor file I/O

ArchiveFileView read the profile with a synchronous String(contentsOf:) inside the view body — up to Apple's 1 MiB cap, re-executed on every body evaluation. RunLogsView scanned the directory, probed fifty file tails and read the selected transcript synchronously from .task. Both now read off the main actor into state, and the log reader drops a result whose selection changed while it was loading.

Verification

Go: build, vet, gofmt, full suite green. 3 new tests — an unapplied membership write must not read as done, the one-read-per-relationship budget, and a failed re-read being "not verified" rather than failed. Swift: macOS CI is the gate.

🤖 Generated with Claude Code