From 549871f2f460ed8137239fa43970bb42e45409d7 Mon Sep 17 00:00:00 2001
From: gregoryfoster <gregoryfoster@users.noreply.github.com>
Date: Wed, 17 Jun 2026 22:41:04 +0000
Subject: [PATCH 1/4] chore: update skills submodules

---
 skills-vendor/obra-superpowers | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/skills-vendor/obra-superpowers b/skills-vendor/obra-superpowers
index 6fd4507..b62616f 160000
--- a/skills-vendor/obra-superpowers
+++ b/skills-vendor/obra-superpowers
@@ -1 +1 @@
-Subproject commit 6fd4507659784c351abbd2bc264c7162cfd386dc
+Subproject commit b62616fc12f6a007c6fd5118146821d748da0d33

From 4fd829e68cc9845443902cac956e9062d06de30d Mon Sep 17 00:00:00 2001
From: gregoryfoster <gregoryfoster@users.noreply.github.com>
Date: Mon, 22 Jun 2026 15:46:19 +0000
Subject: [PATCH 2/4] #63 fix: self-heal stale watcher_item_id on WatchedItem
 404

Distinguish a permanently deleted WatchedItem (HTTP 404) from a transient
Watcher outage in the dashboard read/action paths. On a confirmed
WatcherNotFound, NULL the stale watcher_item_id and fall back to the
not_watching state (re-exposing "Begin Watching") instead of sticking in
degraded forever. Transient failures (network/5xx) still render degraded
and retain the link, so a brief outage never drops it.

- _clear_stale_watcher_link helper clears the pointer and commits
- _render_status_partial / _render_watcher_section catch WatcherNotFound
  ahead of the broad except; gain a session param (threaded to all callers)
- check-now / toggle-watch-active flash an accurate "no longer watched"
  message and clear the link on 404

Keeps the one-way Archiver->Watcher control-plane model intact: Archiver
reconciles lazily on its next read rather than requiring Watcher to notify
it. Dashboard-only; no schema/SDK/API-contract change.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 docs/UI.md                                    |   8 +-
 src/dashboard/routes/info_items.py            |  79 ++++++--
 tests/dashboard/test_watcher_404_reconcile.py | 174 ++++++++++++++++++
 3 files changed, 245 insertions(+), 16 deletions(-)
 create mode 100644 tests/dashboard/test_watcher_404_reconcile.py

diff --git a/docs/UI.md b/docs/UI.md
index 14a0119..afccbf1 100644
--- a/docs/UI.md
+++ b/docs/UI.md
@@ -234,17 +234,17 @@ Logs a warning on degraded/failure. Auth-gated; unauthenticated requests redirec
    - *Rep Fields* — `x-data="repFieldsEditor()"` wrapper; HTMX-loaded `sortableChips` suggestions (`hx-trigger="load"`); `<textarea name="rep_fields">` with `PATCH /dashboard/info-items/{id}/rep-fields` inline save; flash target `#rep-fields-flash`.
    - *Replication Specs* — `data-table` of active `info_item_rep_specs` assignments; assign form (`filter-card`, `rep_spec_id` field); HTMX delete per row.
 
-**GET `/dashboard/info-items/{id}/watcher-status`** — HTMX partial (`info_items/_watcher_status.html`). Calls Watcher `get_watched_item`; renders ok/error/unknown/not_watching/not_configured/degraded. Used by `hx-trigger="load"` on the health strip and re-renders after check-now, begin-watching, resync-watcher.
+**GET `/dashboard/info-items/{id}/watcher-status`** — HTMX partial (`info_items/_watcher_status.html`). Calls Watcher `get_watched_item`; renders ok/error/unknown/not_watching/not_configured/degraded. Used by `hx-trigger="load"` on the health strip and re-renders after check-now, begin-watching, resync-watcher. **Self-heal on 404:** a `WatcherNotFound` (the WatchedItem was permanently deleted in Watcher) NULLs the stale `watcher_item_id` (commits) and renders `not_watching` so "Begin Watching" reappears — only a confirmed 404 clears the link; transient failures (network/5xx) still render `degraded` and retain it (CannObserv/archiver#63).
 
-**GET `/dashboard/info-items/{id}/watcher-section`** — HTMX partial (`info_items/_watcher_section.html`). Calls Watcher `get_watched_item`; renders not_configured/not_watching/degraded/watching. The watching state shows health badge, timestamps, cadence, and action buttons (no URL or spec — those live in the Information Sources section). Loaded on page init via `hx-trigger="load"` and re-fetched on the `watcherUpdated` body event. The Watcher deeplink lives on the section's `<h2>` header (rendered by the detail page, not this partial).
+**GET `/dashboard/info-items/{id}/watcher-section`** — HTMX partial (`info_items/_watcher_section.html`). Calls Watcher `get_watched_item`; renders not_configured/not_watching/degraded/watching. The watching state shows health badge, timestamps, cadence, and action buttons (no URL or spec — those live in the Information Sources section). Loaded on page init via `hx-trigger="load"` and re-fetched on the `watcherUpdated` body event. The Watcher deeplink lives on the section's `<h2>` header (rendered by the detail page, not this partial). Same 404 self-heal as `/watcher-status` (CannObserv/archiver#63).
 
-**POST `/dashboard/info-items/{id}/check-now`** — proxies to Watcher `check-now`; re-renders `_watcher_status.html`; also sets `HX-Trigger: {"watcherUpdated":{}}` so Section 3 (`#watcher-section`) auto-refreshes. If `check_now` fails, re-fetches via `get_watched_item` (shows degraded only if that also fails) **and** adds a `showFlash` error to the `HX-Trigger` so the failure is surfaced rather than swallowed *(#60)*. A `WatcherConflict` (409 — check-now on a paused item) flashes "resume it first"; any other failure flashes "Watcher is unavailable".
+**POST `/dashboard/info-items/{id}/check-now`** — proxies to Watcher `check-now`; re-renders `_watcher_status.html`; also sets `HX-Trigger: {"watcherUpdated":{}}` so Section 3 (`#watcher-section`) auto-refreshes. If `check_now` fails, re-fetches via `get_watched_item` (shows degraded only if that also fails) **and** adds a `showFlash` error to the `HX-Trigger` so the failure is surfaced rather than swallowed *(#60)*. A `WatcherConflict` (409 — check-now on a paused item) flashes "resume it first"; a `WatcherNotFound` (404 — the WatchedItem was deleted in Watcher) clears the stale `watcher_item_id` and flashes "no longer watched — it was removed in Watcher" so the re-render falls back to `not_watching` (CannObserv/archiver#63); any other failure flashes "Watcher is unavailable".
 
 **POST `/dashboard/info-items/{id}/begin-watching`** — provisions a WatchedItem on demand (for InfoItems without `watcher_item_id`); calls `provision_on_create`; re-renders `_watcher_status.html`; sets `HX-Trigger: {"watcherUpdated":{}}` so Section 3 auto-refreshes. `provision_on_create` returns a `WatcherSyncOutcome`; on `FAILED` (provisioning attempted but Watcher unavailable) the response adds a `showFlash` error so the failure is surfaced rather than swallowed. When the item has no active primary source to watch, flashes "No primary source to watch — bind one first." A `SKIPPED` outcome (no Watcher configured) flashes nothing *(#61)*.
 
 **POST `/dashboard/info-items/{id}/resync-watcher`** — PATCHes the WatchedItem with the current primary URL and specs via `sync_on_source_swap`; re-renders `_watcher_status.html`; also sets `HX-Trigger: {"watcherUpdated":{}}` so Section 3 auto-refreshes. `sync_on_source_swap` returns a `WatcherSyncOutcome`; on `FAILED` the response adds a `showFlash` error ("Couldn't re-sync with Watcher — it's unavailable"). When the watched item has no active primary source, flashes "No primary source to re-sync — bind one first." *(#61)*
 
-**POST `/dashboard/info-items/{id}/toggle-watch-active`** *(#60)* — pauses or resumes the WatchedItem via `patch_watched_item(is_active=…)`. Form field `active` is the desired target state ("true" → resume, anything else → pause); the button submits the opposite of the current state. Re-renders `_watcher_status.html` and sets `HX-Trigger: {"watcherUpdated":{}}` so Section 3 auto-refreshes. On failure the response adds a `showFlash` error to the `HX-Trigger`: a Watcher 409 (`WatcherConflict`, e.g. pause/resume on an archived item) flashes "the item may be archived"; any other failure flashes "Watcher is unavailable". The partial still re-renders rather than 500ing. No-op (no patch) when the InfoItem has no `watcher_item_id`.
+**POST `/dashboard/info-items/{id}/toggle-watch-active`** *(#60)* — pauses or resumes the WatchedItem via `patch_watched_item(is_active=…)`. Form field `active` is the desired target state ("true" → resume, anything else → pause); the button submits the opposite of the current state. Re-renders `_watcher_status.html` and sets `HX-Trigger: {"watcherUpdated":{}}` so Section 3 auto-refreshes. On failure the response adds a `showFlash` error to the `HX-Trigger`: a Watcher 409 (`WatcherConflict`, e.g. pause/resume on an archived item) flashes "the item may be archived"; a `WatcherNotFound` (404 — the WatchedItem was deleted in Watcher) clears the stale `watcher_item_id` and flashes "no longer watched — it was removed in Watcher" so the re-render falls back to `not_watching` (CannObserv/archiver#63); any other failure flashes "Watcher is unavailable". The partial still re-renders rather than 500ing. No-op (no patch) when the InfoItem has no `watcher_item_id`.
 
 **POST `/dashboard/info-items/{id}/swap-primary-source`** — inline primary-source swap: creates a new InfoSource (form fields: `url`, `source_specs` JSON array), deactivates the old active binding, binds the new source, best-effort `patch_watched_item` post-commit. Returns 204 + `HX-Redirect` to detail on success; returns 422 with an `<div id="swap-error">` fragment on validation error (targeted by `hx-target-422="#swap-error"` on the form). Template: `info_items/_swap_primary.html`.
 
diff --git a/src/dashboard/routes/info_items.py b/src/dashboard/routes/info_items.py
index 1e8c0da..82dc411 100644
--- a/src/dashboard/routes/info_items.py
+++ b/src/dashboard/routes/info_items.py
@@ -16,10 +16,11 @@
 from sqlalchemy import func, select
 from sqlalchemy.ext.asyncio import AsyncSession
 from ulid import ULID
-from watcher_client.errors import WatcherConflict
+from watcher_client.errors import WatcherConflict, WatcherNotFound
 
 from src.api.deps import get_db_session, get_watcher_client
 from src.api.errors import raise_envelope
+from src.core.logging import get_logger
 from src.core.watcher_provisioning import (
     WatcherSyncOutcome,
     provision_on_create,
@@ -83,6 +84,8 @@
 
 _templates = Jinja2Templates(directory=str(Path(__file__).parent.parent / "templates"))
 
+logger = get_logger(__name__)
+
 
 @dataclass
 class _ItemRow:
@@ -991,9 +994,30 @@ def _format_cadence(schedule_config: object) -> str:
     return f"~{amount} {label}{plural}"
 
 
+async def _clear_stale_watcher_link(session: AsyncSession, item: InfoItem) -> None:
+    """NULL a watcher_item_id after Watcher reports the WatchedItem gone (404).
+
+    A permanently deleted WatchedItem 404s on every read. Without this the
+    InfoItem sticks in the ``degraded`` state forever — indistinguishable from a
+    transient Watcher outage — and "Begin Watching" never reappears (it is gated
+    on a NULL ``watcher_item_id``). Clearing the pointer lets the item fall back
+    to ``not_watching`` so an operator can re-provision. Only a confirmed 404
+    clears the link; transient failures keep it so a brief outage never drops it.
+    """
+    stale_id = item.watcher_item_id
+    item.watcher_item_id = None
+    await session.commit()
+    logger.info(
+        "Cleared stale watcher_item_id %s for InfoItem %s (WatchedItem 404)",
+        stale_id,
+        item.info_item_id,
+    )
+
+
 async def _render_status_partial(
     request: Request,
     *,
+    session: AsyncSession,
     item: InfoItem,
     watcher: "WatcherClient | None",
     pre_fetched: "WatchedItemResponse | None" = None,
@@ -1019,6 +1043,13 @@ async def _render_status_partial(
     if wi is None:
         try:
             wi = await watcher.get_watched_item(item.watcher_item_id)
+        except WatcherNotFound:
+            await _clear_stale_watcher_link(session, item)
+            return _templates.TemplateResponse(
+                request,
+                "info_items/_watcher_status.html",
+                {"item_id": item_id, "state": "not_watching"},
+            )
         except Exception as e:
             return _templates.TemplateResponse(
                 request,
@@ -1043,6 +1074,7 @@ async def _render_status_partial(
 async def _render_watcher_section(
     request: Request,
     *,
+    session: AsyncSession,
     item: InfoItem,
     watcher: "WatcherClient | None",
 ) -> HTMLResponse:
@@ -1065,6 +1097,13 @@ async def _render_watcher_section(
 
     try:
         wi = await watcher.get_watched_item(item.watcher_item_id)
+    except WatcherNotFound:
+        await _clear_stale_watcher_link(session, item)
+        return _templates.TemplateResponse(
+            request,
+            "info_items/_watcher_section.html",
+            {"item_id": item_id, "state": "not_watching"},
+        )
     except Exception as e:
         return _templates.TemplateResponse(
             request,
@@ -1114,7 +1153,7 @@ async def watcher_status(
 ) -> HTMLResponse:
     """HTMX partial: load WatchedItem health strip from Watcher."""
     item = await _resolve_item(item_id, session)
-    return await _render_status_partial(request, item=item, watcher=watcher)
+    return await _render_status_partial(request, session=session, item=item, watcher=watcher)
 
 
 # ---------------------------------------------------------------------------
@@ -1132,7 +1171,7 @@ async def watcher_section(
 ) -> HTMLResponse:
     """HTMX partial: detailed Watcher panel for Section 3 of the detail page."""
     item = await _resolve_item(item_id, session)
-    return await _render_watcher_section(request, item=item, watcher=watcher)
+    return await _render_watcher_section(request, session=session, item=item, watcher=watcher)
 
 
 # ---------------------------------------------------------------------------
@@ -1152,12 +1191,17 @@ async def check_now(
     item = await _resolve_item(item_id, session)
 
     if watcher is None or not item.watcher_item_id:
-        return await _render_status_partial(request, item=item, watcher=watcher)
+        return await _render_status_partial(request, session=session, item=item, watcher=watcher)
 
     wi: WatchedItemResponse | None = None
     flash: tuple[str, str] | None = None
     try:
         wi = await watcher.check_now(item.watcher_item_id)
+    except WatcherNotFound:
+        # The WatchedItem is gone (deleted in Watcher). Clear the stale link so
+        # the partial falls back to not_watching instead of looping on 404.
+        await _clear_stale_watcher_link(session, item)
+        flash = ("error", "This item is no longer watched — it was removed in Watcher.")
     except WatcherConflict:
         # Watcher 409s on check-now of a paused item. The button is hidden when
         # paused, but guard direct posts with the accurate reason.
@@ -1167,7 +1211,9 @@ async def check_now(
         # also fails. Either way, surface the action failure as a flash.
         flash = ("error", "Couldn't trigger a check — Watcher is unavailable. Try again shortly.")
 
-    response = await _render_status_partial(request, item=item, watcher=watcher, pre_fetched=wi)
+    response = await _render_status_partial(
+        request, session=session, item=item, watcher=watcher, pre_fetched=wi
+    )
     response.headers["HX-Trigger"] = _watcher_hx_trigger(flash)
     return response
 
@@ -1190,7 +1236,7 @@ async def begin_watching(
 
     if item.watcher_item_id:
         # Already provisioned — just re-render current state.
-        return await _render_status_partial(request, item=item, watcher=watcher)
+        return await _render_status_partial(request, session=session, item=item, watcher=watcher)
 
     # Find the active primary source.
     binding = (
@@ -1209,7 +1255,9 @@ async def begin_watching(
         # No active primary source to watch — flash rather than silently re-render
         # (but stay quiet when Watcher is unconfigured: the partial already shows
         # the not_configured state, and a missing-source flash would mislead).
-        response = await _render_status_partial(request, item=item, watcher=watcher)
+        response = await _render_status_partial(
+            request, session=session, item=item, watcher=watcher
+        )
         flash: tuple[str, str] | None = (
             ("error", "No primary source to watch — bind one first.")
             if watcher is not None
@@ -1223,7 +1271,7 @@ async def begin_watching(
     if outcome is WatcherSyncOutcome.FAILED:
         flash = ("error", "Couldn't start watching — Watcher is unavailable. Try again shortly.")
 
-    response = await _render_status_partial(request, item=item, watcher=watcher)
+    response = await _render_status_partial(request, session=session, item=item, watcher=watcher)
     response.headers["HX-Trigger"] = _watcher_hx_trigger(flash)
     return response
 
@@ -1245,7 +1293,7 @@ async def resync_watcher(
     item = await _resolve_item(item_id, session)
 
     if watcher is None or not item.watcher_item_id:
-        return await _render_status_partial(request, item=item, watcher=watcher)
+        return await _render_status_partial(request, session=session, item=item, watcher=watcher)
 
     binding = (
         await session.execute(
@@ -1272,7 +1320,7 @@ async def resync_watcher(
                 "Couldn't re-sync with Watcher — it's unavailable. Try again shortly.",
             )
 
-    response = await _render_status_partial(request, item=item, watcher=watcher)
+    response = await _render_status_partial(request, session=session, item=item, watcher=watcher)
     response.headers["HX-Trigger"] = _watcher_hx_trigger(flash)
     return response
 
@@ -1301,12 +1349,17 @@ async def toggle_watch_active(
     item = await _resolve_item(item_id, session)
 
     if watcher is None or not item.watcher_item_id:
-        return await _render_status_partial(request, item=item, watcher=watcher)
+        return await _render_status_partial(request, session=session, item=item, watcher=watcher)
 
     wi: WatchedItemResponse | None = None
     flash: tuple[str, str] | None = None
     try:
         wi = await watcher.patch_watched_item(item.watcher_item_id, is_active=active == "true")
+    except WatcherNotFound:
+        # The WatchedItem is gone (deleted in Watcher). Clear the stale link so
+        # the partial falls back to not_watching instead of looping on 404.
+        await _clear_stale_watcher_link(session, item)
+        flash = ("error", "This item is no longer watched — it was removed in Watcher.")
     except WatcherConflict:
         # Watcher rejects pause/resume on an archived item (archive/restore owns
         # activation there). The toggle is hidden in that state, but guard direct posts.
@@ -1317,6 +1370,8 @@ async def toggle_watch_active(
             "Couldn't update the watch state — Watcher is unavailable. Try again shortly.",
         )
 
-    response = await _render_status_partial(request, item=item, watcher=watcher, pre_fetched=wi)
+    response = await _render_status_partial(
+        request, session=session, item=item, watcher=watcher, pre_fetched=wi
+    )
     response.headers["HX-Trigger"] = _watcher_hx_trigger(flash)
     return response
diff --git a/tests/dashboard/test_watcher_404_reconcile.py b/tests/dashboard/test_watcher_404_reconcile.py
new file mode 100644
index 0000000..41e211b
--- /dev/null
+++ b/tests/dashboard/test_watcher_404_reconcile.py
@@ -0,0 +1,174 @@
+"""Self-heal a stale watcher_item_id when Watcher reports the WatchedItem gone (404).
+
+A permanently deleted WatchedItem 404s on every read. Archiver must distinguish
+that from a transient outage: on a confirmed 404 it clears watcher_item_id and
+falls back to the not_watching state (re-exposing "Begin Watching") instead of
+sticking in degraded forever. Transient failures (network/5xx) still render
+degraded and retain the id, so a brief outage never drops the link.
+
+Covers:
+  GET  /watcher-section        404 -> not_watching, link cleared
+  GET  /watcher-status         404 -> not_watching, link cleared
+  GET  /watcher-section        network error -> degraded, link retained (regression)
+  POST /check-now              404 -> not_watching + "no longer watched" flash, link cleared
+  POST /toggle-watch-active    404 -> not_watching + "no longer watched" flash, link cleared
+"""
+
+from __future__ import annotations
+
+from unittest.mock import AsyncMock, MagicMock
+
+import pytest
+from watcher_client.errors import WatcherNotFound
+
+from src.api.deps import get_watcher_client
+from src.api.main import app
+from src.core.models import InfoItem
+
+_HEADERS = {"X-ExeDev-UserID": "ext-404", "X-ExeDev-Email": "reconcile@example.com"}
+_WI_ID = "01HZZWATCHER00000000000009"
+
+
+def _watcher_404() -> MagicMock:
+    """A WatcherClient mock whose reads/actions all 404 (deleted WatchedItem)."""
+    m = MagicMock()
+    m.base_url = "https://watcher.example.com"
+    err = WatcherNotFound("WatchedItem not found", status_code=404)
+    m.get_watched_item = AsyncMock(side_effect=err)
+    m.check_now = AsyncMock(side_effect=err)
+    m.patch_watched_item = AsyncMock(side_effect=err)
+    return m
+
+
+def _watcher_down() -> MagicMock:
+    """A WatcherClient mock that fails with a transient (non-404) error."""
+    m = MagicMock()
+    m.base_url = "https://watcher.example.com"
+    m.get_watched_item = AsyncMock(side_effect=Exception("connection refused"))
+    return m
+
+
+# ---------------------------------------------------------------------------
+# GET /watcher-section — 404 self-heals to not_watching and clears the link
+# ---------------------------------------------------------------------------
+
+
+@pytest.mark.asyncio
+async def test_watcher_section_404_clears_link_and_shows_not_watching(client, session):
+    app.dependency_overrides[get_watcher_client] = lambda: _watcher_404()
+    item = InfoItem(name="section-404", watcher_item_id=_WI_ID)
+    session.add(item)
+    await session.flush()
+
+    r = await client.get(
+        f"/dashboard/info-items/{item.info_item_id}/watcher-section",
+        headers=_HEADERS,
+    )
+    assert r.status_code == 200
+    assert "Not watching" in r.text
+    assert "begin-watching" in r.text
+    assert "Watcher unavailable" not in r.text
+
+    await session.refresh(item)
+    assert item.watcher_item_id is None
+
+
+# ---------------------------------------------------------------------------
+# GET /watcher-status — 404 self-heals to not_watching and clears the link
+# ---------------------------------------------------------------------------
+
+
+@pytest.mark.asyncio
+async def test_watcher_status_404_clears_link_and_shows_not_watching(client, session):
+    app.dependency_overrides[get_watcher_client] = lambda: _watcher_404()
+    item = InfoItem(name="status-404", watcher_item_id=_WI_ID)
+    session.add(item)
+    await session.flush()
+
+    r = await client.get(
+        f"/dashboard/info-items/{item.info_item_id}/watcher-status",
+        headers=_HEADERS,
+    )
+    assert r.status_code == 200
+    assert "Not watching" in r.text
+    assert "begin-watching" in r.text
+
+    await session.refresh(item)
+    assert item.watcher_item_id is None
+
+
+# ---------------------------------------------------------------------------
+# GET /watcher-section — transient failure stays degraded and retains the link
+# ---------------------------------------------------------------------------
+
+
+@pytest.mark.asyncio
+async def test_watcher_section_transient_error_stays_degraded_and_retains_link(client, session):
+    app.dependency_overrides[get_watcher_client] = lambda: _watcher_down()
+    item = InfoItem(name="section-down", watcher_item_id=_WI_ID)
+    session.add(item)
+    await session.flush()
+
+    r = await client.get(
+        f"/dashboard/info-items/{item.info_item_id}/watcher-section",
+        headers=_HEADERS,
+    )
+    assert r.status_code == 200
+    assert "Watcher unavailable" in r.text
+    assert "Not watching" not in r.text
+
+    await session.refresh(item)
+    assert item.watcher_item_id == _WI_ID
+
+
+# ---------------------------------------------------------------------------
+# POST /check-now — 404 self-heals to not_watching with an accurate flash
+# ---------------------------------------------------------------------------
+
+
+@pytest.mark.asyncio
+async def test_check_now_404_clears_link_and_flashes_removed(client, session):
+    app.dependency_overrides[get_watcher_client] = lambda: _watcher_404()
+    item = InfoItem(name="check-now-404", watcher_item_id=_WI_ID)
+    session.add(item)
+    await session.flush()
+
+    r = await client.post(
+        f"/dashboard/info-items/{item.info_item_id}/check-now",
+        headers=_HEADERS,
+    )
+    assert r.status_code == 200
+    assert "Not watching" in r.text
+    hx_trigger = r.headers.get("HX-Trigger", "")
+    assert "showFlash" in hx_trigger
+    assert "no longer watched" in hx_trigger
+
+    await session.refresh(item)
+    assert item.watcher_item_id is None
+
+
+# ---------------------------------------------------------------------------
+# POST /toggle-watch-active — 404 self-heals to not_watching with an accurate flash
+# ---------------------------------------------------------------------------
+
+
+@pytest.mark.asyncio
+async def test_toggle_watch_active_404_clears_link_and_flashes_removed(client, session):
+    app.dependency_overrides[get_watcher_client] = lambda: _watcher_404()
+    item = InfoItem(name="toggle-404", watcher_item_id=_WI_ID)
+    session.add(item)
+    await session.flush()
+
+    r = await client.post(
+        f"/dashboard/info-items/{item.info_item_id}/toggle-watch-active",
+        headers=_HEADERS,
+        data={"active": "false"},
+    )
+    assert r.status_code == 200
+    assert "Not watching" in r.text
+    hx_trigger = r.headers.get("HX-Trigger", "")
+    assert "showFlash" in hx_trigger
+    assert "no longer watched" in hx_trigger
+
+    await session.refresh(item)
+    assert item.watcher_item_id is None

From c26a6bd53be8f0294be370bc112c2fd15a25c4e6 Mon Sep 17 00:00:00 2001
From: gregoryfoster <gregoryfoster@users.noreply.github.com>
Date: Mon, 22 Jun 2026 17:01:52 +0000
Subject: [PATCH 3/4] #63 fix: harden watcher 404 self-heal per CR (PR #64)

- _clear_stale_watcher_link is now best-effort: it never raises. A failed
  reconcile commit is rolled back, the item refreshed, and the failure
  reported as False so the render/action paths degrade rather than 500
  (preserving the "never 500 the partial" contract). [CR finding 1]
- Render helpers branch on the bool: render not_watching only when the
  link was durably cleared, else degraded. check-now/toggle flash an
  accurate message when the local update fails.
- Add tests: resync-watcher 404 self-heal; _clear_stale_watcher_link
  returns False (no raise) on commit failure; watcher-section degrades
  (200, link retained) when the reconcile commit fails. [CR findings 1, 2]
- UI.md: document resync-watcher's 404 self-heal-via-render. [CR finding 3]

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 docs/UI.md                                    |  2 +-
 src/dashboard/routes/info_items.py            | 73 +++++++++++++---
 tests/dashboard/test_watcher_404_reconcile.py | 83 ++++++++++++++++++-
 3 files changed, 144 insertions(+), 14 deletions(-)

diff --git a/docs/UI.md b/docs/UI.md
index afccbf1..f0c74a0 100644
--- a/docs/UI.md
+++ b/docs/UI.md
@@ -242,7 +242,7 @@ Logs a warning on degraded/failure. Auth-gated; unauthenticated requests redirec
 
 **POST `/dashboard/info-items/{id}/begin-watching`** — provisions a WatchedItem on demand (for InfoItems without `watcher_item_id`); calls `provision_on_create`; re-renders `_watcher_status.html`; sets `HX-Trigger: {"watcherUpdated":{}}` so Section 3 auto-refreshes. `provision_on_create` returns a `WatcherSyncOutcome`; on `FAILED` (provisioning attempted but Watcher unavailable) the response adds a `showFlash` error so the failure is surfaced rather than swallowed. When the item has no active primary source to watch, flashes "No primary source to watch — bind one first." A `SKIPPED` outcome (no Watcher configured) flashes nothing *(#61)*.
 
-**POST `/dashboard/info-items/{id}/resync-watcher`** — PATCHes the WatchedItem with the current primary URL and specs via `sync_on_source_swap`; re-renders `_watcher_status.html`; also sets `HX-Trigger: {"watcherUpdated":{}}` so Section 3 auto-refreshes. `sync_on_source_swap` returns a `WatcherSyncOutcome`; on `FAILED` the response adds a `showFlash` error ("Couldn't re-sync with Watcher — it's unavailable"). When the watched item has no active primary source, flashes "No primary source to re-sync — bind one first." *(#61)*
+**POST `/dashboard/info-items/{id}/resync-watcher`** — PATCHes the WatchedItem with the current primary URL and specs via `sync_on_source_swap`; re-renders `_watcher_status.html`; also sets `HX-Trigger: {"watcherUpdated":{}}` so Section 3 auto-refreshes. `sync_on_source_swap` returns a `WatcherSyncOutcome`; on `FAILED` the response adds a `showFlash` error ("Couldn't re-sync with Watcher — it's unavailable"). When the watched item has no active primary source, flashes "No primary source to re-sync — bind one first." *(#61)* **404 self-heal:** a deleted WatchedItem 404s inside `sync_on_source_swap` (swallowed to `FAILED`), but the trailing `_watcher_status.html` re-render re-fetches via `get_watched_item`, 404s, clears the stale `watcher_item_id`, and reconciles to `not_watching` — so a deleted item recovers even though the flash stays the generic "unavailable" (the 404 is opaque to the shared core helper; CannObserv/archiver#63).
 
 **POST `/dashboard/info-items/{id}/toggle-watch-active`** *(#60)* — pauses or resumes the WatchedItem via `patch_watched_item(is_active=…)`. Form field `active` is the desired target state ("true" → resume, anything else → pause); the button submits the opposite of the current state. Re-renders `_watcher_status.html` and sets `HX-Trigger: {"watcherUpdated":{}}` so Section 3 auto-refreshes. On failure the response adds a `showFlash` error to the `HX-Trigger`: a Watcher 409 (`WatcherConflict`, e.g. pause/resume on an archived item) flashes "the item may be archived"; a `WatcherNotFound` (404 — the WatchedItem was deleted in Watcher) clears the stale `watcher_item_id` and flashes "no longer watched — it was removed in Watcher" so the re-render falls back to `not_watching` (CannObserv/archiver#63); any other failure flashes "Watcher is unavailable". The partial still re-renders rather than 500ing. No-op (no patch) when the InfoItem has no `watcher_item_id`.
 
diff --git a/src/dashboard/routes/info_items.py b/src/dashboard/routes/info_items.py
index 82dc411..ba22aea 100644
--- a/src/dashboard/routes/info_items.py
+++ b/src/dashboard/routes/info_items.py
@@ -994,8 +994,10 @@ def _format_cadence(schedule_config: object) -> str:
     return f"~{amount} {label}{plural}"
 
 
-async def _clear_stale_watcher_link(session: AsyncSession, item: InfoItem) -> None:
-    """NULL a watcher_item_id after Watcher reports the WatchedItem gone (404).
+async def _clear_stale_watcher_link(session: AsyncSession, item: InfoItem) -> bool:
+    """Best-effort NULL of a watcher_item_id after Watcher reports the WatchedItem
+    gone (404). Returns ``True`` when the link was durably cleared, ``False`` when
+    the commit failed.
 
     A permanently deleted WatchedItem 404s on every read. Without this the
     InfoItem sticks in the ``degraded`` state forever — indistinguishable from a
@@ -1003,15 +1005,38 @@ async def _clear_stale_watcher_link(session: AsyncSession, item: InfoItem) -> No
     on a NULL ``watcher_item_id``). Clearing the pointer lets the item fall back
     to ``not_watching`` so an operator can re-provision. Only a confirmed 404
     clears the link; transient failures keep it so a brief outage never drops it.
+
+    Never raises: the render/action paths it serves are designed to degrade rather
+    than 500, so a failed commit is rolled back, logged, and reported as ``False``
+    (the caller keeps degrading). ``item`` is refreshed on failure so callers may
+    keep using it; the next read retries the clear.
     """
+    item_id = str(item.info_item_id)  # capture before commit/rollback can expire it
     stale_id = item.watcher_item_id
     item.watcher_item_id = None
-    await session.commit()
+    try:
+        await session.commit()
+    except Exception:
+        logger.exception(
+            "Failed to clear stale watcher_item_id %s for InfoItem %s (WatchedItem 404)",
+            stale_id,
+            item_id,
+        )
+        try:
+            await session.rollback()
+            await session.refresh(item)
+        except Exception:
+            logger.exception(
+                "Recovery after failed watcher_item_id clear also failed for InfoItem %s",
+                item_id,
+            )
+        return False
     logger.info(
         "Cleared stale watcher_item_id %s for InfoItem %s (WatchedItem 404)",
         stale_id,
-        item.info_item_id,
+        item_id,
     )
+    return True
 
 
 async def _render_status_partial(
@@ -1044,11 +1069,21 @@ async def _render_status_partial(
         try:
             wi = await watcher.get_watched_item(item.watcher_item_id)
         except WatcherNotFound:
-            await _clear_stale_watcher_link(session, item)
+            cleared = await _clear_stale_watcher_link(session, item)
+            if cleared:
+                return _templates.TemplateResponse(
+                    request,
+                    "info_items/_watcher_status.html",
+                    {"item_id": item_id, "state": "not_watching"},
+                )
             return _templates.TemplateResponse(
                 request,
                 "info_items/_watcher_status.html",
-                {"item_id": item_id, "state": "not_watching"},
+                {
+                    "item_id": item_id,
+                    "state": "degraded",
+                    "error_message": "couldn't update the local watch record",
+                },
             )
         except Exception as e:
             return _templates.TemplateResponse(
@@ -1098,11 +1133,21 @@ async def _render_watcher_section(
     try:
         wi = await watcher.get_watched_item(item.watcher_item_id)
     except WatcherNotFound:
-        await _clear_stale_watcher_link(session, item)
+        cleared = await _clear_stale_watcher_link(session, item)
+        if cleared:
+            return _templates.TemplateResponse(
+                request,
+                "info_items/_watcher_section.html",
+                {"item_id": item_id, "state": "not_watching"},
+            )
         return _templates.TemplateResponse(
             request,
             "info_items/_watcher_section.html",
-            {"item_id": item_id, "state": "not_watching"},
+            {
+                "item_id": item_id,
+                "state": "degraded",
+                "error_message": "couldn't update the local watch record",
+            },
         )
     except Exception as e:
         return _templates.TemplateResponse(
@@ -1200,8 +1245,10 @@ async def check_now(
     except WatcherNotFound:
         # The WatchedItem is gone (deleted in Watcher). Clear the stale link so
         # the partial falls back to not_watching instead of looping on 404.
-        await _clear_stale_watcher_link(session, item)
-        flash = ("error", "This item is no longer watched — it was removed in Watcher.")
+        if await _clear_stale_watcher_link(session, item):
+            flash = ("error", "This item is no longer watched — it was removed in Watcher.")
+        else:
+            flash = ("error", "This item is gone in Watcher, but updating the local record failed.")
     except WatcherConflict:
         # Watcher 409s on check-now of a paused item. The button is hidden when
         # paused, but guard direct posts with the accurate reason.
@@ -1358,8 +1405,10 @@ async def toggle_watch_active(
     except WatcherNotFound:
         # The WatchedItem is gone (deleted in Watcher). Clear the stale link so
         # the partial falls back to not_watching instead of looping on 404.
-        await _clear_stale_watcher_link(session, item)
-        flash = ("error", "This item is no longer watched — it was removed in Watcher.")
+        if await _clear_stale_watcher_link(session, item):
+            flash = ("error", "This item is no longer watched — it was removed in Watcher.")
+        else:
+            flash = ("error", "This item is gone in Watcher, but updating the local record failed.")
     except WatcherConflict:
         # Watcher rejects pause/resume on an archived item (archive/restore owns
         # activation there). The toggle is hidden in that state, but guard direct posts.
diff --git a/tests/dashboard/test_watcher_404_reconcile.py b/tests/dashboard/test_watcher_404_reconcile.py
index 41e211b..960eaf1 100644
--- a/tests/dashboard/test_watcher_404_reconcile.py
+++ b/tests/dashboard/test_watcher_404_reconcile.py
@@ -23,7 +23,8 @@
 
 from src.api.deps import get_watcher_client
 from src.api.main import app
-from src.core.models import InfoItem
+from src.core.models import InfoItem, InfoItemSource, InfoSource
+from src.dashboard.routes.info_items import _clear_stale_watcher_link
 
 _HEADERS = {"X-ExeDev-UserID": "ext-404", "X-ExeDev-Email": "reconcile@example.com"}
 _WI_ID = "01HZZWATCHER00000000000009"
@@ -172,3 +173,83 @@ async def test_toggle_watch_active_404_clears_link_and_flashes_removed(client, s
 
     await session.refresh(item)
     assert item.watcher_item_id is None
+
+
+# ---------------------------------------------------------------------------
+# POST /resync-watcher — 404 self-heals to not_watching (CR #64 finding 2)
+# ---------------------------------------------------------------------------
+
+
+@pytest.mark.asyncio
+async def test_resync_watcher_404_clears_link_and_shows_not_watching(client, session):
+    """resync routes the 404 through sync_on_source_swap (swallowed to FAILED); the
+    trailing status re-render then re-fetches, 404s, and reconciles to not_watching.
+    The flash stays generic ("unavailable") — only the self-heal is asserted here.
+    """
+    app.dependency_overrides[get_watcher_client] = lambda: _watcher_404()
+    item = InfoItem(name="resync-404", watcher_item_id=_WI_ID)
+    src = InfoSource(url="https://example.com/resync-404", source_specs=[])
+    session.add_all([item, src])
+    await session.flush()
+    session.add(InfoItemSource(info_item_id=item.info_item_id, info_source_id=src.info_source_id))
+    await session.flush()
+
+    r = await client.post(
+        f"/dashboard/info-items/{item.info_item_id}/resync-watcher",
+        headers=_HEADERS,
+    )
+    assert r.status_code == 200
+    assert "Not watching" in r.text
+
+    await session.refresh(item)
+    assert item.watcher_item_id is None
+
+
+# ---------------------------------------------------------------------------
+# Reconcile-commit failure is best-effort: never raises, never 500s the partial,
+# and retains the link for a later retry (CR #64 finding 1)
+# ---------------------------------------------------------------------------
+
+
+async def _boom() -> None:
+    raise RuntimeError("db connection dropped")
+
+
+@pytest.mark.asyncio
+async def test_clear_stale_watcher_link_returns_false_when_commit_fails(session, monkeypatch):
+    """A failed reconcile commit is swallowed: returns False, never raises, and the
+    link is left intact so the caller keeps degrading instead of 500ing."""
+    item = InfoItem(name="clear-commit-fail", watcher_item_id=_WI_ID)
+    session.add(item)
+    await session.commit()  # durable so the helper's rollback preserves the row
+
+    monkeypatch.setattr(session, "commit", _boom)
+
+    result = await _clear_stale_watcher_link(session, item)
+
+    assert result is False
+    # item remains usable and the link was not durably cleared
+    assert item.watcher_item_id == _WI_ID
+
+
+@pytest.mark.asyncio
+async def test_watcher_section_404_commit_failure_stays_degraded_and_retains_link(
+    client, session, monkeypatch
+):
+    """When clearing the stale link can't commit, the partial degrades (200) rather
+    than 500ing, and the link survives for the next read to retry."""
+    app.dependency_overrides[get_watcher_client] = lambda: _watcher_404()
+    item = InfoItem(name="section-404-commitfail", watcher_item_id=_WI_ID)
+    session.add(item)
+    await session.commit()  # durable so the helper's rollback preserves the row
+
+    monkeypatch.setattr(session, "commit", _boom)
+
+    r = await client.get(
+        f"/dashboard/info-items/{item.info_item_id}/watcher-section",
+        headers=_HEADERS,
+    )
+    assert r.status_code == 200
+    assert "Watcher unavailable" in r.text
+    assert "Not watching" not in r.text
+    assert item.watcher_item_id == _WI_ID

From 620f51e9428231735610c797448e72d5ce352ce0 Mon Sep 17 00:00:00 2001
From: gregoryfoster <gregoryfoster@users.noreply.github.com>
Date: Mon, 22 Jun 2026 18:17:02 +0000
Subject: [PATCH 4/4] #63 fix: render degraded from path id on failed reconcile
 (CR round 2, PR #64)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Addresses CR findings 6-9:

- check-now / toggle: on a failed link-clear, render degraded straight from
  the path item_id instead of re-rendering through the (possibly expired)
  item — removes the double clear-attempt and the not_watching/flash
  mismatch (finding 6), and closes the triple-fault path where the trailing
  render could touch an expired attribute and 500 (finding 9).
- Factor _status_degraded / _section_degraded (render degraded from an id
  alone) and shared message constants so the flash and degraded-panel copy
  stay aligned across render and action handlers (finding 8).
- Add action-handler commit-failure tests for check-now and toggle: degrade
  (200) with the reconcile flash, never 500, link retained (finding 7).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 src/dashboard/routes/info_items.py            | 103 +++++++++++-------
 tests/dashboard/test_watcher_404_reconcile.py |  53 +++++++++
 2 files changed, 114 insertions(+), 42 deletions(-)

diff --git a/src/dashboard/routes/info_items.py b/src/dashboard/routes/info_items.py
index ba22aea..1551831 100644
--- a/src/dashboard/routes/info_items.py
+++ b/src/dashboard/routes/info_items.py
@@ -994,6 +994,37 @@ def _format_cadence(schedule_config: object) -> str:
     return f"~{amount} {label}{plural}"
 
 
+# Copy for the WatchedItem-deleted (404) reconcile paths — shared so the flash
+# and degraded-panel wording stay aligned across the render and action handlers.
+_WATCHER_REMOVED_FLASH = "This item is no longer watched — it was removed in Watcher."
+_RECONCILE_FAILED_FLASH = (
+    "Watcher reports this item gone, but the local record couldn't be updated — retrying shortly."
+)
+_RECONCILE_FAILED_MSG = "couldn't update the local record after Watcher reported it gone"
+
+
+def _status_degraded(request: Request, item_id: str, error_message: str) -> HTMLResponse:
+    """Render the _watcher_status.html partial in the degraded state from an id alone.
+
+    Takes ``item_id`` (not an ``InfoItem``) so it is safe to call after a failed
+    reconcile, when the ORM object may have expired attributes.
+    """
+    return _templates.TemplateResponse(
+        request,
+        "info_items/_watcher_status.html",
+        {"item_id": item_id, "state": "degraded", "error_message": error_message},
+    )
+
+
+def _section_degraded(request: Request, item_id: str, error_message: str) -> HTMLResponse:
+    """Render the _watcher_section.html partial in the degraded state from an id alone."""
+    return _templates.TemplateResponse(
+        request,
+        "info_items/_watcher_section.html",
+        {"item_id": item_id, "state": "degraded", "error_message": error_message},
+    )
+
+
 async def _clear_stale_watcher_link(session: AsyncSession, item: InfoItem) -> bool:
     """Best-effort NULL of a watcher_item_id after Watcher reports the WatchedItem
     gone (404). Returns ``True`` when the link was durably cleared, ``False`` when
@@ -1069,28 +1100,15 @@ async def _render_status_partial(
         try:
             wi = await watcher.get_watched_item(item.watcher_item_id)
         except WatcherNotFound:
-            cleared = await _clear_stale_watcher_link(session, item)
-            if cleared:
+            if await _clear_stale_watcher_link(session, item):
                 return _templates.TemplateResponse(
                     request,
                     "info_items/_watcher_status.html",
                     {"item_id": item_id, "state": "not_watching"},
                 )
-            return _templates.TemplateResponse(
-                request,
-                "info_items/_watcher_status.html",
-                {
-                    "item_id": item_id,
-                    "state": "degraded",
-                    "error_message": "couldn't update the local watch record",
-                },
-            )
+            return _status_degraded(request, item_id, _RECONCILE_FAILED_MSG)
         except Exception as e:
-            return _templates.TemplateResponse(
-                request,
-                "info_items/_watcher_status.html",
-                {"item_id": item_id, "state": "degraded", "error_message": str(e)},
-            )
+            return _status_degraded(request, item_id, str(e))
 
     return _templates.TemplateResponse(
         request,
@@ -1133,28 +1151,15 @@ async def _render_watcher_section(
     try:
         wi = await watcher.get_watched_item(item.watcher_item_id)
     except WatcherNotFound:
-        cleared = await _clear_stale_watcher_link(session, item)
-        if cleared:
+        if await _clear_stale_watcher_link(session, item):
             return _templates.TemplateResponse(
                 request,
                 "info_items/_watcher_section.html",
                 {"item_id": item_id, "state": "not_watching"},
             )
-        return _templates.TemplateResponse(
-            request,
-            "info_items/_watcher_section.html",
-            {
-                "item_id": item_id,
-                "state": "degraded",
-                "error_message": "couldn't update the local watch record",
-            },
-        )
+        return _section_degraded(request, item_id, _RECONCILE_FAILED_MSG)
     except Exception as e:
-        return _templates.TemplateResponse(
-            request,
-            "info_items/_watcher_section.html",
-            {"item_id": item_id, "state": "degraded", "error_message": str(e)},
-        )
+        return _section_degraded(request, item_id, str(e))
 
     return _templates.TemplateResponse(
         request,
@@ -1240,15 +1245,17 @@ async def check_now(
 
     wi: WatchedItemResponse | None = None
     flash: tuple[str, str] | None = None
+    reconcile_failed = False
     try:
         wi = await watcher.check_now(item.watcher_item_id)
     except WatcherNotFound:
         # The WatchedItem is gone (deleted in Watcher). Clear the stale link so
         # the partial falls back to not_watching instead of looping on 404.
         if await _clear_stale_watcher_link(session, item):
-            flash = ("error", "This item is no longer watched — it was removed in Watcher.")
+            flash = ("error", _WATCHER_REMOVED_FLASH)
         else:
-            flash = ("error", "This item is gone in Watcher, but updating the local record failed.")
+            flash = ("error", _RECONCILE_FAILED_FLASH)
+            reconcile_failed = True
     except WatcherConflict:
         # Watcher 409s on check-now of a paused item. The button is hidden when
         # paused, but guard direct posts with the accurate reason.
@@ -1258,9 +1265,14 @@ async def check_now(
         # also fails. Either way, surface the action failure as a flash.
         flash = ("error", "Couldn't trigger a check — Watcher is unavailable. Try again shortly.")
 
-    response = await _render_status_partial(
-        request, session=session, item=item, watcher=watcher, pre_fetched=wi
-    )
+    if reconcile_failed:
+        # Clearing the link failed to commit; render degraded straight from the path
+        # id — don't re-render through the item (attrs may be expired) or re-fetch.
+        response = _status_degraded(request, item_id, _RECONCILE_FAILED_MSG)
+    else:
+        response = await _render_status_partial(
+            request, session=session, item=item, watcher=watcher, pre_fetched=wi
+        )
     response.headers["HX-Trigger"] = _watcher_hx_trigger(flash)
     return response
 
@@ -1400,15 +1412,17 @@ async def toggle_watch_active(
 
     wi: WatchedItemResponse | None = None
     flash: tuple[str, str] | None = None
+    reconcile_failed = False
     try:
         wi = await watcher.patch_watched_item(item.watcher_item_id, is_active=active == "true")
     except WatcherNotFound:
         # The WatchedItem is gone (deleted in Watcher). Clear the stale link so
         # the partial falls back to not_watching instead of looping on 404.
         if await _clear_stale_watcher_link(session, item):
-            flash = ("error", "This item is no longer watched — it was removed in Watcher.")
+            flash = ("error", _WATCHER_REMOVED_FLASH)
         else:
-            flash = ("error", "This item is gone in Watcher, but updating the local record failed.")
+            flash = ("error", _RECONCILE_FAILED_FLASH)
+            reconcile_failed = True
     except WatcherConflict:
         # Watcher rejects pause/resume on an archived item (archive/restore owns
         # activation there). The toggle is hidden in that state, but guard direct posts.
@@ -1419,8 +1433,13 @@ async def toggle_watch_active(
             "Couldn't update the watch state — Watcher is unavailable. Try again shortly.",
         )
 
-    response = await _render_status_partial(
-        request, session=session, item=item, watcher=watcher, pre_fetched=wi
-    )
+    if reconcile_failed:
+        # Clearing the link failed to commit; render degraded straight from the path
+        # id — don't re-render through the item (attrs may be expired) or re-fetch.
+        response = _status_degraded(request, item_id, _RECONCILE_FAILED_MSG)
+    else:
+        response = await _render_status_partial(
+            request, session=session, item=item, watcher=watcher, pre_fetched=wi
+        )
     response.headers["HX-Trigger"] = _watcher_hx_trigger(flash)
     return response
diff --git a/tests/dashboard/test_watcher_404_reconcile.py b/tests/dashboard/test_watcher_404_reconcile.py
index 960eaf1..24385fc 100644
--- a/tests/dashboard/test_watcher_404_reconcile.py
+++ b/tests/dashboard/test_watcher_404_reconcile.py
@@ -253,3 +253,56 @@ async def test_watcher_section_404_commit_failure_stays_degraded_and_retains_lin
     assert "Watcher unavailable" in r.text
     assert "Not watching" not in r.text
     assert item.watcher_item_id == _WI_ID
+
+
+@pytest.mark.asyncio
+async def test_check_now_404_commit_failure_degrades_with_flash_and_retains_link(
+    client, session, monkeypatch
+):
+    """check-now 404 + failed reconcile commit: degrade (200) with the reconcile
+    flash, never 500, and keep the link — no not_watching/flash mismatch (finding 6)."""
+    app.dependency_overrides[get_watcher_client] = lambda: _watcher_404()
+    item = InfoItem(name="check-now-404-commitfail", watcher_item_id=_WI_ID)
+    session.add(item)
+    await session.commit()  # durable so the helper's rollback preserves the row
+
+    monkeypatch.setattr(session, "commit", _boom)
+
+    r = await client.post(
+        f"/dashboard/info-items/{item.info_item_id}/check-now",
+        headers=_HEADERS,
+    )
+    assert r.status_code == 200
+    assert "Watcher unavailable" in r.text
+    assert "Not watching" not in r.text
+    hx_trigger = r.headers.get("HX-Trigger", "")
+    assert "showFlash" in hx_trigger
+    assert "the local record" in hx_trigger
+    assert item.watcher_item_id == _WI_ID
+
+
+@pytest.mark.asyncio
+async def test_toggle_404_commit_failure_degrades_with_flash_and_retains_link(
+    client, session, monkeypatch
+):
+    """toggle 404 + failed reconcile commit: degrade (200) with the reconcile flash,
+    never 500, and keep the link (findings 6/9)."""
+    app.dependency_overrides[get_watcher_client] = lambda: _watcher_404()
+    item = InfoItem(name="toggle-404-commitfail", watcher_item_id=_WI_ID)
+    session.add(item)
+    await session.commit()  # durable so the helper's rollback preserves the row
+
+    monkeypatch.setattr(session, "commit", _boom)
+
+    r = await client.post(
+        f"/dashboard/info-items/{item.info_item_id}/toggle-watch-active",
+        headers=_HEADERS,
+        data={"active": "false"},
+    )
+    assert r.status_code == 200
+    assert "Watcher unavailable" in r.text
+    assert "Not watching" not in r.text
+    hx_trigger = r.headers.get("HX-Trigger", "")
+    assert "showFlash" in hx_trigger
+    assert "the local record" in hx_trigger
+    assert item.watcher_item_id == _WI_ID