fix(webui): authority-aware ownership + redacted contamination text (#641)

Addresses the two blockers from the PR #898 review at a81db754.

B1 - degraded ownership inventory was rendered as affirmative absence.
_build_session_rows read the sessions/leases/locks sections without
consulting their status, so a session row emitted lease_ids=() and
worktree_paths=() whether the session genuinely held nothing or the
lease store simply could not be read. The renderer printed both as
"none" and "unbound", contradicting the ownership_authority_complete
invariant documented on InventorySnapshot.

SessionRow now carries lease_authority and worktree_authority. A
worktree binding is correlated through lease work numbers, so it is
unproven when either the leases or the locks section fails to read --
this covers the narrow variant where locks hold real worktree paths but
a degraded leases section leaves work_numbers empty. The renderer emits
"unknown (inventory <status>)" with an authority-unproven badge instead
of none/unbound, the card names the unreadable sections, and an empty
session list from an unreadable sessions section no longer reads as
"no sessions recorded". snapshot_to_dict exports
ownership_authority_complete, ownership_section_status, and per-row
lease_authority / worktree_authority so /api/sessions consumers can
distinguish the two cases.

B2 - contamination payload strings bypassed redaction.
_inspect_contamination copied command_summary, session_id, role and
reason_class out of the marker payload with only str(), while every
inventory-sourced field on the same page arrives through
webui.inventory.scrub(). The write-time redactor
stable_branch_push_guard.redact_command is a narrow denylist that leaves
absolute $HOME paths, -H 'X-Api-Key: <value>', --password <value>, and
PRIVATE_KEY=<value> intact, and this is the first web surface to render
command_summary at all.

Adds webui.inventory.scrub_text(), which collapses $HOME and redacts
credential-shaped tokens and URL userinfo anywhere inside a string rather
than only at its start, and routes the marker payload through it. scrub()
and every existing caller are untouched. The command_summary field is
kept: it is the #630 evidence naming which daemon was killed. The module
docstring claiming absolute paths were already collapsed is corrected.

Also: removes the locks_by_session_hint dead loop and its discard (N1),
adds the missing trailing newline to webui/runtime_views.py (N4), drops
an unused dataclasses.field import, and documents both honesty rules in
docs/webui-local-dev.md.

Tests: tests/test_webui_sessions_view.py grows from 12 to 26 cases,
covering degraded and unavailable ownership sections in both the HTML and
JSON paths, the locks-readable/leases-degraded variant, a guard against
over-correcting clean inventory into "unknown", the previously untested
expired-lease flag, HTML escaping of hostile values in clean and degraded
renders, and each secret class the write-time denylist misses. The
STATUS_UNAVAILABLE import that was present but unused is now exercised.

Validation, from the issue worktree with venv/bin/python (Python 3.14.5,
pytest 9.1.1):

  pytest tests/test_webui_sessions_view.py tests/test_webui_*.py -q
    -> 512 passed, 376 subtests (was 498 / 372; +14 new tests)
  pytest tests/test_issue_854_semantic_container_exclusion.py -q
    -> 13 passed, 8 subtests
  13-file runtime/health/inventory/restart set
    -> 1 failed, 223 passed; the single failure is
       test_runtime_clarity.py::TestRuntimeClarity::
       test_activate_profile_succeeds_when_enabled, the identical test and
       assertion the reviewer recorded on master at 7af40fb5, so it is
       baseline-equivalent and not introduced here.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

webui/session_views.py

@@ -11,6 +11,7 @@ from __future__ import annotations
 from html import escape
 from typing import Sequence
 
+from webui.inventory import STATUS_OK
 from webui.layout import render_page
 from webui.session_loader import (
     ContaminationMarker,
@@ -29,6 +30,19 @@ def _flags(flags: Sequence[str], *, css: str) -> str:
     return " ".join(_badge(flag, css) for flag in flags)
 
 
+def _unproven_cell(status: str) -> str:
+    """Render an ownership column whose backing inventory section failed to read.
+
+    Never "none" and never "unbound": an unreadable source proves nothing about
+    ownership, and claiming otherwise is the exact failure the
+    ``ownership_authority_complete`` invariant exists to prevent.
+    """
+    return (
+        f'<span class="muted">unknown (inventory {escape(status)})</span><br>'
+        f'{_badge("authority unproven", "badge-health-degraded")}'
+    )
+
+
 def _runtime_banner(snapshot: SessionViewSnapshot) -> str:
     runtime = snapshot.runtime
     stale = runtime.stale_runtime_warning
@@ -73,15 +87,37 @@ def _summary_bar(snapshot: SessionViewSnapshot) -> str:
     contaminated = snapshot.contaminated_session_count
     active_markers = len(snapshot.active_contamination)
     inv_status = snapshot.inventory.status
+    authority_complete = snapshot.ownership_authority_complete
+    authority_text = "complete" if authority_complete else "incomplete"
+    authority_css = "badge-health-ok" if authority_complete else "badge-health-degraded"
     return f"""<div class="health-card" style="display:flex; flex-wrap:wrap; gap:1rem; align-items:center;">
   <div><strong>Sessions:</strong> <span class="badge badge-health-ok">{total}</span></div>
   <div><strong>Stale:</strong> <span class="badge badge-stale">{stale}</span></div>
   <div><strong>Contaminated:</strong> <span class="badge badge-blocked">{contaminated}</span></div>
   <div><strong>Active markers:</strong> <span class="badge badge-health-unproven">{active_markers}</span></div>
   <div><strong>Inventory:</strong> <span class="badge badge-health-skipped">{escape(inv_status)}</span></div>
+  <div><strong>Ownership authority:</strong> <span class="badge {authority_css}">{authority_text}</span></div>
 </div>"""
 
 
+def _ownership_caveat(snapshot: SessionViewSnapshot) -> str:
+    """Name the unreadable ownership sections, or render nothing when all read."""
+    if snapshot.ownership_authority_complete:
+        return ""
+    degraded = ", ".join(
+        f"{name}: {status}"
+        for name, status in snapshot.ownership_section_status.items()
+        if status != STATUS_OK
+    )
+    return (
+        '<div class="health-card health-stale">'
+        "<strong>Ownership authority incomplete:</strong> "
+        f"{escape(degraded)}. Columns marked <em>unknown</em> could not be read. "
+        "No session below may be treated as holding no lease or no worktree "
+        "binding — absence of evidence is not evidence of absence.</div>"
+    )
+
+
 def _render_session_row(row: SessionRow) -> str:
     pid = "—" if row.pid is None else str(row.pid)
     pid_alive = "—" if row.pid_alive is None else ("alive" if row.pid_alive else "dead")
@@ -90,21 +126,33 @@ def _render_session_row(row: SessionRow) -> str:
         if row.pid_alive is True
         else ("badge-blocked" if row.pid_alive is False else "badge-health-skipped")
     )
-    leases = (
-        ", ".join(f"<code>{escape(lid)}</code>" for lid in row.lease_ids)
-        if row.lease_ids
-        else '<span class="muted">none</span>'
-    )
-    work = (
-        ", ".join(escape(ref) for ref in row.work_refs)
-        if row.work_refs
-        else '<span class="muted">—</span>'
-    )
-    worktrees = (
-        "<br>".join(f"<code>{escape(path)}</code>" for path in row.worktree_paths)
-        if row.worktree_paths
-        else '<span class="muted">unbound</span>'
-    )
+    # An empty tuple only means "holds none" when its source read cleanly.
+    if row.lease_authority != STATUS_OK:
+        lease_cell = _unproven_cell(row.lease_authority)
+    else:
+        leases = (
+            ", ".join(f"<code>{escape(lid)}</code>" for lid in row.lease_ids)
+            if row.lease_ids
+            else '<span class="muted">none</span>'
+        )
+        work = (
+            ", ".join(escape(ref) for ref in row.work_refs)
+            if row.work_refs
+            else '<span class="muted">—</span>'
+        )
+        lease_cell = (
+            f'{leases}<div class="muted" style="font-size:0.82rem; '
+            f'margin-top:0.2rem;">{work}</div>'
+        )
+
+    if row.worktree_authority != STATUS_OK:
+        worktrees = _unproven_cell(row.worktree_authority)
+    else:
+        worktrees = (
+            "<br>".join(f"<code>{escape(path)}</code>" for path in row.worktree_paths)
+            if row.worktree_paths
+            else '<span class="muted">unbound</span>'
+        )
     return f"""<tr>
   <td><code>{escape(row.session_id)}</code></td>
   <td>
@@ -116,15 +164,24 @@ def _render_session_row(row: SessionRow) -> str:
     {_badge(pid_alive, pid_css)}
   </td>
   <td>{escape(str(row.status or "—"))}<div class="muted" style="font-size:0.82rem;">{escape(str(row.last_heartbeat_at or ""))}</div></td>
-  <td>{leases}<div class="muted" style="font-size:0.82rem; margin-top:0.2rem;">{work}</div></td>
+  <td>{lease_cell}</td>
   <td>{worktrees}</td>
   <td>{_flags(row.stale_flags, css="badge-stale")}</td>
   <td>{_flags(row.contamination_flags, css="badge-blocked")}</td>
 </tr>"""
 
 
-def _sessions_table(rows: Sequence[SessionRow]) -> str:
+def _sessions_table(snapshot: SessionViewSnapshot) -> str:
+    rows: Sequence[SessionRow] = snapshot.sessions
     if not rows:
+        sessions_status = snapshot.ownership_section_status.get("sessions", STATUS_OK)
+        if sessions_status != STATUS_OK:
+            return (
+                '<p class="muted">Session inventory is '
+                f"<strong>{escape(sessions_status)}</strong> — the session list "
+                "could not be read. This is not evidence that no sessions "
+                "exist.</p>"
+            )
         return (
             '<p class="muted">No control-plane sessions recorded. Inventory may '
             "be unavailable, or no MCP workers have registered yet.</p>"
@@ -329,8 +386,10 @@ def render_sessions_page(snapshot: SessionViewSnapshot) -> str:
 <div class="prompt-card">
   <h3>Sessions</h3>
   <p class="muted">Control-plane sessions correlated with leases and worktree bindings.
-  Stale and contamination flags are fail-soft: absence of a marker is not proof of cleanliness when inventory is degraded.</p>
-  {_sessions_table(snapshot.sessions)}
+  Stale and contamination flags are fail-soft: absence of a marker is not proof of cleanliness when inventory is degraded.
+  Lease and worktree columns read <em>unknown (inventory …)</em> when their source could not be loaded.</p>
+  {_ownership_caveat(snapshot)}
+  {_sessions_table(snapshot)}
 </div>
 
 {_namespaces_section(snapshot)}