Triple-C

Two accuracy defects from re-review, both the same class as the bug this
branch exists to fix.

`probe_failed` rendered every failure as "This project's container could
not be inspected", but only two of the four readings are about the
container -- the others are the base image and the snapshot. A malformed
base image name in settings therefore pointed the user at the wrong object.
The sentence now names the check rather than the container.

The doc claimed "the first error wins, in call order". It does not: the
checks run container_id, base_image_id, container_running, while the daemon
is called in a different order entirely. The priority is deliberate -- it
puts the reading that stopped the probe first -- so the comment now says
that, instead of describing an order the code does not use.

The test guarding the first point asserted the message does not contain
"Docker", using a synthetic payload. The real bollard error for that case
is "Docker responded with status code 400: invalid reference format", so
the assertion passed only because the payload was invented. It now uses the
real shape and asserts what actually matters: that nothing we add claims
the daemon was unreachable or names the container.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

2026-09-18 19:53:52 -07:00

capabilities

security: drop opener:allow-open-url now that nothing calls it

2026-09-17 10:10:45 -07:00

gen/schemas

chore: regenerate capabilities schema after dropping the opener grant

2026-09-17 10:11:03 -07:00

icons

Give the app a mark that survives being 16 pixels tall

2026-08-11 12:01:39 -07:00

src

fix: say which check failed, and stop claiming an order we do not use