[0xacee]

Why this matters

An unreadable asset directory can produce a successful Pixel publication receipt even though its CSS/JS/images were silently omitted. In the real socket/HTTP regression, the base returns readbackVerified=true and HTTP 200 for index.html while the referenced stylesheet returns 404.

os.walk ignores directory enumeration errors by default. Propagate them through the existing unsafe_directory failure category during source capture and snapshot verification, before issuing a success receipt.

Overlap check

Searched live open/closed titles and workspace_preview.py changes. #4226 adds allowed named text files; merged #4553 supports empty assets; #4357 handles asset query strings; #4083/#5082 handle diff line representation. None handles failed directory enumeration. This change does not depend on #5082; shared-file composition will be recorded separately.

Validation

• Baseline fails with a real mode-000 nested directory under an unprivileged owner: success receipt, one captured file, stylesheet HTTP 404.
• 34 preview tests pass. The new Unix control-socket/HTTP boundary checks failure without a partial snapshot, successful publication and asset readback after permission recovery, and continued exclusion of unreadable .git metadata.
• Existing preview ownership, file-type, symlink, content-hash and empty-asset controls remain green.
• Ruff and git diff --check pass; the new boundary test is wired into Linux CI.

Linux x86_64/WSL, real filesystem permissions and loopback sockets, temporary install data only. This is publication correctness, not a claim of a remote exploit. Root-run permission tests explicitly skip because root bypasses the intended denial. Installed service recovery and independent human review remain pending; not merge-approved. AI-assisted implementation and validation.

Review status and composition

Candidate 8abbce5: 1 failure, 4 skipped, 31 success. Independent review remains outstanding. The failed openSUSE smoke job cannot install jq/rsync because package mirrors return HTTP 403/404. The contributor rerun request returned HTTP 403 (repository admin rights required).

All 20 companion changes compose at local synthetic head aef9e2e41b8acfe6e7f3e548d0affae03c88fb7f: 1,112 frontend tests, 72 focused API tests and the related CLI suites pass; frontend build/lint pass (0 errors, 597 existing warnings), and all 24 workflow YAML files parse. This unpublished test head also includes #4986/#4987, #3039 and the #3189/#3288 tests; it is not an installed-stack qualification.

Follow-up commit 8abbce5 moves the CI hook so it composes cleanly with #5082. The production fix is unchanged; the combined preview suite passes 36 tests.