catch render errors instead of showing a white screen

The repo had no error boundary anywhere, so a single malformed stored layout took the whole app down
and the only recovery was a psql session. Two boundaries, because "recover" means different things:

- around the routed screen in DashboardLayout, with the dock and header deliberately left outside so
  navigating away is itself a way out, plus a two-click reset of every `screens/*` layout for when it
  fails again in the same place. Dashboards are not touched — they are user-created and hold content.
- around each panel app in PanelSlot, so one bad app leaves the rest of the workspace running. Its
  recovery is "clear this panel", offered only when the layout is the user's to edit.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/workspaces/components/ErrorBoundary.tsx

@@ -0,0 +1,55 @@
+import { Component } from 'react';
+import type { ErrorInfo, ReactNode } from 'react';
+
+type FallbackArgs = { error: Error; reset: () => void };
+
+type ErrorBoundaryProps = {
+  children: ReactNode;
+  /** Rendered in place of the children once something below has thrown. */
+  fallback: (args: FallbackArgs) => ReactNode;
+  /**
+   * Clear the error whenever any of these changes — pass the pathname to recover on navigation, or the
+   * id of the thing being rendered. Without it a boundary latches: the screen stays broken until reload
+   * even after the user has navigated somewhere that would render fine.
+   */
+  resetKeys?: readonly unknown[];
+  onError?: (error: Error, info: ErrorInfo) => void;
+};
+
+type ErrorBoundaryState = { error: Error | null };
+
+/**
+ * The repo had none of these. A single malformed value anywhere below the router took the whole app to a
+ * white screen, and the only recovery from a bad stored layout was SQL — which is the wrong thing to ask
+ * of someone who has just opened the dashboard to read what happened overnight.
+ *
+ * Deliberately a render-prop rather than a fixed panel: what "recover" means is different for a screen
+ * (go somewhere else) and for one panel inside a workspace (clear the app, keep the rest running).
+ */
+export class ErrorBoundary extends Component<ErrorBoundaryProps, ErrorBoundaryState> {
+  override state: ErrorBoundaryState = { error: null };
+
+  static getDerivedStateFromError(error: Error): ErrorBoundaryState {
+    return { error };
+  }
+
+  override componentDidCatch(error: Error, info: ErrorInfo): void {
+    console.error('[error-boundary]', error, info.componentStack);
+    this.props.onError?.(error, info);
+  }
+
+  override componentDidUpdate(prev: ErrorBoundaryProps): void {
+    if (!this.state.error) return;
+    const a = prev.resetKeys ?? [];
+    const b = this.props.resetKeys ?? [];
+    if (a.length !== b.length || a.some((key, i) => !Object.is(key, b[i]))) this.setState({ error: null });
+  }
+
+  reset = (): void => this.setState({ error: null });
+
+  override render(): ReactNode {
+    const { error } = this.state;
+    if (error) return this.props.fallback({ error, reset: this.reset });
+    return this.props.children;
+  }
+}

src/workspaces/officerdev/src/components/Workspace/PanelErrorFallback.tsx

@@ -0,0 +1,50 @@
+import { AlertTriangle } from 'lucide-react';
+
+type PanelErrorFallbackProps = {
+  error: Error;
+  reset: () => void;
+  /** Null when the panel is not interactive — then there is nothing to clear it back to. */
+  onClearApp: (() => void) | null;
+};
+
+/**
+ * One panel's app threw. The workspace around it keeps running — the other panels are still live, and
+ * that is the whole point: a dashboard left running overnight should not be taken to a white screen by
+ * whichever app happened to receive a malformed value.
+ *
+ * Compact on purpose. A panel can be 200px tall, so the stack lives behind a `<details>` and the two
+ * recoveries are the only things guaranteed to be visible.
+ */
+export const PanelErrorFallback = ({ error, reset, onClearApp }: PanelErrorFallbackProps) => (
+  <div className="flex h-full w-full flex-col items-center justify-center gap-2 overflow-auto p-3 text-center">
+    <AlertTriangle className="size-5 shrink-0 text-amber-500" />
+    <p className="text-sm font-medium">This panel failed to render</p>
+    <p className="text-muted-foreground max-w-full truncate text-xs" title={error.message}>
+      {error.message || 'Unknown error'}
+    </p>
+    <div className="flex flex-wrap items-center justify-center gap-2 pt-1">
+      <button
+        type="button"
+        onClick={reset}
+        className="cursor-pointer rounded border px-2 py-1 text-xs transition-colors hover:bg-black/5"
+      >
+        Try again
+      </button>
+      {onClearApp && (
+        <button
+          type="button"
+          onClick={onClearApp}
+          className="cursor-pointer rounded border px-2 py-1 text-xs transition-colors hover:bg-black/5"
+        >
+          Clear this panel
+        </button>
+      )}
+    </div>
+    {error.stack && (
+      <details className="w-full text-left">
+        <summary className="text-muted-foreground cursor-pointer select-none text-[11px]">Details</summary>
+        <pre className="mt-1 max-h-40 overflow-auto whitespace-pre-wrap text-[10px] opacity-70">{error.stack}</pre>
+      </details>
+    )}
+  </div>
+);

src/workspaces/officerdev/src/components/Workspace/PanelSlot.tsx

@@ -5,7 +5,9 @@ import type { LayoutPanel, AppRegistryMap, PanelComponents, PanelComponentEntry
 import { useWorkspace } from './WorkspaceContext';
 import { ZOOM_MIN, ZOOM_MAX, ZOOM_STEP } from './layout-utils';
 import { Card } from '@/components/Card';
+import { ErrorBoundary } from '@/components/ErrorBoundary';
 import { AppPicker } from './AppPicker';
+import { PanelErrorFallback } from './PanelErrorFallback';
 import {
   ContextMenu,
   ContextMenuTrigger,
@@ -382,6 +384,24 @@ export const PanelSlot = ({
         )
     : (content: React.ReactNode) => <>{content}</>;
 
+  // One app throwing must not take the workspace with it — the other panels are still live, and on a
+  // dashboard left running overnight they are the result. Keyed on the panel's identity, so swapping the
+  // app or clearing it is itself a recovery. A locked layout offers no "clear": it isn't the user's to edit.
+  const guardApp = (node: React.ReactNode) => (
+    <ErrorBoundary
+      resetKeys={[panel.id, panel.appType]}
+      fallback={({ error, reset }) => (
+        <PanelErrorFallback
+          error={error}
+          reset={reset}
+          onClearApp={interactive && !locked ? () => onSetApp(panel.id, null) : null}
+        />
+      )}
+    >
+      {node}
+    </ErrorBoundary>
+  );
+
   const overlays =
     interactive && !locked ? (
       <>
@@ -413,7 +433,7 @@ export const PanelSlot = ({
     return contextMenu(
       <div data-panel-id={panel.id} className="group/panel relative h-full w-full p-1">
         <div className="@container relative h-full w-full overflow-hidden">
-          <AppComponent panelId={panel.id} />
+          {guardApp(<AppComponent panelId={panel.id} />)}
         </div>
         {overlays}
       </div>,
@@ -518,7 +538,7 @@ export const PanelSlot = ({
     <div className="flex-1 min-h-0">
       <Card className="h-full w-full overflow-hidden p-0 rounded-none border-0 shadow-none">
         <div className="@container h-full w-full" style={zoom !== null && zoom !== 1 ? { zoom } : undefined}>
-          <AppComponent panelId={panel.id} />
+          {guardApp(<AppComponent panelId={panel.id} />)}
         </div>
       </Card>
     </div>