Log every unexpected recipe grounding failure by fixed reason

Wrap an initial dinner read failure on the candidate and link path, and
any manual-recipe read, store or write failure, in ErrGroundFailed so the
handler logs only reason=ground_failed and the dinner id, never database
text. Not-found, archived and conflict answers stay distinct.

Strengthen TestFixInFlightKeepsMemberEdits: start from populated method,
minutes and difficulty, edit each in flight in turn, and require the edit
kept and the untouched populated fields replaced by the recipe's values.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/server/dinners.go

@@ -202,7 +202,8 @@ func actorOrFail(w http.ResponseWriter, r *http.Request, logger *slog.Logger) (a
 // up is 409 not_configured; a search or model failure is 502; grounding by
 // hand that runs past dinners.GroundTimeout is 504 ground_timeout; grounding
 // an archived dinner is 409 dinner_archived and one changed while grounding
-// 409 ground_conflict. Any other grounding failure is 500, logged by reason
+// 409 ground_conflict. Any other grounding failure, by candidate, link or
+// manual recipe, wraps dinners.ErrGroundFailed and is 500, logged by reason
 // and dinner id only.
 func writeDinnerError(w http.ResponseWriter, r *http.Request, logger *slog.Logger, action string, err error) {
 	var invalid *dinners.ValidationError

internal/server/grounding_test.go

@@ -279,6 +279,45 @@ func TestPostGroundViaRecipeURLDinnerWriteFailure(t *testing.T) {
 	}
 }
 
+// TestPostGroundUnexpectedFailures: grounding by hand that fails reading
+// the dinner, or storing a manual recipe, is a 500 logged by reason and
+// dinner id, never with the database error.
+func TestPostGroundUnexpectedFailures(t *testing.T) {
+	t.Parallel()
+	const (
+		// Renaming a column every dinner read selects fails the read.
+		breakRead = `ALTER TABLE dinners RENAME COLUMN cuisine TO cuisine_gone`
+		// The trigger's message stands in for the database error.
+		breakStore = `CREATE TRIGGER refuse_recipes BEFORE INSERT ON recipes BEGIN SELECT RAISE(ABORT, 'disk full'); END`
+		manual     = `{"manual":{"ingredients":["1 lb beef"],"steps":["Brown."],"minutes":240,"method":"crockpot"}}`
+	)
+	for _, tc := range []struct {
+		name, sabotage, fix, leak string
+	}{
+		{"link read", breakRead, `{"recipe_url":"` + stewPage + `"}`, "cuisine"},
+		{"manual read", breakRead, manual, "cuisine"},
+		{"manual store", breakStore, manual, "disk full"},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+			e := newDinnersEnv(t).withRecipes(t)
+			id := createDinner(t, e.h, `{"name":"Sunday stew"}`)
+			if _, err := e.st.Writer.ExecContext(t.Context(), tc.sabotage); err != nil {
+				t.Fatal(err)
+			}
+
+			rec, body := callDinners(t, e.h, http.MethodPost, dinnersPath+"/"+id+"/ground", tc.fix)
+			if rec.Code != http.StatusInternalServerError || errorCode(body) != "internal" {
+				t.Errorf("POST = %d %s, want 500 internal", rec.Code, rec.Body)
+			}
+			logs := e.logs.String()
+			if strings.Contains(logs, tc.leak) || !strings.Contains(logs, "reason=ground_failed") || !strings.Contains(logs, "dinner_id="+id) {
+				t.Errorf("logs = %q, want reason=ground_failed and the dinner id, without the database error", logs)
+			}
+		})
+	}
+}
+
 // TestPostGroundArchived: grounding an archived dinner by hand is a 409.
 func TestPostGroundArchived(t *testing.T) {
 	t.Parallel()