A recipe-candidates request whose stored-recipe lookup failed logged the error unchanged, and that error quotes the search result's URL, which can carry a personal token, along with the database error text. dinners.Service.Candidates now wraps every failure other than a missing dinner in ErrCandidatesFailed, and writeDinnerError logs it as a fixed reason (candidates_failed) with the dinner id only, answering 500 internal. Not-found, not-configured and search-failed responses are unchanged. Fixes MQ-98-06 (Maestro 3759a975-f937-4284-81a2-9e61345a3aa3). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>