From ea876f94642497b8a07b2b9842e713cc08c148f5 Mon Sep 17 00:00:00 2001
From: Dotta <bippadotta@protonmail.com>
Date: Fri, 24 Apr 2026 17:27:10 -0500
Subject: [PATCH] Tighten watchdog decision gating

Co-Authored-By: Paperclip <noreply@paperclip.ing>
---
 ui/src/components/IssueRunLedger.tsx | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/ui/src/components/IssueRunLedger.tsx b/ui/src/components/IssueRunLedger.tsx
index cda31a41e11..45f9bc2671f 100644
--- a/ui/src/components/IssueRunLedger.tsx
+++ b/ui/src/components/IssueRunLedger.tsx
@@ -319,14 +319,14 @@ function canBoardRecordWatchdogDecision(
   companyId: string,
   boardAccess: CurrentBoardAccess | undefined,
 ) {
-  if (!boardAccess) return true;
+  if (!boardAccess) return false;
   if (boardAccess.source === "local_implicit" || boardAccess.isInstanceAdmin) return true;
 
   const membership = boardAccess.memberships?.find(
     (item) => item.companyId === companyId && item.status === "active",
   );
   if (!membership) return boardAccess.companyIds.includes(companyId) && !boardAccess.memberships;
-  return membership.membershipRole !== "viewer";
+  return membership.membershipRole !== "viewer" && membership.membershipRole !== null;
 }
 
 function watchdogDecisionErrorMessage(error: unknown) {
@@ -386,12 +386,13 @@ export function IssueRunLedger({
     },
     onError: (error) => {
       const message = watchdogDecisionErrorMessage(error);
+      const dedupeSuffix = error instanceof ApiError ? String(error.status) : "error";
       setWatchdogDecisionError(message);
       pushToast({
         title: "Watchdog decision not recorded",
         body: message,
         tone: "error",
-        dedupeKey: `watchdog-decision:${issueId}:forbidden`,
+        dedupeKey: `watchdog-decision:${issueId}:${dedupeSuffix}`,
       });
     },
   });