Casework: a task template preview is silently skipped when a subject field is denied, concealed, or missing

[jeremi]

What

When Casework builds the task template previews for a work item, it reads each template's subject fields live, under the officer's own token, through the source adapter. If the source answers Denied or Concealed, or if disclosed_subjects cannot produce a value, the loop skips that template with a bare continue. The officer sees a shorter list of offerable tasks with no indication that a template was withheld or why. A misconfigured template, a subject field the officer's read profile cannot see, or a record missing a subject value all present identically: the task is simply never offered.

Nothing catches this before runtime either. caseworkctl check has no diagnostic that cross-checks a template's subject fields against the read authority of the profiles that will preview it.

Evidence

• crates/registry-casework/src/task_grants.rs, the preview loop around lines 466 to 500:
  • Err(registry_casework_core::SourceAdapterError::Denied | registry_casework_core::SourceAdapterError::Concealed) => continue, after read_task_context
  • let Ok(subjects) = template.disclosed_subjects(&context.values) else { continue; };
• Both arms discard the template without recording anything. The surrounding function returns only TaskTemplatePreviews { item_revision, templates }, so there is no channel for a withheld entry.
• rg task_template crates/registry-caseworkctl/src shows template handling in dev/integrations.rs and dev/mod.rs only; no check-time subject readability diagnostic exists.

Proposed fix

Two parts.

1. Return a structured warning alongside the previews naming the template id, the work item and the field or condition that caused the omission, and surface it in the officer response so a UI can say "one template was not offered" rather than silently showing fewer. Keep the field value out of the warning; the template and field id are enough.
2. Add a caseworkctl check --source-project cross-check that every subject field named by every task template is readable by every access profile eligible to preview it, so the misconfiguration is refused at check time instead of disappearing at runtime.

Found while

Extracting reusable App Kit skills against Registry Stack v0.32.0.