fix(push): text preflight fails closed on a labels.csv read error

[saadqbal]

What

manifestReferencedTextNames (enforced-text preflight) skipped a failed labels.csv read with continue, returning a partial referenced set — so the text files named by the unread rows would silently escape the enforced record-format check (local fail-open). A persistent read error would also spin the loop forever.

The image mirror-check CrossCheckLabels already aborts on the same read error; this makes the enforced-text path match and fail closed.

Bugbot framing vs. reality

Bugbot flagged this as "skips bad CSV rows." That specific scenario isn't reproducible: openCSVReader sets LazyQuotes + FieldsPerRecord=-1, so every malformed CSV shape (bare/unbalanced quotes, ragged rows, null bytes, stray CR) parses cleanly — exactly like pandas. Verified empirically. The err != nil branch is therefore reachable only via a genuine I/O read error, not content. The fix is still correct (fail closed + consistent with the image sibling + removes the latent infinite loop); the code comment and test say so honestly rather than repeating the "bad row" framing.

Test

The branch can't be hit through a real file, so the parse loop is split into referencedTextNames(*csv.Reader) and exercised with an injected reader that yields the header then fails — asserting the walk returns the wrapped read error instead of a partial set.

Scope

Bugbot drive-by on promote PR #219; rolls up under release ticket #220 (no separate kanban item). Targets develop so it joins the v0.8.0 payload before staging QA.

🤖 Generated with Claude Code

---

Note

Medium Risk
Changes local dataset preflight validation for enforced text record formats; incorrect behavior could let some manifest-referenced files skip checks, but the change tightens fail-closed behavior to match existing image preflight.

Overview
Enforced-text preflight no longer keeps walking labels.csv when a row read fails with a real I/O error. It now aborts and returns a wrapped reading labels.csv error, matching how CrossCheckLabels handles the same failure for image layouts.

The manifest walk is split into referencedTextNames(*csv.Reader) so that behavior can be tested without a real file. A test uses an injected reader that serves the header then fails mid-stream, asserting discovery does not return a partial referenced filename set (which would skip validation for unread rows).

Comments clarify that with LazyQuotes and FieldsPerRecord=-1, malformed CSV rows are not what hit this branch—only genuine read failures do.

^{Reviewed by Cursor Bugbot for commit 1831a54. Bugbot is set up for automated code reviews on this repo. Configure here.}