[guijacquemet]

Follow-up to the note on #59: when step 1 could not read a saved experiment_design.csv, _open_design fell back to the default design and called _save_design at once. The user's confirmed answers were overwritten before they answered anything. A typical case is a confirmed_on that a spreadsheet program rewrote as 26/10/2026, which #59 now refuses.

Summary

• notebook_ui.py: _open_design no longer writes when load_design reports a problem. A new _design_unreadable flag records this state.
  • The note is now a red card: "The saved experiment_design.csv cannot be read. It was left unchanged." It shows the reader's refusal, which names the line and column, and explains both ways forward: correct the file, then undo and confirm the labels to read it again; or answer the questions again, in which case the first answer replaces the file.
  • The "where saved" line says the unreadable file is kept as it is. It no longer claims the output folder cannot be written.
  • After the first answer is written, the note changes to "Your answers replaced the unreadable experiment_design.csv."
  • The questions start unanswered, so step 3 cannot run until every group is confirmed again. run_experiment itself still refuses with design_not_confirmed.
• Docs:
  • contract §12, "Notebook" row
  • user guide step 1 (new bullet)
  • user guide Python example: it now stops on problem instead of carrying on with the default design
  • plan §12, new question 42 with the decision

Decisions

• Owner decision of 31 October 2026: keep the unreadable file untouched and show the refusal that names the row and column. Write nothing until the user fixes the file or explicitly answers again. No silent fallback to a default design.

Notes for review

• The command line already behaved this way: run refuses with "Correct the file, or delete it" and writes nothing, and check only prints the problem. It is unchanged.
• load_design is unchanged: it still returns the default design together with problem, and callers must check problem. Making it raise would change the public API, so I left it for the owner to decide.
• The widgets were tested headless only. I have not looked at them in a real JupyterLab.
• No version bump or tag.

Tests

• New test_an_unreadable_design_is_left_untouched_until_answered (regression):
  • A confirmed design with a control has its dates re-saved as DD/MM/YYYY.
  • Reopening step 1 leaves the bytes unchanged, shows an error naming line 2, column confirmed_on, and leaves the design unconfirmed with the editor shown.
  • Undoing and confirming the labels again still writes nothing.
  • Restoring the file loads the original answers.
  • On old main it fails: the file is rewritten with confirmed=false.
• New test_answering_again_replaces_an_unreadable_design: an explicit answer replaces the file and the note changes. It fails on old main because the note is missing.
• test_an_unreadable_design_is_asked_again now also checks that the file is untouched before the answer.
• Gate (Python 3.13, .[dev,notebook,zarr]): ruff check . and ruff format --check . are clean. pytest: 1462 passed, 1 skipped. The skip is tests/test_discovery.py:665: the tests run as root, which ignores file modes.

---

Generated by Claude Code