Group onboard wireless steps and trace journalled Bluetooth failures

tests/test_node_k1_bridge.py

@@ -70,6 +70,33 @@ def bridge():
     return result
 
 
+def test_journalled_failure_logs_source_without_secret_and_does_not_repeat(caplog):
+    from bleak.exc import BleakError
+
+    secret = secrets.token_hex(20)
+    device = bridge()
+    calls = []
+    identifier = "op_" + "c" * 32
+    native = plugin_operation_id(identifier)
+
+    async def invoke(action, payload, _identifier):
+        calls.append(action)
+        if action == "network.provision":
+            raise BleakError(secret)
+        return {"operations": [{"operation_id": native, "status": "failed"}]}
+
+    device.invoke = invoke
+    result = asyncio.run(device.invoke_journalled(
+        "network.provision", {"operation_id": native, "password": secret}, identifier,
+    ))
+    assert result["operations"][0]["status"] == "failed"
+    assert calls == ["network.provision", "state.read"]
+    assert "exception=BleakError" in caplog.text
+    assert "test_node_k1_bridge.py:invoke:" in caplog.text
+    assert identifier in caplog.text
+    assert secret not in caplog.text
+
+
 def test_node_scan_reaches_service_through_real_facade_with_runtime_fence():
     """Exercise the actual admission boundary, replacing only the BLE service."""
     from k1link.device_plugins.xgrids_k1.facade import SnapshotRuntimeConflict