@remnic/core 10.0.55 → 10.0.57

package/dist/{chunk-XVTB6BZS.js → chunk-P5FYZH5G.js}

@@ -26,7 +26,7 @@ import {
 } from "./chunk-KNA3BXXL.js";
 
 // src/namespaces/catalog.ts
-import path from "path";
+import path2 from "path";
 import {
   appendFile,
   lstat,
@@ -35,10 +35,131 @@ import {
   readdir,
   realpath,
   rename,
+  rm,
   stat,
   writeFile
 } from "fs/promises";
 import { StringDecoder } from "string_decoder";
+
+// src/namespaces/catalog-read-boundary.ts
+import path from "path";
+async function sanitizeRecordForRead(port, record) {
+  if (record.namespace !== port.defaultNamespaceIdentity && !isSafeRouteNamespace(record.namespace)) {
+    return null;
+  }
+  if (await port.isContainedStorageDir(record.storageDir) && await port.isStorageDirForNamespace(record.namespace, record.storageDir)) {
+    return record;
+  }
+  const safe = await port.resolveSafeStorageDir(record.namespace);
+  return { ...record, storageDir: safe };
+}
+function storageRootOwnershipRank(port, record, resolvedStorageDir, configured) {
+  if (resolvedStorageDir === path.resolve(port.memoryDir)) {
+    return record.namespace === port.defaultNamespaceIdentity ? 0 : 3;
+  }
+  const leaf = path.basename(resolvedStorageDir);
+  const tokenOwnsRoot = namespaceIdentityToken(record.namespace) === leaf;
+  if (tokenOwnsRoot && configured.has(record.namespace)) {
+    return 0;
+  }
+  if (record.namespace === leaf) return 1;
+  if (tokenOwnsRoot) return 2;
+  return 3;
+}
+function configuredNamespaceIdentities(config) {
+  return new Set(
+    [
+      config.defaultNamespace,
+      config.sharedNamespace,
+      ...config.namespacePolicies.map((p) => p.name)
+    ].map((n) => normalizeNamespaceIdentity(n)).filter((n) => n.length > 0)
+  );
+}
+function preferStorageRootOwner(port, current, candidate, resolvedStorageDir, configured) {
+  const currentRank = storageRootOwnershipRank(
+    port,
+    current,
+    resolvedStorageDir,
+    configured
+  );
+  const candidateRank = storageRootOwnershipRank(
+    port,
+    candidate,
+    resolvedStorageDir,
+    configured
+  );
+  if (candidateRank < currentRank) return candidate;
+  if (candidateRank > currentRank) return current;
+  const byName = candidate.namespace.localeCompare(current.namespace);
+  if (byName < 0) return candidate;
+  if (byName > 0) return current;
+  return candidate.identityToken.localeCompare(current.identityToken) < 0 ? candidate : current;
+}
+function dropDuplicateStorageRootAliases(port, records, config) {
+  const byStorageDir = /* @__PURE__ */ new Map();
+  const configured = configuredNamespaceIdentities(config);
+  for (const record of records) {
+    const resolvedStorageDir = path.resolve(record.storageDir);
+    const current = byStorageDir.get(resolvedStorageDir);
+    if (!current) {
+      byStorageDir.set(resolvedStorageDir, record);
+      continue;
+    }
+    const owner = preferStorageRootOwner(
+      port,
+      current,
+      record,
+      resolvedStorageDir,
+      configured
+    );
+    const alias = owner === current ? record : current;
+    byStorageDir.set(resolvedStorageDir, mergeNewerTouchFields(owner, alias));
+  }
+  return [...byStorageDir.values()];
+}
+
+// src/namespaces/catalog-repair.ts
+import { createHash } from "crypto";
+var MALFORMED_REPAIR_DROP_BACKOFF_MS = 250;
+var MalformedCatalogRepairGate = class {
+  inFlight;
+  nextAttemptAt = 0;
+  attempts = 0;
+  /** Test-only observability: attempts that actually entered the gate. */
+  get attemptCount() {
+    return this.attempts;
+  }
+  /**
+   * Run `attempt` unless one is already in flight or the backoff window is on.
+   * Resolves when the attempt settles; never rejects (the repair is fail-open).
+   */
+  run(attempt) {
+    if (this.inFlight || Date.now() < this.nextAttemptAt) return Promise.resolve();
+    this.attempts += 1;
+    this.inFlight = Promise.resolve().then(async () => {
+      let outcome = "failed";
+      try {
+        outcome = await attempt();
+      } catch {
+        outcome = "failed";
+      } finally {
+        this.inFlight = void 0;
+        if (outcome === "dropped") {
+          this.nextAttemptAt = Date.now() + MALFORMED_REPAIR_DROP_BACKOFF_MS;
+        }
+      }
+    });
+    return this.inFlight;
+  }
+};
+function malformedSidecarPath(catalogPath, dropped) {
+  return `${catalogPath}.malformed-${contentHash(dropped.join("\n"))}`;
+}
+function contentHash(input) {
+  return createHash("sha256").update(input, "utf8").digest("hex").slice(0, 16);
+}
+
+// src/namespaces/catalog.ts
 var NAMESPACE_KINDS = [
   "default",
   "shared",
@@ -77,7 +198,7 @@ function isCatalogEnabled(config) {
 }
 var FILE_MEMORY_DATA_CHILDREN = /* @__PURE__ */ new Set(["profile.md"]);
 async function inspectMemoryDataMarker(rootDir, child) {
-  const childPath = path.join(rootDir, child);
+  const childPath = path2.join(rootDir, child);
   let entry;
   try {
     entry = await lstat(childPath);
@@ -225,9 +346,9 @@ var NamespaceCatalog = class {
   constructor(config) {
     this.config = config;
     this.memoryDir = config.memoryDir;
-    this.stateDir = path.join(this.memoryDir, STATE_DIR);
-    this.catalogPath = path.join(this.stateDir, CATALOG_FILE);
-    this.rebuildLockPath = path.join(this.stateDir, REBUILD_LOCK_FILE);
+    this.stateDir = path2.join(this.memoryDir, STATE_DIR);
+    this.catalogPath = path2.join(this.stateDir, CATALOG_FILE);
+    this.rebuildLockPath = path2.join(this.stateDir, REBUILD_LOCK_FILE);
     this.defaultNamespaceIdentity = normalizeNamespaceIdentity(config.defaultNamespace);
     this.compactBytesLimit = config.namespacesCatalogCompactBytes ?? 16 * 1024 * 1024;
     this.readCoalesceMs = config.namespacesCatalogReadTouchCoalesceMs ?? 6e4;
@@ -297,6 +418,12 @@ var NamespaceCatalog = class {
   compactBytesLimit;
   readCoalesceMs;
   writeCoalesceMs;
+  // #3298 review: single-flight + backoff gate for the malformed-catalog repair.
+  malformedRepairGate = new MalformedCatalogRepairGate();
+  /** Test-only observability: how many repair attempts actually entered the gate. */
+  get malformedRepairAttemptsForTest() {
+    return this.malformedRepairGate.attemptCount;
+  }
   // Size after the most recent auto-compaction (0 = none yet). Hysteresis for
   // maybeAutoCompact: a folded catalog that is itself above the limit (many
   // distinct namespaces) would otherwise be re-folded + re-rewritten on every
@@ -315,100 +442,39 @@ var NamespaceCatalog = class {
     return isCatalogEnabled(this.config);
   }
   // ── Public enumeration API ──────────────────────────────────────────────
-  /**
-   * Sanitize a record at the enumeration boundary (round 5, cursor Medium + codex
-   * P2; round 6 — NDXHe). Reads return whatever is in `namespaces.jsonl` after
-   * schema checks only, so a tampered or pre-fix row could surface unsafe data to
-   * maintenance/QMD until a rewrite occurs. Two distinct defenses:
-   *
-   *  1. UNSAFE NAMESPACE NAME (NGZqr, codex P2): an unsafe non-default namespace
-   *     (e.g. `../evil`, a name with separators, or >64 chars) is REJECTED outright
-   *     — return `null` so the caller drops it. The disk SCAN and the hot touch
-   *     path both reject such names with the SAME default-exempt `isSafeRouteNamespace`
-   *     gate, so the read boundary MUST agree, or `listNamespaces()`/`getNamespaceRecord()`
-   *     would expose a namespace those paths reject (note `isStorageDirForNamespace`
-   *     can still build a tokenized root even for `../evil`, so storageDir sanitation
-   *     alone does not catch it). The default namespace is exempt (it may be a
-   *     non-route literal), matching every other validation site.
-   *
-   *  2. UNSAFE storageDir: for an otherwise-valid namespace, apply the SAME contract
-   *     as the write path — full containment (`isContainedStorageDir`: lexical +
-   *     symlink/realpath) AND namespace ownership (`isStorageDirForNamespace`). When
-   *     a record fails EITHER check we substitute the trusted resolved-and-safe root
-   *     for that namespace (rule 42: read and write stay symmetric).
-   */
-  async sanitizeRecordForRead(record) {
-    if (record.namespace !== this.defaultNamespaceIdentity && !isSafeRouteNamespace(record.namespace)) {
-      return null;
-    }
-    if (await this.isContainedStorageDir(record.storageDir) && await this.isStorageDirForNamespace(record.namespace, record.storageDir)) {
-      return record;
-    }
-    const safe = await this.resolveSafeStorageDir(record.namespace);
-    return { ...record, storageDir: safe };
-  }
-  storageRootOwnershipRank(record, resolvedStorageDir, configured) {
-    if (resolvedStorageDir === path.resolve(this.memoryDir)) {
-      return record.namespace === this.defaultNamespaceIdentity ? 0 : 3;
-    }
-    const leaf = path.basename(resolvedStorageDir);
-    const tokenOwnsRoot = namespaceIdentityToken(record.namespace) === leaf;
-    if (tokenOwnsRoot && configured.has(record.namespace)) {
-      return 0;
-    }
-    if (record.namespace === leaf) return 1;
-    if (tokenOwnsRoot) return 2;
-    return 3;
-  }
-  configuredNamespaceIdentities() {
-    return new Set(
-      [
-        this.config.defaultNamespace,
-        this.config.sharedNamespace,
-        ...this.config.namespacePolicies.map((p) => p.name)
-      ].map((n) => normalizeNamespaceIdentity(n)).filter((n) => n.length > 0)
-    );
-  }
-  preferStorageRootOwner(current, candidate, resolvedStorageDir, configured) {
-    const currentRank = this.storageRootOwnershipRank(current, resolvedStorageDir, configured);
-    const candidateRank = this.storageRootOwnershipRank(candidate, resolvedStorageDir, configured);
-    if (candidateRank < currentRank) return candidate;
-    if (candidateRank > currentRank) return current;
-    const byName = candidate.namespace.localeCompare(current.namespace);
-    if (byName < 0) return candidate;
-    if (byName > 0) return current;
-    return candidate.identityToken.localeCompare(current.identityToken) < 0 ? candidate : current;
-  }
-  dropDuplicateStorageRootAliases(records) {
-    const byStorageDir = /* @__PURE__ */ new Map();
-    const configured = this.configuredNamespaceIdentities();
-    for (const record of records) {
-      const resolvedStorageDir = path.resolve(record.storageDir);
-      const current = byStorageDir.get(resolvedStorageDir);
-      if (!current) {
-        byStorageDir.set(resolvedStorageDir, record);
-        continue;
-      }
-      const owner = this.preferStorageRootOwner(current, record, resolvedStorageDir, configured);
-      const alias = owner === current ? record : current;
-      byStorageDir.set(resolvedStorageDir, mergeNewerTouchFields(owner, alias));
-    }
-    return [...byStorageDir.values()];
+  catalogReadBoundaryPort() {
+    return {
+      defaultNamespaceIdentity: this.defaultNamespaceIdentity,
+      memoryDir: this.memoryDir,
+      isContainedStorageDir: (candidate) => this.isContainedStorageDir(candidate),
+      isStorageDirForNamespace: (namespace, candidate) => this.isStorageDirForNamespace(namespace, candidate),
+      resolveSafeStorageDir: (namespace) => this.resolveSafeStorageDir(namespace)
+    };
   }
-  loadSanitizedRecords() {
+  loadSanitizedRecords(health) {
     return this.queueCritical(async () => {
-      const records = await this.loadCompacted();
+      const records = await this.loadCompacted(false, health);
+      const port = this.catalogReadBoundaryPort();
       const sanitized = await Promise.all(
-        [...records.values()].map((r) => this.sanitizeRecordForRead(r))
+        [...records.values()].map((r) => sanitizeRecordForRead(port, r))
       );
-      return this.dropDuplicateStorageRootAliases(
-        sanitized.filter((r) => r !== null)
+      return dropDuplicateStorageRootAliases(
+        port,
+        sanitized.filter((r) => r !== null),
+        this.config
       );
     });
   }
-  async listNamespaces(filter) {
+  async listNamespaces(filter, options) {
     if (!this.enabled) return [];
-    let out = await this.loadSanitizedRecords();
+    const health = {};
+    let out = await this.loadSanitizedRecords(health);
+    if (health.incomplete !== void 0) {
+      options?.onIncomplete?.(health.incomplete);
+    }
+    if (health.malformed === true) {
+      void this.malformedRepairGate.run(() => this.rewriteAfterIncompleteRead()).catch(() => void 0);
+    }
     if (filter?.kind) out = out.filter((r) => r.kind === filter.kind);
     if (filter?.discoveredBy) out = out.filter((r) => r.discoveredBy === filter.discoveredBy);
     if (filter?.writtenSince) {
@@ -594,10 +660,10 @@ var NamespaceCatalog = class {
     return this.namespaceTokenDir(token);
   }
   namespaceTokenDir(token) {
-    if (token.length === 0 || token.includes("/") || token.includes("\\") || token.includes("..") || path.isAbsolute(token)) {
+    if (token.length === 0 || token.includes("/") || token.includes("\\") || token.includes("..") || path2.isAbsolute(token)) {
       throw new Error(`unsafe namespace token: ${token}`);
     }
-    return path.join(this.memoryDir, "namespaces", token);
+    return path2.join(this.memoryDir, "namespaces", token);
   }
   /**
    * Whether a candidate storage dir is LEXICALLY contained: it is either the
@@ -608,11 +674,11 @@ var NamespaceCatalog = class {
    * pure string check — symlink escape is checked separately via realpath.
    */
   isLexicallyContained(candidate) {
-    const resolved = path.resolve(candidate);
-    if (resolved === path.resolve(this.memoryDir)) return true;
-    const nsBase = path.resolve(path.join(this.memoryDir, "namespaces"));
-    const rel = path.relative(nsBase, resolved);
-    return rel.length > 0 && !rel.startsWith("..") && !path.isAbsolute(rel);
+    const resolved = path2.resolve(candidate);
+    if (resolved === path2.resolve(this.memoryDir)) return true;
+    const nsBase = path2.resolve(path2.join(this.memoryDir, "namespaces"));
+    const rel = path2.relative(nsBase, resolved);
+    return rel.length > 0 && !rel.startsWith("..") && !path2.isAbsolute(rel);
   }
   /**
    * Whether a candidate storage dir satisfies the catalog containment contract,
@@ -626,12 +692,12 @@ var NamespaceCatalog = class {
    */
   async isContainedStorageDir(candidate) {
     if (!this.isLexicallyContained(candidate)) return false;
-    if (path.resolve(candidate) === path.resolve(this.memoryDir)) return true;
+    if (path2.resolve(candidate) === path2.resolve(this.memoryDir)) return true;
     let memoryReal;
     try {
       memoryReal = await realpath(this.memoryDir);
     } catch {
-      memoryReal = path.resolve(this.memoryDir);
+      memoryReal = path2.resolve(this.memoryDir);
     }
     if (await this.hasSymlinkedAncestor(candidate)) return false;
     try {
@@ -657,15 +723,15 @@ var NamespaceCatalog = class {
    * symlink-checked by the caller; this walks only the intermediate ancestors.
    */
   async hasSymlinkedAncestor(candidate) {
-    const stopAt = path.resolve(this.memoryDir);
-    let dir = path.dirname(path.resolve(candidate));
-    const root = path.parse(dir).root;
-    while (dir !== stopAt && dir !== root && dir !== path.dirname(dir)) {
+    const stopAt = path2.resolve(this.memoryDir);
+    let dir = path2.dirname(path2.resolve(candidate));
+    const root = path2.parse(dir).root;
+    while (dir !== stopAt && dir !== root && dir !== path2.dirname(dir)) {
       try {
         if ((await lstat(dir)).isSymbolicLink()) return true;
       } catch {
       }
-      dir = path.dirname(dir);
+      dir = path2.dirname(dir);
     }
     return false;
   }
@@ -684,10 +750,10 @@ var NamespaceCatalog = class {
    * (NF21i) and the disk scan, so every containment consumer agrees.
    */
   async isNearestExistingAncestorContained(candidate, memoryReal) {
-    let dir = path.resolve(candidate);
-    const root = path.parse(dir).root;
+    let dir = path2.resolve(candidate);
+    const root = path2.parse(dir).root;
     for (; ; ) {
-      const parent = path.dirname(dir);
+      const parent = path2.dirname(dir);
       if (parent === dir || dir === root) return false;
       let real;
       try {
@@ -734,24 +800,24 @@ var NamespaceCatalog = class {
    * namespace's root. Compared on resolved (absolute) paths.
    */
   async isStorageDirForNamespace(namespace, candidate) {
-    const resolvedCandidate = path.resolve(candidate);
+    const resolvedCandidate = path2.resolve(candidate);
     const valid = /* @__PURE__ */ new Set();
     try {
-      valid.add(path.resolve(this.namespaceTokenDir(namespaceIdentityToken(namespace))));
+      valid.add(path2.resolve(this.namespaceTokenDir(namespaceIdentityToken(namespace))));
     } catch {
     }
     try {
-      valid.add(path.resolve(this.namespaceTokenDir(namespace)));
+      valid.add(path2.resolve(this.namespaceTokenDir(namespace)));
     } catch {
     }
     try {
-      valid.add(path.resolve(await resolveNamespaceStorageRoot(this.config, namespace)));
+      valid.add(path2.resolve(await resolveNamespaceStorageRoot(this.config, namespace)));
     } catch {
     }
     if (normalizeNamespaceIdentity(namespace) === this.defaultNamespaceIdentity) {
-      valid.add(path.resolve(this.memoryDir));
+      valid.add(path2.resolve(this.memoryDir));
       try {
-        valid.add(path.resolve(await resolveDefaultNamespaceRoot(this.config)));
+        valid.add(path2.resolve(await resolveDefaultNamespaceRoot(this.config)));
       } catch {
       }
     }
@@ -860,7 +926,7 @@ var NamespaceCatalog = class {
     } catch {
       return false;
     }
-    if (normalizeNamespaceIdentity(namespace) !== this.defaultNamespaceIdentity && path.resolve(root) === path.resolve(this.memoryDir)) {
+    if (normalizeNamespaceIdentity(namespace) !== this.defaultNamespaceIdentity && path2.resolve(root) === path2.resolve(this.memoryDir)) {
       return false;
     }
     let stat2;
@@ -927,6 +993,40 @@ var NamespaceCatalog = class {
       })
     );
   }
+  /**
+   * Rewrite the catalog after a read skipped malformed rows (#3297). Same fold-and-rewrite as the
+   * size-triggered compaction — the readable rows survive, the malformed ones do not — so a stuck
+   * bad row stops keeping every completion request owed. Best-effort and fail-open (rule #40): a
+   * failed rewrite leaves the catalog unchanged and the next read reports and retries.
+   *
+   * Locking: the fold runs inside `queueCritical` (in-process serialization, like every other
+   * read), and the rewrite's load→rename window runs under the held catalog file lock, so it can
+   * never interleave with another process's touch append or rebuild. If another process already
+   * holds the lock, the rewrite is dropped (not queued): that process's own rewrite or rebuild is
+   * the likeliest repair, and the next incomplete read retries anyway.
+   *
+   * Data safety: the locked re-read must itself reach the end of the file and still find
+   * malformed rows, and must leave at least one readable row. A failed re-read folds to an empty
+   * map, and a catalog with nothing readable is left for `rebuildFromDisk`: rewriting either
+   * would replace a healthy or recoverable catalog with an empty file.
+   */
+  async rewriteAfterIncompleteRead() {
+    return this.queueCritical(
+      async () => this.withHeldCatalogLock(async (acquired) => {
+        if (!acquired) return "dropped";
+        const health = { malformedLines: [] };
+        const folded = await this.loadCompacted(true, health);
+        if (health.malformed !== true || folded.size === 0) return "failed";
+        const dropped = health.malformedLines ?? [];
+        if (dropped.length > 0) {
+          const sidecar = malformedSidecarPath(this.catalogPath, dropped);
+          await writeFile(sidecar, dropped.join("\n") + "\n", "utf8").catch(() => void 0);
+        }
+        await this.rewriteUnchained([...folded.values()]);
+        return "repaired";
+      })
+    );
+  }
   /**
    * Fold-and-rewrite the JSONL log when it exceeds `compactBytesLimit`
    * (issue #1903). MUST be called only from inside `touch`'s held-lock +
@@ -1037,7 +1137,7 @@ var NamespaceCatalog = class {
         })
       );
     }
-    const namespacesDir = path.join(this.memoryDir, "namespaces");
+    const namespacesDir = path2.join(this.memoryDir, "namespaces");
     let entries = [];
     let namespacesDirSafe = true;
     try {
@@ -1065,7 +1165,7 @@ var NamespaceCatalog = class {
     const scannedFromTokenized = /* @__PURE__ */ new Map();
     for (const entry of entries) {
       const token = entry.name;
-      const fullPath = path.join(namespacesDir, token);
+      const fullPath = path2.join(namespacesDir, token);
       let stat2;
       try {
         stat2 = await lstat(fullPath);
@@ -1089,7 +1189,7 @@ var NamespaceCatalog = class {
         continue;
       }
       const literalRecord = existing.get(token);
-      const literalOwnsRoot = configured.has(token) || literalRecord !== void 0 && path.resolve(literalRecord.storageDir) === path.resolve(fullPath);
+      const literalOwnsRoot = configured.has(token) || literalRecord !== void 0 && path2.resolve(literalRecord.storageDir) === path2.resolve(fullPath);
       const tokenDecoded = literalOwnsRoot ? null : namespaceIdentityFromToken(token);
       const rawDecoded = tokenDecoded && tokenDecoded.length > 0 ? tokenDecoded : token;
       const decoded = normalizeNamespaceIdentity(rawDecoded);
@@ -1176,10 +1276,10 @@ var NamespaceCatalog = class {
           }
           if (await this.liveStorageRootExistsForRebuild(ns, memoryReal)) {
             const safeDir = await this.resolveSafeStorageDir(ns);
-            const resolvedSafe = path.resolve(safeDir);
+            const resolvedSafe = path2.resolve(safeDir);
             let owningNamespace = null;
             for (const [otherNs, otherRec] of rebuilt) {
-              if (otherNs !== ns && path.resolve(otherRec.storageDir) === resolvedSafe) {
+              if (otherNs !== ns && path2.resolve(otherRec.storageDir) === resolvedSafe) {
                 owningNamespace = otherNs;
                 break;
               }
@@ -1291,13 +1391,14 @@ var NamespaceCatalog = class {
   }
   // ── Persistence ──────────────────────────────────────────────────────────
   /** Load the JSONL log and fold it into current state (last-record-wins). */
-  async loadCompacted(forceFresh = false) {
+  async loadCompacted(forceFresh = false, health) {
     const records = /* @__PURE__ */ new Map();
     let handle;
     try {
       handle = await open(this.catalogPath, "r");
-    } catch {
+    } catch (error) {
       this.compactedCache = void 0;
+      if (health && !isNotFoundError(error)) health.incomplete = `catalog unreadable: ${String(error)}`;
       return records;
     }
     let identity;
@@ -1311,10 +1412,15 @@ var NamespaceCatalog = class {
       };
       if (!forceFresh && this.compactedCache && this.compactedCache.identity.size === identity.size && this.compactedCache.identity.mtimeMs === identity.mtimeMs && this.compactedCache.identity.ctimeMs === identity.ctimeMs && this.compactedCache.identity.ino === identity.ino) {
         await handle.close().catch(() => void 0);
+        if (health && this.compactedCache.incomplete) {
+          health.incomplete = this.compactedCache.incomplete;
+          health.malformed = true;
+        }
         return this.cloneCompactedRecords(this.compactedCache.records);
       }
     } catch {
     }
+    let malformed = 0;
     try {
       this.onCatalogReadForTest?.();
       const CHUNK_BYTES = 1 << 16;
@@ -1330,10 +1436,16 @@ var NamespaceCatalog = class {
         try {
           parsed = JSON.parse(trimmed);
         } catch {
+          malformed += 1;
+          health?.malformedLines?.push(trimmed);
           return;
         }
         const record = coerceRecord(parsed);
-        if (!record) return;
+        if (!record) {
+          malformed += 1;
+          health?.malformedLines?.push(trimmed);
+          return;
+        }
         const prior = records.get(record.namespace);
         records.set(record.namespace, prior ? mergeNewerTouchFields(record, prior) : record);
       };
@@ -1354,13 +1466,19 @@ var NamespaceCatalog = class {
       }
       leftover += decoder.end();
       foldLine(leftover);
-    } catch {
+    } catch (error) {
       this.compactedCache = void 0;
+      if (health) health.incomplete = `catalog unreadable: ${String(error)}`;
       return /* @__PURE__ */ new Map();
     } finally {
       await handle.close().catch(() => void 0);
     }
-    this.compactedCache = identity ? { identity, records } : void 0;
+    const incomplete = malformed > 0 ? `${malformed} malformed catalog line(s) skipped` : void 0;
+    if (health && incomplete) {
+      health.incomplete = incomplete;
+      health.malformed = true;
+    }
+    this.compactedCache = identity ? { identity, records, incomplete } : void 0;
     return this.cloneCompactedRecords(records);
   }
   cloneCompactedRecords(records) {
@@ -1417,8 +1535,13 @@ var NamespaceCatalog = class {
     const body = records.map((r) => serializeRecord(r)).join("\n") + (records.length > 0 ? "\n" : "");
     await mkdir(this.stateDir, { recursive: true });
     const tmp = `${this.catalogPath}.${process.pid}.${Date.now()}.tmp`;
-    await writeFile(tmp, body, "utf8");
-    await rename(tmp, this.catalogPath);
+    try {
+      await writeFile(tmp, body, "utf8");
+      await rename(tmp, this.catalogPath);
+    } catch (error) {
+      await rm(tmp, { force: true }).catch(() => void 0);
+      throw error;
+    }
     await this.refreshCacheIdentity(new Map(records.map((record) => [record.namespace, record])));
   }
   async refreshCacheAfterAppend(record, lineByteLength) {
@@ -1464,8 +1587,8 @@ var NamespaceCatalog = class {
   }
 };
 function isPathInside(root, child) {
-  const relative = path.relative(root, child);
-  return relative === "" || !relative.startsWith("..") && !path.isAbsolute(relative);
+  const relative = path2.relative(root, child);
+  return relative === "" || !relative.startsWith("..") && !path2.isAbsolute(relative);
 }
 
 export {
@@ -1473,4 +1596,4 @@ export {
   isNamespaceKind,
   NamespaceCatalog
 };
-//# sourceMappingURL=chunk-XVTB6BZS.js.map
+//# sourceMappingURL=chunk-P5FYZH5G.js.map