blockyard 0.0.9 → 0.1.1

package/server/chain/index/heights.js

@@ -5,15 +5,32 @@
 // blocks at one height -- which the build checks for, since it counts every height exactly once.
 // The LAST 16 hex digits of the displayed hash, not the first: a displayed hash begins with the
 // proof of work, so a recent block's first 16 digits are all zero and every one of them would collide.
+//
+// THE TABLE IS SIZED FROM THE TIP, AND NEVER LOOPS WHEN FULL (audit 2026-09-16, L7). The capacity was
+// fixed at 2^21 and nothing checked the load, so the 2,097,153rd block -- mainnet reaches it around
+// 2046 -- sent `set` round the table forever, on the server's main thread. Now a build sizes it at
+// least twice the heights it will hold (HeightTable.forTip), `set` refuses past a load of 0.75, and
+// both `set` and `get` give up after one lap of the table whatever its state.
+export const MAX_LOAD = 0.75;
+
 export class HeightTable {
   constructor(capacity = 1 << 21) {
+    if (!Number.isSafeInteger(capacity) || capacity < 1 || capacity > 2 ** 30 || (capacity & (capacity - 1)) !== 0) throw new RangeError(`height table capacity must be a power of two, not ${capacity}`);
     this.capacity = capacity;
     this.buffer = new SharedArrayBuffer(capacity * 12);
+    this.count = 0;
     this._bind();
   }
+  /** A table for heights 0..tip: at least twice tip + 1 slots, a power of two, never under 1,024. */
+  static forTip(tip) {
+    if (!Number.isSafeInteger(tip) || tip < 0) throw new RangeError(`a height table needs a tip height, not ${tip}`);
+    let capacity = 1024;
+    while (capacity < 2 * (tip + 1)) capacity *= 2;
+    return new HeightTable(capacity);
+  }
   static attach(buffer, capacity) {
     const t = Object.create(HeightTable.prototype);
-    t.capacity = capacity; t.buffer = buffer; t._bind();
+    t.capacity = capacity; t.buffer = buffer; t.count = null; t._bind();
     return t;
   }
   _bind() {
@@ -24,13 +41,22 @@ export class HeightTable {
   set(hashHex, height) {
     const k = HeightTable.#prefix(hashHex);
     let i = Number(k % BigInt(this.capacity));
-    while (this.keys[i] !== 0n && this.keys[i] !== k) i = (i + 1) % this.capacity;
+    for (let probes = 0; this.keys[i] !== 0n && this.keys[i] !== k; probes++) {
+      if (probes >= this.capacity) throw new RangeError(`the height table is full (${this.capacity} slots)`);
+      i = (i + 1) % this.capacity;
+    }
+    if (this.keys[i] === 0n) {
+      // an attached table counts what it holds the first time it is written to
+      if (this.count == null) { let n = 0; for (let j = 0; j < this.capacity; j++) if (this.keys[j] !== 0n) n++; this.count = n; }
+      if (this.count + 1 > this.capacity * MAX_LOAD) throw new RangeError(`the height table is too small: ${this.count + 1} heights would load its ${this.capacity} slots past ${MAX_LOAD} (size it with HeightTable.forTip)`);
+      this.count++;
+    }
     this.keys[i] = k; this.values[i] = height;
   }
   get(hashHex) {
     const k = HeightTable.#prefix(hashHex);
     let i = Number(k % BigInt(this.capacity));
-    while (this.keys[i] !== 0n) { if (this.keys[i] === k) return this.values[i]; i = (i + 1) % this.capacity; }
+    for (let probes = 0; probes < this.capacity && this.keys[i] !== 0n; probes++) { if (this.keys[i] === k) return this.values[i]; i = (i + 1) % this.capacity; }
     return -1;
   }
 }

package/server/chain/index/live.js

@@ -23,7 +23,7 @@ import path from 'node:path';
 import { crc32 } from 'node:zlib';
 import { IndexStore } from './store.js';
 import { ROW, RowSink, verboseBlockRows } from './rows.js';
-import { BLOCK_ROWS } from './build.js';
+import { BLOCK_ROWS, openTempFile } from './build.js';
 
 export const CONFIRMATIONS = 100;
 export const FOLD_BLOCKS = 144;
@@ -59,10 +59,11 @@ export function sortRows(buf, blockRows = BLOCK_ROWS) {
   return { rows: out.subarray(0, w), idx: Buffer.from(new BigUint64Array(sparse).buffer) };
 }
 
+// The temporary name is unlinked and created afresh with O_EXCL, owner-only: a symlink planted at
+// live.log.tmp or tips.json.tmp is never followed (audit 2026-09-16, L10)
 function writeAtomic(file, data) {
-  const fd = openSync(file + '.tmp', 'w');
-  for (let o = 0; o < data.length;) o += writeSync(fd, data, o, data.length - o);
-  fsyncSync(fd); closeSync(fd);
+  const fd = openTempFile(file + '.tmp');
+  try { for (let o = 0; o < data.length;) o += writeSync(fd, data, o, data.length - o); fsyncSync(fd); } finally { closeSync(fd); }
   renameSync(file + '.tmp', file);
 }
 
@@ -81,7 +82,7 @@ export class LiveIndex {
   constructor(dir, { rpc, nodeId = null, log = null, confirmations = CONFIRMATIONS, foldBlocks = FOLD_BLOCKS, maxLayers = MAX_LAYERS, maxBlocksPerPoll = 50 } = {}) {
     this.dir = dir; this.rpc = rpc; this.nodeId = nodeId; this.log = log;
     this.confirmations = confirmations; this.foldBlocks = foldBlocks; this.maxLayers = maxLayers; this.maxBlocksPerPoll = maxBlocksPerPoll;
-    this.store = new IndexStore(dir);
+    this.store = new IndexStore(dir, { log });
     this.blocks = new Map();             // height -> { hash, rows: Buffer }
     this.byKey = new Map();              // key hex (16) -> [Buffer, offset, Buffer, offset, ...]
     this.stale = null;                   // a reason, once the chain has left us behind
@@ -138,6 +139,11 @@ export class LiveIndex {
       if (pos + 9 + len + 4 > buf.length) break;
       const payload = buf.subarray(pos + 9, pos + 9 + len);
       if (crc32(payload) !== buf.readUInt32LE(pos + 9 + len)) break;
+      // A RECORD WHOSE CHECKSUM HOLDS BUT WHOSE SHAPE DOES NOT is treated like a torn one: the log is cut
+      // there (audit 2026-09-16, I4). A block record shorter than its height and hash, or with rows
+      // that are not whole 21-byte rows, threw from this constructor and the follower never started.
+      if (type === T_BLOCK && (len < 36 || (len - 36) % ROW !== 0)) break;
+      if (type === T_ROLLBACK && len < 4) break;
       if (type === T_BLOCK) {
         const height = payload.readUInt32LE(0), hash = payload.toString('hex', 4, 36);
         if (height === this.tip + 1) this.#add(height, hash, Buffer.from(payload.subarray(36)));
@@ -155,7 +161,7 @@ export class LiveIndex {
   }
 
   #append(rec) {
-    const fd = openSync(this.logFile, 'a');
+    const fd = openSync(this.logFile, 'a', 0o600);                // owner-only (audit 2026-09-16, L10)
     try { writeSync(fd, rec); fsyncSync(fd); } finally { closeSync(fd); }
   }
 
@@ -235,7 +241,7 @@ export class LiveIndex {
     const from = deep[0], to = deep[deep.length - 1];
     const { rows, idx } = sortRows(Buffer.concat(deep.map((h) => this.blocks.get(h).rows)), this.store.blockRows);
     const dir = path.join(this.dir, 'layers');
-    mkdirSync(dir, { recursive: true });
+    mkdirSync(dir, { recursive: true, mode: 0o700 });
     const base = path.join(dir, `L${from}-${to}`);
     // the top block's hash first, so a layer is never on disk without it
     let tips = {};

package/server/chain/index/rows.js

@@ -76,7 +76,7 @@ export function blockRows(body, undoBody, height, out) {
   const moved = new Map();
   for (let p = 0; p < ntx; p++) {
     moved.clear();
-    walkTx(body, st, (value, script) => {
+    const nin = walkTx(body, st, (value, script) => {
       if (script.length > 0 && script[0] === 0x6a) return;       // OP_RETURN: unspendable, not an address
       const k = scriptKey(script);
       moved.set(k, (moved.get(k) ?? 0) + value);
@@ -84,6 +84,11 @@ export function blockRows(body, undoBody, height, out) {
     if (p > 0) {
       const coins = undo[p - 1];
       if (!coins) throw new Error(`block ${height}: no undo for transaction ${p}`);
+      // ONE SPENT COIN PER INPUT, OR THIS IS NOT THE BLOCK'S UNDO (audit 2026-09-16, L8). Blocks and
+      // undo records are paired by hash256(prevhash || undo), which does not commit to the block, so
+      // two sibling blocks in one file can each match the other's record. The coin count was trusted,
+      // and a two-input transaction given a one-coin undo wrote rows with the wrong spent scripts.
+      if (coins.length !== nin) throw new Error(`block ${height}: transaction ${p} has ${nin} inputs and its undo record ${coins.length} spent coins -- a block paired with another block's undo`);
       for (const c of coins) {
         const k = scriptKey(c.script);
         moved.set(k, (moved.get(k) ?? 0) - c.value_sat);

package/server/chain/index/store.js

@@ -14,7 +14,9 @@ import { ROW, scriptKey, readRow } from './rows.js';
 import { FORMAT } from './build.js';
 
 const LAYER = /^L(\d+)-(\d+)\.rows$/;
-const RING_MAX_BLIND = 4096;   // rows (86 KB) a page may keep without first counting the history
+const RING_MAX_BLIND = 4096;
+// the most rows to a sparse-index block a manifest may name: it sizes a read buffer (4,096 is written)
+export const MAX_BLOCK_ROWS = 1 << 16;   // rows (86 KB) a page may keep without first counting the history
 
 // NO FILE IS HELD OPEN (2026-09-14): a store used to keep one descriptor per segment and layer --
 // 256 and more -- for the life of the process, which is the whole soft limit on a stock macOS
@@ -22,16 +24,24 @@ const RING_MAX_BLIND = 4096;   // rows (86 KB) a page may keep without first cou
 // and closes it: three syscalls on a 0.25 ms lookup.
 function openSorted(rowsFile, idxFile) {
   const raw = readFileSync(idxFile);
+  // whole 8-byte keys and whole rows, or the source is not one this code wrote (audit 2026-09-16, I4)
+  if (raw.length % 8 !== 0) throw new Error(`${path.basename(idxFile)} is ${raw.length} bytes, not a whole number of 8-byte keys`);
+  const size = statSync(rowsFile).size;
+  if (size % ROW !== 0) throw new Error(`${path.basename(rowsFile)} is ${size} bytes, not a whole number of ${ROW}-byte rows`);
   const idx = new BigUint64Array(raw.buffer, raw.byteOffset, raw.length / 8).slice();
-  return { idx, file: rowsFile, rows: statSync(rowsFile).size / ROW };
+  return { idx, file: rowsFile, rows: size / ROW };
 }
 
 export class IndexStore {
-  constructor(dir) {
+  constructor(dir, { log = null } = {}) {
     this.dir = dir;
+    this.log = log;
     this.manifest = JSON.parse(readFileSync(path.join(dir, 'manifest.json'), 'utf8'));
     if (this.manifest.format !== FORMAT) throw new Error(`index format ${this.manifest.format}, this code reads ${FORMAT}`);
-    this.blockRows = this.manifest.blockRows;
+    // blockRows sizes the read buffer below: checked before it allocates anything (audit 2026-09-16, I4)
+    const br = this.manifest.blockRows;
+    if (!Number.isSafeInteger(br) || br < 1 || br > MAX_BLOCK_ROWS) throw new Error(`index manifest names ${JSON.stringify(br)} rows to a block; this code reads 1 to ${MAX_BLOCK_ROWS}`);
+    this.blockRows = br;
     this.segments = Array.from({ length: 256 }, (_, b) => {
       const hex = b.toString(16).padStart(2, '0');
       try { return openSorted(path.join(dir, `seg-${hex}.rows`), path.join(dir, `seg-${hex}.idx`)); } catch { return null; }
@@ -53,8 +63,21 @@ export class IndexStore {
     const ranges = names.map((f) => { const [, from, to] = f.match(LAYER); return { f, from: Number(from), to: Number(to) }; });
     const live = ranges.filter((r) => !ranges.some((o) => o !== r && o.from <= r.from && o.to >= r.to && (o.to - o.from) > (r.to - r.from)));
     const idxOf = (f) => path.join(dir, f.replace(/\.rows$/, '.idx'));
+    // A LAYER THAT CANNOT BE READ IS SKIPPED, as a segment is (audit 2026-09-16, I4): an .idx of the
+    // wrong length threw from here, out of a fold, and out of the constructor. It is named in
+    // `badLayers` and said once, and a missing .idx (a fold interrupted between its files) stays quiet.
+    this.badLayers = [];
     this.layers = live.filter((r) => { try { readFileSync(idxOf(r.f), { flag: 'r' }); return true; } catch { return false; } })
-      .map((r) => ({ from: r.from, to: r.to, ...openSorted(path.join(dir, r.f), idxOf(r.f)) }))
+      .flatMap((r) => {
+        try { return [{ from: r.from, to: r.to, ...openSorted(path.join(dir, r.f), idxOf(r.f)) }]; } catch (err) {
+          this.badLayers.push({ layer: r.f, error: err.message });
+          if (!(this.warned ??= new Set()).has(r.f)) {
+            this.warned.add(r.f);
+            this.log?.warn?.(`address index: skipping layer ${r.f}: ${err.message}`);
+          }
+          return [];
+        }
+      })
       .sort((a, b) => a.from - b.from);
   }
 

package/server/chain/index/worker.js

@@ -2,15 +2,19 @@
 //
 //   scan  one blk/rev file pair -> the file's index rows, partitioned by the key's first byte into
 //         256 buffers (a counting sort), so the main thread only appends each to its bucket file
-//   sort  one bucket file -> sorted, de-duplicated rows plus a sparse index, then the unsorted
-//         input is removed
+//   sort  one bucket file -> sorted, de-duplicated rows plus a sparse index, each written to a
+//         temporary name, fsynced and renamed. The input is first checked against the length and
+//         CRC-32 the scan journaled, and it is left in place: the main thread removes it once the
+//         build journal records the bucket sorted (build.js, THE BUILD JOURNAL)
 import { parentPort, workerData } from 'node:worker_threads';
-import { openSync, readSync, writeSync, closeSync, fstatSync, unlinkSync, renameSync } from 'node:fs';
+import { openSync, readSync, writeSync, closeSync, fstatSync, fsyncSync, renameSync } from 'node:fs';
+import { crc32 } from 'node:zlib';
 import path from 'node:path';
 import { Reader, readHeader } from '../tx.js';
 import { readChainFile, records, pairBlocksWithUndo, MAGIC } from '../blockfile.js';
 import { blockRows, RowSink, ROW } from './rows.js';
 import { HeightTable } from './heights.js';
+import { openTempFile } from './build.js';
 
 const { blocksDir, key, heightsBuffer, heightsCapacity, blockRowsPerIndex } = workerData;
 const heights = HeightTable.attach(heightsBuffer, heightsCapacity);
@@ -26,7 +30,7 @@ function scan(file) {
   for (const r of records(blk, MAGIC.main, 0, xor)) {
     const rd = new Reader(r.body);
     const h = readHeader(rd);
-    blocks.push({ body: r.body, hash: h.hash, previousblockhash: h.previousblockhash, ntx: rd.varint() });
+    blocks.push({ offset: r.offset, body: r.body, hash: h.hash, previousblockhash: h.previousblockhash, ntx: rd.varint() });
   }
   const pairs = pairBlocksWithUndo(blocks, [...records(rev, MAGIC.main, 32, xor)]);
   const sink = new RowSink(1 << 18);
@@ -37,7 +41,12 @@ function scan(file) {
     if (height < 0) { stale++; return; }                          // not on the chain this build covers
     const undo = pairs.get(i);
     if (!undo && height !== 0) { missingUndo++; return; }
-    blockRows(b.body, undo ? undo.body : null, height, sink);
+    // A CORRUPT OR MISPAIRED RECORD FAILS THE FILE, AND SO THE BUILD -- fail-safe, and kept that way
+    // (audit 2026-09-16, I4) -- but the message names the files and offsets to look at
+    try { blockRows(b.body, undo ? undo.body : null, height, sink); } catch (err) {
+      err.message = `blk${id}.dat offset ${b.offset}${undo ? `, rev${id}.dat offset ${undo.offset}` : ''} (block ${height} ${b.hash}): ${err.message}`;
+      throw err;
+    }
     indexed.push(height);
   });
   // counting sort by the first key byte: 256 buffers the main thread appends as they are
@@ -57,7 +66,7 @@ function scan(file) {
   };
 }
 
-function sortBucket(bucket, dir) {
+function sortBucket(bucket, dir, expectSize = null, expectCrc = null) {
   const t0 = performance.now();
   const name = (s) => path.join(dir, `bucket-${bucket.toString(16).padStart(2, '0')}${s}`);
   const fd = openSync(name('.unsorted'), 'r');
@@ -65,6 +74,9 @@ function sortBucket(bucket, dir) {
   const buf = Buffer.allocUnsafe(size);
   for (let got = 0; got < size;) { const k = readSync(fd, buf, got, size - got, got); if (!k) break; got += k; }
   closeSync(fd);
+  const hex = bucket.toString(16).padStart(2, '0');
+  if (expectSize != null && size !== expectSize) throw new Error(`bucket ${hex} does not hold what the scan wrote: ${size} bytes, and the scan wrote ${expectSize}`);
+  if (expectCrc != null && crc32(buf) !== expectCrc) throw new Error(`bucket ${hex} does not hold what the scan wrote: its CRC-32 is ${crc32(buf)}, and the scan's was ${expectCrc}`);
   const n = size / ROW;
   // order by the next 16 key bits into sub-buckets, then compare the rest numerically:
   // hi = key bytes 3..7 (40 bits), lo = height (24 bits) and position (16 bits)
@@ -92,16 +104,16 @@ function sortBucket(bucket, dir) {
     w += ROW;
   }
   const idx = Buffer.from(new BigUint64Array(sparse).buffer);
-  const write = (file, data) => { const f = openSync(file + '.tmp', 'w'); for (let o = 0; o < data.length;) o += writeSync(f, data, o, data.length - o); closeSync(f); renameSync(file + '.tmp', file); };
-  write(path.join(dir, `seg-${bucket.toString(16).padStart(2, '0')}.rows`), out.subarray(0, w));
-  write(path.join(dir, `seg-${bucket.toString(16).padStart(2, '0')}.idx`), idx);
-  unlinkSync(name('.unsorted'));
+  // a temporary name is unlinked and created afresh, owner-only: never a planted symlink followed (audit 2026-09-16, L10)
+  const write = (file, data) => { const f = openTempFile(file + '.tmp'); try { for (let o = 0; o < data.length;) o += writeSync(f, data, o, data.length - o); fsyncSync(f); } finally { closeSync(f); } renameSync(file + '.tmp', file); };
+  write(path.join(dir, `seg-${hex}.rows`), out.subarray(0, w));
+  write(path.join(dir, `seg-${hex}.idx`), idx);
   return { msg: { type: 'sorted', bucket, rows: w / ROW, dupes, ms: performance.now() - t0 }, transfer: [] };
 }
 
 parentPort.on('message', (job) => {
   try {
-    const r = job.type === 'scan' ? scan(job.file) : sortBucket(job.bucket, job.dir);
+    const r = job.type === 'scan' ? scan(job.file) : sortBucket(job.bucket, job.dir, job.size, job.crc);
     parentPort.postMessage(r.msg, r.transfer);
   } catch (err) {
     parentPort.postMessage({ type: 'error', job, message: err.stack || err.message });

package/server/collect/logparse.js

@@ -17,12 +17,14 @@
 const TS_RE = /^(\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2})\.(\d{3}) /;
 const TAG_RE = /^\[[a-z0-9_]+(?::\d+)?\]\s*/;
 
-// "1.0KB", "32.0 KB/s", "0.0B", "2.3MB", "128 KB". The node prints decimal
+// "1.0KB", "32.0 KB/s", "0.0B", "2.3MB", "128 KB". (2026-09-16, audit L6: the number is
+// `\d*\.\d+|\d+`, the same numbers as the old `[0-9]*\.?[0-9]+` without the two digit
+// runs that could split a long string of digits every possible way.) The node prints decimal
 // units (4096 bytes renders as "4.0KB"), so decode the same way back.
 const SIZE_UNITS = { B: 1, KB: 1e3, MB: 1e6, GB: 1e9, TB: 1e12, PB: 1e15 };
 export function parseSize(text) {
   if (text == null) return null;
-  const m = String(text).trim().match(/^([0-9]*\.?[0-9]+)\s*(B|KB|MB|GB|TB|PB)(?:\/s)?$/i);
+  const m = String(text).trim().match(/^(\d*\.\d+|\d+)\s*(B|KB|MB|GB|TB|PB)(?:\/s)?$/i);
   if (!m) return null;
   const unit = m[2].toUpperCase();
   return Math.round(parseFloat(m[1]) * SIZE_UNITS[unit]);
@@ -30,7 +32,7 @@ export function parseSize(text) {
 
 export function parseRate(text) {
   if (text == null) return null;
-  const m = String(text).trim().match(/^([0-9]*\.?[0-9]+)\s*(B|KB|MB|GB|TB)\/s$/i);
+  const m = String(text).trim().match(/^(\d*\.\d+|\d+)\s*(B|KB|MB|GB|TB)\/s$/i);
   if (!m) return null;
   return parseFloat(m[1]) * SIZE_UNITS[m[2].toUpperCase()];
 }
@@ -64,6 +66,11 @@ function addrParts(s) {
   return { host: s, port: null, addr: s };
 }
 
+// 2026-09-16 (audit L6): a `\s*` in front of a capture such as `([^,]+)` that can itself
+// start with a space lets the engine split one run of spaces between the two in every
+// possible way -- quadratic on a long run, and each rule pays it on every line. Those
+// captures now start with a character `\s` cannot match (`[^\s,][^,]*`), which matches
+// the same real lines and leaves only one way to read the spaces.
 const RULES = [
   // [dlc] -- network recv this tick: 4.0KB (405.0B/s) | total recv: 2.3MB || disk write this tick: 0.0B (0.0B/s) | total written: 1.9MB --
   {
@@ -90,7 +97,7 @@ const RULES = [
   // [dlc] -- dead-weight floor this tick: 32.0 KB/s (pool median 0.0 KB/s, absolute 32.0 KB/s) --
   {
     name: 'deadweight',
-    re: /\[dlc\]\s*--\s*dead-weight floor this tick:\s*([^\s]+(?:\s?[KMG]?B\/s)?)\s*\(pool median\s*([^,]+),\s*absolute\s*([^)]+)\)/,
+    re: /\[dlc\]\s*--\s*dead-weight floor this tick:\s*([^\s]+(?:\s?[KMG]?B\/s)?)\s*\(pool median\s*([^\s,][^,]*),\s*absolute\s*([^\s)][^)]*)\)/,
     apply(m) {
       return { kind: 'deadweight', floor: parseRate(m[1].trim()), poolMedian: parseRate(m[2].trim()), absolute: parseRate(m[3].trim()) };
     },
@@ -100,7 +107,7 @@ const RULES = [
   // [dlc] ranked 116 live peer(s) by a 2000-header sample in 44.6s: 39 answered, best 94 KB/s, median 63 KB/s, slowest answering 48 KB/s; the 77 silent rank last
   {
     name: 'ranking',
-    re: /\[dlc\]\s*ranked\s*(\d+)\s*live peer\(s\)[^.]*in\s*([\d.]+)s:\s*(\d+)\s*answered,\s*best\s*([^,]+),\s*median\s*([^,]+),\s*slowest answering\s*([^;]+);\s*the\s*(\d+)\s*silent/,
+    re: /\[dlc\]\s*ranked\s*(\d+)\s*live peer\(s\)[^.]*in\s*([\d.]+)s:\s*(\d+)\s*answered,\s*best\s*([^\s,][^,]*),\s*median\s*([^\s,][^,]*),\s*slowest answering\s*([^\s;][^;]*);\s*the\s*(\d+)\s*silent/,
     apply(m) {
       return {
         kind: 'peer_ranking', live: +m[1], sampleSecs: +m[2], answered: +m[3],
@@ -131,7 +138,7 @@ const RULES = [
   // [block] stored height=965923 hash=0000000000000000.. bytes=1464177 tx=6866 (via 193.223.81.8:8333)
   {
     name: 'blockStored',
-    re: /\[block\]\s*stored\s+height=(\d+)\s+hash=([0-9a-f.]+)\s+bytes=(\d+)\s+tx=(\d+)(?:\s*\(via\s*([^\)]+)\))?/,
+    re: /\[block\]\s*stored\s+height=(\d+)\s+hash=([0-9a-f.]+)\s+bytes=(\d+)\s+tx=(\d+)(?:\s*\(via\s*([^\s)][^)]*)\))?/,
     apply(m) {
       const via = addrParts(m[5]);
       return { kind: 'block_stored', height: +m[1], hashPrefix: m[2].replace(/\.$/, ''), bytes: +m[3], txs: +m[4], via: via?.addr ?? null, viaHost: via?.host ?? null };
@@ -198,7 +205,10 @@ const RULES = [
   // [mux:7] leg replaced: connected next pool peer 208.161.116.211:8333 (fd 266) addrv2=1
   { name: 'legReplaced', re: /\[mux:(\d+)\]\s*leg replaced:\s*connected next pool peer\s*(\S+)\s*\(fd\s*(\d+)\)\s*addrv2=(\d)/, apply: (m) => ({ kind: 'peer_connect', leg: +m[1], addr: m[2], host: addrParts(m[2])?.host, fd: +m[3], addrv2: m[4] === '1', reason: 'leg replaced' }) },
   // [mux:9] next peer 86.147.78.44:8333 unreachable: connect: Operation now in progress (leg stays down)
-  { name: 'legDown', re: /\[mux:(\d+)\]\s*next peer\s*(\S+)\s+unreachable:\s*(.+?)\s*\(leg stays down\)/, apply: (m) => ({ kind: 'peer_unreachable', leg: +m[1], addr: m[2], host: addrParts(m[2])?.host, reason: m[3].trim() }) },
+  // 2026-09-16 (audit L6): was `unreachable:\s*(.+?)\s*\(leg stays down\)`, which is cubic
+  // on a long run of spaces -- 20,000 of them did not finish in 300 s. The lazy capture
+  // now meets a literal straight away, and the apply trims what the two `\s*` used to.
+  { name: 'legDown', re: /\[mux:(\d+)\]\s*next peer\s*(\S+)\s+unreachable:(.+?)\(leg stays down\)/, apply: (m) => ({ kind: 'peer_unreachable', leg: +m[1], addr: m[2], host: addrParts(m[2])?.host, reason: m[3].trim() }) },
   // [dl:7] 209.38.162.73:8333 connection dropped (revents 0x11); re-dialing
   { name: 'legDropped', re: /\[dl:(\d+)\]\s*(\S+?)\s+connection dropped\s*\(revents\s*(\S+?)\)(?:;\s*(\S+))?/, apply: (m) => ({ kind: 'peer_drop', leg: +m[1], addr: m[2], host: addrParts(m[2])?.host, revents: m[3], follow: m[4] || null }) },
   // [net] feeler 47.232.103.88:8333 -> dead
@@ -217,7 +227,7 @@ const RULES = [
     },
   },
   // [mempool] recent-rejects filter: 128 KB shared (...)
-  { name: 'rejectFilter', re: /\[mempool\]\s*recent-rejects filter:\s*([^\s]+)\s*(?:KB|MB|B)?\s+shared/, apply: (m) => ({ kind: 'reject_filter', size: parseSize(m[1] + (/\s?(KB|MB|B)$/i.test(m[1]) ? '' : 'KB')) }) },
+  { name: 'rejectFilter', re: /\[mempool\]\s*recent-rejects filter:\s*([^\s]+)(?:\s*(?:KB|MB|B))?\s+shared/, apply: (m) => ({ kind: 'reject_filter', size: parseSize(m[1] + (/\s?(KB|MB|B)$/i.test(m[1]) ? '' : 'KB')) }) },
 
   // ---- the 2026-09-08 bench build (v0.0.1, built 03:02) rewrote these lines ----
   // Measured the same day against that node's own log: of 1,702 lines the rules
@@ -237,16 +247,21 @@ const RULES = [
   // unit to fill a gap.
   {
     name: 'bandwidthTick',
-    re: /\[dlc\]\s*--\s*recv\s*([^\s(]+)\s*\(avg\s*([^)]+)\)\s*\|\s*write\s*([^\s(]+)\s*\(avg\s*([^)]+)\)\s*\|\s*floor\s*([^()]+?)\s*\(median\s*([^)]+)\)\s*\|\s*banned\s*(\d+)\/(\d+)(?:\s*\|\s*(events.*?))?\s*--/,
+    // 2026-09-16 (audit L6): every `\s*` in front of a capture that could also match
+    // spaces now hands over to a first character that cannot (`[^\s)]`), and no lazy
+    // capture is followed by `\s*` -- the captures keep their trailing spaces and the
+    // apply trims them. The old form retried the same run of spaces from both sides and
+    // went quadratic on a long one.
+    re: /\[dlc\]\s*--\s*recv\s*([^\s(]+)\s*\(avg\s*([^\s)][^)]*)\)\s*\|\s*write\s*([^\s(]+)\s*\(avg\s*([^\s)][^)]*)\)\s*\|\s*floor\s*([^\s()][^()]*?)\(median\s*([^\s)][^)]*)\)\s*\|\s*banned\s*(\d+)\/(\d+)(?:\s*\|\s*(events.*?)|\s*)--/,
     apply(m) {
       const counters = {};
       for (const [, k, v] of (m[9] || '').matchAll(/\b(events|rot|wait|help|fail)\s+(\d+)/g)) counters[k] = +v;
       return {
         kind: 'bandwidth',
         netRate: parseRate(m[1]),
-        avgNetRate: parseRate(m[2]),
+        avgNetRate: parseRate(m[2].trim()),
         diskRate: parseRate(m[3]),
-        avgDiskRate: parseRate(m[4]),
+        avgDiskRate: parseRate(m[4].trim()),
         floor: parseRate((m[5] || '').trim()),
         poolMedianText: (m[6] || '').trim() || null,
         banned: +m[7],
@@ -274,7 +289,10 @@ const RULES = [
   // floor this tick:`, `average since start:`) stay with their own rules.
   {
     name: 'bandwidthTickFields',
-    re: /\[dlc\]\s*--\s*(.+?)\s*--/,
+    // 2026-09-16 (audit L6): `\s*(.+?)\s*--` retried every space run from both sides
+    // (quadratic). The capture now starts on a non-space and runs to the first `--`; its
+    // trailing spaces are trimmed with each segment below, so the fields are the same.
+    re: /\[dlc\]\s*--\s*(\S.*?)--/,
     apply(m) {
       const out = { kind: 'bandwidth', extraFields: [], extraValues: null };
       let claims = 0;
@@ -331,7 +349,8 @@ const RULES = [
   // the stored/applied figures survive whatever the node does to the prose.
   {
     name: 'dlcProgressFields',
-    re: /\[dlc\]\s*==\s*(.+?)\s*==/,
+    // 2026-09-16 (audit L6): same rewrite as bandwidthTickFields, same reason.
+    re: /\[dlc\]\s*==\s*(\S.*?)==/,
     apply(m) {
       const out = { kind: 'dlc_progress', extraFields: [] };
       let claims = 0;
@@ -429,7 +448,7 @@ const RULES = [
   // re-windowed, and that is decoded as negative rather than dropped.
   {
     name: 'dlcWorkerPeer',
-    re: /\[dlc\]\s*w(\d+)\s+(\S+?)\s+chunks=(\d+)\s+blocks=(\d+)\s*\(\+(-?\d+) blk\/s,\s*([^)]+)\)(?:\s*[\[(]([^\])]*?)[\])])?/,
+    re: /\[dlc\]\s*w(\d+)\s+(\S+?)\s+chunks=(\d+)\s+blocks=(\d+)\s*\(\+(-?\d+) blk\/s,\s*([^\s)][^)]*)\)(?:\s*[\[(]([^\])]*?)[\])])?/,
     apply(m) {
       const a = addrParts(m[2]);
       const note = (m[7] || '').trim() || null;
@@ -475,7 +494,11 @@ const RULES = [
   // Again: stored beside the others, not averaged with them.
   {
     name: 'catchupProgress',
-    re: /\[utxo_live\]\s*catchup progress:\s*height=(\d+)\/(\d+)\s*\((\d+\.?\d*)%\)\s*([\d.]+)\s*blk\/s\s*\(avg\s*([\d.]+)\)\s*eta\s*(\S+)\s*\|\s*(.*?)\s*\(([\d.]+)\s*ms\/blk over (\d+)\)/,
+    // 2026-09-16 (audit L6): the phase text was `\|\s*(.*?)\s*\(`, quadratic on spaces;
+    // it is now everything between the bar and the parenthesis. Only the `name N%` pairs
+    // are read out of it, so the spaces it now keeps change nothing. The eta stops at a
+    // bar, so a run of bars is not re-scanned once for every bar in it.
+    re: /\[utxo_live\]\s*catchup progress:\s*height=(\d+)\/(\d+)\s*\((\d+\.?\d*)%\)\s*([\d.]+)\s*blk\/s\s*\(avg\s*([\d.]+)\)\s*eta\s*([^\s|]+)\s*\|(.*?)\(([\d.]+)\s*ms\/blk over (\d+)\)/,
     apply(m) {
       // Groups: 1 height 2 of 3 pct 4 blk/s 5 avg 6 eta 7 phase text 8 ms/blk 9 samples.
       // An earlier cut of this apply() read 8/9/10 and returned msPerBlk 155 for a
@@ -496,7 +519,7 @@ const RULES = [
   //   12 input run(s) unlinked; apply never waited
   {
     name: 'utxoCompaction',
-    re: /\[utxo_live\]\s*compaction done in\s*([\d.]+)s\s*\((\d+) run\(s\)\s*\[[^\]]*\)\s*of\s*(\d+)[^;]*;\s*started at height\s*(\d+)\)?:\s*manifest_n\s*(\d+)\s*->\s*(\d+),\s*merged into run\s*(\d+),\s*(\d+) flushed meanwhile,\s*(\d+) input run\(s\) unlinked;\s*apply\s*(never waited|waited[^;,]*)/,
+    re: /\[utxo_live\]\s*compaction done in\s*([\d.]+)s\s*\((\d+) run\(s\)\s*\[[^\]]*\)\s*of\s*(\d+)(?:[^;\d][^;]*)?;\s*started at height\s*(\d+)\)?:\s*manifest_n\s*(\d+)\s*->\s*(\d+),\s*merged into run\s*(\d+),\s*(\d+) flushed meanwhile,\s*(\d+) input run\(s\) unlinked;\s*apply\s*(never waited|waited[^;,]*)/,
     apply(m) {
       const waited = m[10] !== 'never waited';
       return {
@@ -575,7 +598,7 @@ const RULES = [
   // median 59 s, p95 393 s apart on production.
   {
     name: 'dialTopUpFails',
-    re: /\[dl\]\s*outbound top-up:\s*(\d+)\s*dial\(s\) failed(?:,\s*first\s+(\S+):\s*(.+?))?\s*$/,
+    re: /\[dl\]\s*outbound top-up:\s*(\d+)\s*dial\(s\) failed(?:,\s*first\s+(\S+):(.+))?\s*$/,
     apply(m) {
       const a = m[2] ? addrParts(m[2]) : null;
       return {
@@ -625,7 +648,9 @@ const RULES = [
   // event list, which is what it is for.
   {
     name: 'dialBackgroundFail',
-    re: /\[dial\]\s*(\S+?):\s*background dial failed:\s*(.+?)\s*$/,
+    // 2026-09-16 (audit L6): `:\s*(.+?)\s*$` became `:(.+)$` (here and in dialTopUpFails):
+    // the same text once trimmed, and one pass to the end instead of one per space.
+    re: /\[dial\]\s*(\S+?):\s*background dial failed:(.+)$/,
     apply(m) {
       const a = addrParts(m[1]);
       return { kind: 'peer_reject', direction: 'outbound', addr: a?.addr ?? m[1], host: a?.host ?? m[1], reason: m[2].trim(), severity: 'warn' };
@@ -708,9 +733,19 @@ function localFromLogTs(dateTime, ms) {
   return new Date(+y, +mo - 1, +d, +h, +mi, +s, +ms).getTime();
 }
 
+// LONG LINES (2026-09-16, audit L6). Every rule runs unanchored on the server's main
+// thread, so a line's length is a cost every rule pays. No line this node prints comes
+// near 8 KB (the longest in the fixtures is a few hundred bytes); anything past that is
+// cut before matching, and the event says so (`truncated`: the characters dropped).
+// Together with the rewritten patterns above, a 20,000-space line parses in
+// a few milliseconds where `legDown` alone used to not finish in 300 s.
+export const MAX_LINE = 8192;
+
 // One line in, one event out (or null for a continuation/blank line).
 export function parseLine(line) {
   if (!line) return null;
+  let cut = 0;
+  if (line.length > MAX_LINE) { cut = line.length - MAX_LINE; line = line.slice(0, MAX_LINE); }
   const trimmed = line.replace(/\r$/, '');
   if (!trimmed.trim()) return null;
 
@@ -738,6 +773,7 @@ export function parseLine(line) {
         out.text = rest.trim();
         out.rule = rule.name;
         out.severity = out.severity ?? classify(tagBase, rest);
+        if (cut) out.truncated = cut;
         return out;
       }
     }
@@ -751,14 +787,25 @@ export function parseLine(line) {
     text: rest.trim(),
     severity: classify(tagBase, rest),
     rule: null,
+    ...(cut ? { truncated: cut } : {}),
   };
 }
 
 // Lines arrive in chunks; keep the trailing partial line for the next round.
+//
+// 2026-09-16 (audit L6): the partial line used to grow without limit, so a log that
+// never printed a newline was held whole in memory and handed to every rule at once.
+// `carry` now keeps at most MAX_LINE characters -- the front of the line, where the
+// timestamp and tag are -- and parseLine would cut it there anyway. What is dropped is
+// counted in `state.carryDropped`, so a mangled log shows up as a number, not silence.
 export function splitLines(buf, state = { carry: '' }) {
   const text = state.carry + buf;
   const parts = text.split('\n');
   state.carry = parts.pop() ?? '';
+  if (state.carry.length > MAX_LINE) {
+    state.carryDropped = (state.carryDropped ?? 0) + state.carry.length - MAX_LINE;
+    state.carry = state.carry.slice(0, MAX_LINE);
+  }
   const out = [];
   for (const p of parts) { const e = parseLine(p); if (e) out.push(e); }
   return out;