blockyard 0.1.0 → 0.1.1

package/server/chain/index/live.js

@@ -23,7 +23,7 @@ import path from 'node:path';
 import { crc32 } from 'node:zlib';
 import { IndexStore } from './store.js';
 import { ROW, RowSink, verboseBlockRows } from './rows.js';
-import { BLOCK_ROWS } from './build.js';
+import { BLOCK_ROWS, openTempFile } from './build.js';
 
 export const CONFIRMATIONS = 100;
 export const FOLD_BLOCKS = 144;
@@ -59,10 +59,11 @@ export function sortRows(buf, blockRows = BLOCK_ROWS) {
   return { rows: out.subarray(0, w), idx: Buffer.from(new BigUint64Array(sparse).buffer) };
 }
 
+// The temporary name is unlinked and created afresh with O_EXCL, owner-only: a symlink planted at
+// live.log.tmp or tips.json.tmp is never followed (audit 2026-09-16, L10)
 function writeAtomic(file, data) {
-  const fd = openSync(file + '.tmp', 'w');
-  for (let o = 0; o < data.length;) o += writeSync(fd, data, o, data.length - o);
-  fsyncSync(fd); closeSync(fd);
+  const fd = openTempFile(file + '.tmp');
+  try { for (let o = 0; o < data.length;) o += writeSync(fd, data, o, data.length - o); fsyncSync(fd); } finally { closeSync(fd); }
   renameSync(file + '.tmp', file);
 }
 
@@ -81,7 +82,7 @@ export class LiveIndex {
   constructor(dir, { rpc, nodeId = null, log = null, confirmations = CONFIRMATIONS, foldBlocks = FOLD_BLOCKS, maxLayers = MAX_LAYERS, maxBlocksPerPoll = 50 } = {}) {
     this.dir = dir; this.rpc = rpc; this.nodeId = nodeId; this.log = log;
     this.confirmations = confirmations; this.foldBlocks = foldBlocks; this.maxLayers = maxLayers; this.maxBlocksPerPoll = maxBlocksPerPoll;
-    this.store = new IndexStore(dir);
+    this.store = new IndexStore(dir, { log });
     this.blocks = new Map();             // height -> { hash, rows: Buffer }
     this.byKey = new Map();              // key hex (16) -> [Buffer, offset, Buffer, offset, ...]
     this.stale = null;                   // a reason, once the chain has left us behind
@@ -138,6 +139,11 @@ export class LiveIndex {
       if (pos + 9 + len + 4 > buf.length) break;
       const payload = buf.subarray(pos + 9, pos + 9 + len);
       if (crc32(payload) !== buf.readUInt32LE(pos + 9 + len)) break;
+      // A RECORD WHOSE CHECKSUM HOLDS BUT WHOSE SHAPE DOES NOT is treated like a torn one: the log is cut
+      // there (audit 2026-09-16, I4). A block record shorter than its height and hash, or with rows
+      // that are not whole 21-byte rows, threw from this constructor and the follower never started.
+      if (type === T_BLOCK && (len < 36 || (len - 36) % ROW !== 0)) break;
+      if (type === T_ROLLBACK && len < 4) break;
       if (type === T_BLOCK) {
         const height = payload.readUInt32LE(0), hash = payload.toString('hex', 4, 36);
         if (height === this.tip + 1) this.#add(height, hash, Buffer.from(payload.subarray(36)));
@@ -155,7 +161,7 @@ export class LiveIndex {
   }
 
   #append(rec) {
-    const fd = openSync(this.logFile, 'a');
+    const fd = openSync(this.logFile, 'a', 0o600);                // owner-only (audit 2026-09-16, L10)
     try { writeSync(fd, rec); fsyncSync(fd); } finally { closeSync(fd); }
   }
 
@@ -235,7 +241,7 @@ export class LiveIndex {
     const from = deep[0], to = deep[deep.length - 1];
     const { rows, idx } = sortRows(Buffer.concat(deep.map((h) => this.blocks.get(h).rows)), this.store.blockRows);
     const dir = path.join(this.dir, 'layers');
-    mkdirSync(dir, { recursive: true });
+    mkdirSync(dir, { recursive: true, mode: 0o700 });
     const base = path.join(dir, `L${from}-${to}`);
     // the top block's hash first, so a layer is never on disk without it
     let tips = {};

package/server/chain/index/rows.js

@@ -76,7 +76,7 @@ export function blockRows(body, undoBody, height, out) {
   const moved = new Map();
   for (let p = 0; p < ntx; p++) {
     moved.clear();
-    walkTx(body, st, (value, script) => {
+    const nin = walkTx(body, st, (value, script) => {
       if (script.length > 0 && script[0] === 0x6a) return;       // OP_RETURN: unspendable, not an address
       const k = scriptKey(script);
       moved.set(k, (moved.get(k) ?? 0) + value);
@@ -84,6 +84,11 @@ export function blockRows(body, undoBody, height, out) {
     if (p > 0) {
       const coins = undo[p - 1];
       if (!coins) throw new Error(`block ${height}: no undo for transaction ${p}`);
+      // ONE SPENT COIN PER INPUT, OR THIS IS NOT THE BLOCK'S UNDO (audit 2026-09-16, L8). Blocks and
+      // undo records are paired by hash256(prevhash || undo), which does not commit to the block, so
+      // two sibling blocks in one file can each match the other's record. The coin count was trusted,
+      // and a two-input transaction given a one-coin undo wrote rows with the wrong spent scripts.
+      if (coins.length !== nin) throw new Error(`block ${height}: transaction ${p} has ${nin} inputs and its undo record ${coins.length} spent coins -- a block paired with another block's undo`);
       for (const c of coins) {
         const k = scriptKey(c.script);
         moved.set(k, (moved.get(k) ?? 0) - c.value_sat);

package/server/chain/index/store.js

@@ -14,7 +14,9 @@ import { ROW, scriptKey, readRow } from './rows.js';
 import { FORMAT } from './build.js';
 
 const LAYER = /^L(\d+)-(\d+)\.rows$/;
-const RING_MAX_BLIND = 4096;   // rows (86 KB) a page may keep without first counting the history
+const RING_MAX_BLIND = 4096;
+// the most rows to a sparse-index block a manifest may name: it sizes a read buffer (4,096 is written)
+export const MAX_BLOCK_ROWS = 1 << 16;   // rows (86 KB) a page may keep without first counting the history
 
 // NO FILE IS HELD OPEN (2026-09-14): a store used to keep one descriptor per segment and layer --
 // 256 and more -- for the life of the process, which is the whole soft limit on a stock macOS
@@ -22,16 +24,24 @@ const RING_MAX_BLIND = 4096;   // rows (86 KB) a page may keep without first cou
 // and closes it: three syscalls on a 0.25 ms lookup.
 function openSorted(rowsFile, idxFile) {
   const raw = readFileSync(idxFile);
+  // whole 8-byte keys and whole rows, or the source is not one this code wrote (audit 2026-09-16, I4)
+  if (raw.length % 8 !== 0) throw new Error(`${path.basename(idxFile)} is ${raw.length} bytes, not a whole number of 8-byte keys`);
+  const size = statSync(rowsFile).size;
+  if (size % ROW !== 0) throw new Error(`${path.basename(rowsFile)} is ${size} bytes, not a whole number of ${ROW}-byte rows`);
   const idx = new BigUint64Array(raw.buffer, raw.byteOffset, raw.length / 8).slice();
-  return { idx, file: rowsFile, rows: statSync(rowsFile).size / ROW };
+  return { idx, file: rowsFile, rows: size / ROW };
 }
 
 export class IndexStore {
-  constructor(dir) {
+  constructor(dir, { log = null } = {}) {
     this.dir = dir;
+    this.log = log;
     this.manifest = JSON.parse(readFileSync(path.join(dir, 'manifest.json'), 'utf8'));
     if (this.manifest.format !== FORMAT) throw new Error(`index format ${this.manifest.format}, this code reads ${FORMAT}`);
-    this.blockRows = this.manifest.blockRows;
+    // blockRows sizes the read buffer below: checked before it allocates anything (audit 2026-09-16, I4)
+    const br = this.manifest.blockRows;
+    if (!Number.isSafeInteger(br) || br < 1 || br > MAX_BLOCK_ROWS) throw new Error(`index manifest names ${JSON.stringify(br)} rows to a block; this code reads 1 to ${MAX_BLOCK_ROWS}`);
+    this.blockRows = br;
     this.segments = Array.from({ length: 256 }, (_, b) => {
       const hex = b.toString(16).padStart(2, '0');
       try { return openSorted(path.join(dir, `seg-${hex}.rows`), path.join(dir, `seg-${hex}.idx`)); } catch { return null; }
@@ -53,8 +63,21 @@ export class IndexStore {
     const ranges = names.map((f) => { const [, from, to] = f.match(LAYER); return { f, from: Number(from), to: Number(to) }; });
     const live = ranges.filter((r) => !ranges.some((o) => o !== r && o.from <= r.from && o.to >= r.to && (o.to - o.from) > (r.to - r.from)));
     const idxOf = (f) => path.join(dir, f.replace(/\.rows$/, '.idx'));
+    // A LAYER THAT CANNOT BE READ IS SKIPPED, as a segment is (audit 2026-09-16, I4): an .idx of the
+    // wrong length threw from here, out of a fold, and out of the constructor. It is named in
+    // `badLayers` and said once, and a missing .idx (a fold interrupted between its files) stays quiet.
+    this.badLayers = [];
     this.layers = live.filter((r) => { try { readFileSync(idxOf(r.f), { flag: 'r' }); return true; } catch { return false; } })
-      .map((r) => ({ from: r.from, to: r.to, ...openSorted(path.join(dir, r.f), idxOf(r.f)) }))
+      .flatMap((r) => {
+        try { return [{ from: r.from, to: r.to, ...openSorted(path.join(dir, r.f), idxOf(r.f)) }]; } catch (err) {
+          this.badLayers.push({ layer: r.f, error: err.message });
+          if (!(this.warned ??= new Set()).has(r.f)) {
+            this.warned.add(r.f);
+            this.log?.warn?.(`address index: skipping layer ${r.f}: ${err.message}`);
+          }
+          return [];
+        }
+      })
       .sort((a, b) => a.from - b.from);
   }
 

package/server/chain/index/worker.js

@@ -2,15 +2,19 @@
 //
 //   scan  one blk/rev file pair -> the file's index rows, partitioned by the key's first byte into
 //         256 buffers (a counting sort), so the main thread only appends each to its bucket file
-//   sort  one bucket file -> sorted, de-duplicated rows plus a sparse index, then the unsorted
-//         input is removed
+//   sort  one bucket file -> sorted, de-duplicated rows plus a sparse index, each written to a
+//         temporary name, fsynced and renamed. The input is first checked against the length and
+//         CRC-32 the scan journaled, and it is left in place: the main thread removes it once the
+//         build journal records the bucket sorted (build.js, THE BUILD JOURNAL)
 import { parentPort, workerData } from 'node:worker_threads';
-import { openSync, readSync, writeSync, closeSync, fstatSync, unlinkSync, renameSync } from 'node:fs';
+import { openSync, readSync, writeSync, closeSync, fstatSync, fsyncSync, renameSync } from 'node:fs';
+import { crc32 } from 'node:zlib';
 import path from 'node:path';
 import { Reader, readHeader } from '../tx.js';
 import { readChainFile, records, pairBlocksWithUndo, MAGIC } from '../blockfile.js';
 import { blockRows, RowSink, ROW } from './rows.js';
 import { HeightTable } from './heights.js';
+import { openTempFile } from './build.js';
 
 const { blocksDir, key, heightsBuffer, heightsCapacity, blockRowsPerIndex } = workerData;
 const heights = HeightTable.attach(heightsBuffer, heightsCapacity);
@@ -26,7 +30,7 @@ function scan(file) {
   for (const r of records(blk, MAGIC.main, 0, xor)) {
     const rd = new Reader(r.body);
     const h = readHeader(rd);
-    blocks.push({ body: r.body, hash: h.hash, previousblockhash: h.previousblockhash, ntx: rd.varint() });
+    blocks.push({ offset: r.offset, body: r.body, hash: h.hash, previousblockhash: h.previousblockhash, ntx: rd.varint() });
   }
   const pairs = pairBlocksWithUndo(blocks, [...records(rev, MAGIC.main, 32, xor)]);
   const sink = new RowSink(1 << 18);
@@ -37,7 +41,12 @@ function scan(file) {
     if (height < 0) { stale++; return; }                          // not on the chain this build covers
     const undo = pairs.get(i);
     if (!undo && height !== 0) { missingUndo++; return; }
-    blockRows(b.body, undo ? undo.body : null, height, sink);
+    // A CORRUPT OR MISPAIRED RECORD FAILS THE FILE, AND SO THE BUILD -- fail-safe, and kept that way
+    // (audit 2026-09-16, I4) -- but the message names the files and offsets to look at
+    try { blockRows(b.body, undo ? undo.body : null, height, sink); } catch (err) {
+      err.message = `blk${id}.dat offset ${b.offset}${undo ? `, rev${id}.dat offset ${undo.offset}` : ''} (block ${height} ${b.hash}): ${err.message}`;
+      throw err;
+    }
     indexed.push(height);
   });
   // counting sort by the first key byte: 256 buffers the main thread appends as they are
@@ -57,7 +66,7 @@ function scan(file) {
   };
 }
 
-function sortBucket(bucket, dir) {
+function sortBucket(bucket, dir, expectSize = null, expectCrc = null) {
   const t0 = performance.now();
   const name = (s) => path.join(dir, `bucket-${bucket.toString(16).padStart(2, '0')}${s}`);
   const fd = openSync(name('.unsorted'), 'r');
@@ -65,6 +74,9 @@ function sortBucket(bucket, dir) {
   const buf = Buffer.allocUnsafe(size);
   for (let got = 0; got < size;) { const k = readSync(fd, buf, got, size - got, got); if (!k) break; got += k; }
   closeSync(fd);
+  const hex = bucket.toString(16).padStart(2, '0');
+  if (expectSize != null && size !== expectSize) throw new Error(`bucket ${hex} does not hold what the scan wrote: ${size} bytes, and the scan wrote ${expectSize}`);
+  if (expectCrc != null && crc32(buf) !== expectCrc) throw new Error(`bucket ${hex} does not hold what the scan wrote: its CRC-32 is ${crc32(buf)}, and the scan's was ${expectCrc}`);
   const n = size / ROW;
   // order by the next 16 key bits into sub-buckets, then compare the rest numerically:
   // hi = key bytes 3..7 (40 bits), lo = height (24 bits) and position (16 bits)
@@ -92,16 +104,16 @@ function sortBucket(bucket, dir) {
     w += ROW;
   }
   const idx = Buffer.from(new BigUint64Array(sparse).buffer);
-  const write = (file, data) => { const f = openSync(file + '.tmp', 'w'); for (let o = 0; o < data.length;) o += writeSync(f, data, o, data.length - o); closeSync(f); renameSync(file + '.tmp', file); };
-  write(path.join(dir, `seg-${bucket.toString(16).padStart(2, '0')}.rows`), out.subarray(0, w));
-  write(path.join(dir, `seg-${bucket.toString(16).padStart(2, '0')}.idx`), idx);
-  unlinkSync(name('.unsorted'));
+  // a temporary name is unlinked and created afresh, owner-only: never a planted symlink followed (audit 2026-09-16, L10)
+  const write = (file, data) => { const f = openTempFile(file + '.tmp'); try { for (let o = 0; o < data.length;) o += writeSync(f, data, o, data.length - o); fsyncSync(f); } finally { closeSync(f); } renameSync(file + '.tmp', file); };
+  write(path.join(dir, `seg-${hex}.rows`), out.subarray(0, w));
+  write(path.join(dir, `seg-${hex}.idx`), idx);
   return { msg: { type: 'sorted', bucket, rows: w / ROW, dupes, ms: performance.now() - t0 }, transfer: [] };
 }
 
 parentPort.on('message', (job) => {
   try {
-    const r = job.type === 'scan' ? scan(job.file) : sortBucket(job.bucket, job.dir);
+    const r = job.type === 'scan' ? scan(job.file) : sortBucket(job.bucket, job.dir, job.size, job.crc);
     parentPort.postMessage(r.msg, r.transfer);
   } catch (err) {
     parentPort.postMessage({ type: 'error', job, message: err.stack || err.message });

package/server/collect/logparse.js

@@ -17,12 +17,14 @@
 const TS_RE = /^(\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2})\.(\d{3}) /;
 const TAG_RE = /^\[[a-z0-9_]+(?::\d+)?\]\s*/;
 
-// "1.0KB", "32.0 KB/s", "0.0B", "2.3MB", "128 KB". The node prints decimal
+// "1.0KB", "32.0 KB/s", "0.0B", "2.3MB", "128 KB". (2026-09-16, audit L6: the number is
+// `\d*\.\d+|\d+`, the same numbers as the old `[0-9]*\.?[0-9]+` without the two digit
+// runs that could split a long string of digits every possible way.) The node prints decimal
 // units (4096 bytes renders as "4.0KB"), so decode the same way back.
 const SIZE_UNITS = { B: 1, KB: 1e3, MB: 1e6, GB: 1e9, TB: 1e12, PB: 1e15 };
 export function parseSize(text) {
   if (text == null) return null;
-  const m = String(text).trim().match(/^([0-9]*\.?[0-9]+)\s*(B|KB|MB|GB|TB|PB)(?:\/s)?$/i);
+  const m = String(text).trim().match(/^(\d*\.\d+|\d+)\s*(B|KB|MB|GB|TB|PB)(?:\/s)?$/i);
   if (!m) return null;
   const unit = m[2].toUpperCase();
   return Math.round(parseFloat(m[1]) * SIZE_UNITS[unit]);
@@ -30,7 +32,7 @@ export function parseSize(text) {
 
 export function parseRate(text) {
   if (text == null) return null;
-  const m = String(text).trim().match(/^([0-9]*\.?[0-9]+)\s*(B|KB|MB|GB|TB)\/s$/i);
+  const m = String(text).trim().match(/^(\d*\.\d+|\d+)\s*(B|KB|MB|GB|TB)\/s$/i);
   if (!m) return null;
   return parseFloat(m[1]) * SIZE_UNITS[m[2].toUpperCase()];
 }
@@ -64,6 +66,11 @@ function addrParts(s) {
   return { host: s, port: null, addr: s };
 }
 
+// 2026-09-16 (audit L6): a `\s*` in front of a capture such as `([^,]+)` that can itself
+// start with a space lets the engine split one run of spaces between the two in every
+// possible way -- quadratic on a long run, and each rule pays it on every line. Those
+// captures now start with a character `\s` cannot match (`[^\s,][^,]*`), which matches
+// the same real lines and leaves only one way to read the spaces.
 const RULES = [
   // [dlc] -- network recv this tick: 4.0KB (405.0B/s) | total recv: 2.3MB || disk write this tick: 0.0B (0.0B/s) | total written: 1.9MB --
   {
@@ -90,7 +97,7 @@ const RULES = [
   // [dlc] -- dead-weight floor this tick: 32.0 KB/s (pool median 0.0 KB/s, absolute 32.0 KB/s) --
   {
     name: 'deadweight',
-    re: /\[dlc\]\s*--\s*dead-weight floor this tick:\s*([^\s]+(?:\s?[KMG]?B\/s)?)\s*\(pool median\s*([^,]+),\s*absolute\s*([^)]+)\)/,
+    re: /\[dlc\]\s*--\s*dead-weight floor this tick:\s*([^\s]+(?:\s?[KMG]?B\/s)?)\s*\(pool median\s*([^\s,][^,]*),\s*absolute\s*([^\s)][^)]*)\)/,
     apply(m) {
       return { kind: 'deadweight', floor: parseRate(m[1].trim()), poolMedian: parseRate(m[2].trim()), absolute: parseRate(m[3].trim()) };
     },
@@ -100,7 +107,7 @@ const RULES = [
   // [dlc] ranked 116 live peer(s) by a 2000-header sample in 44.6s: 39 answered, best 94 KB/s, median 63 KB/s, slowest answering 48 KB/s; the 77 silent rank last
   {
     name: 'ranking',
-    re: /\[dlc\]\s*ranked\s*(\d+)\s*live peer\(s\)[^.]*in\s*([\d.]+)s:\s*(\d+)\s*answered,\s*best\s*([^,]+),\s*median\s*([^,]+),\s*slowest answering\s*([^;]+);\s*the\s*(\d+)\s*silent/,
+    re: /\[dlc\]\s*ranked\s*(\d+)\s*live peer\(s\)[^.]*in\s*([\d.]+)s:\s*(\d+)\s*answered,\s*best\s*([^\s,][^,]*),\s*median\s*([^\s,][^,]*),\s*slowest answering\s*([^\s;][^;]*);\s*the\s*(\d+)\s*silent/,
     apply(m) {
       return {
         kind: 'peer_ranking', live: +m[1], sampleSecs: +m[2], answered: +m[3],
@@ -131,7 +138,7 @@ const RULES = [
   // [block] stored height=965923 hash=0000000000000000.. bytes=1464177 tx=6866 (via 193.223.81.8:8333)
   {
     name: 'blockStored',
-    re: /\[block\]\s*stored\s+height=(\d+)\s+hash=([0-9a-f.]+)\s+bytes=(\d+)\s+tx=(\d+)(?:\s*\(via\s*([^\)]+)\))?/,
+    re: /\[block\]\s*stored\s+height=(\d+)\s+hash=([0-9a-f.]+)\s+bytes=(\d+)\s+tx=(\d+)(?:\s*\(via\s*([^\s)][^)]*)\))?/,
     apply(m) {
       const via = addrParts(m[5]);
       return { kind: 'block_stored', height: +m[1], hashPrefix: m[2].replace(/\.$/, ''), bytes: +m[3], txs: +m[4], via: via?.addr ?? null, viaHost: via?.host ?? null };
@@ -198,7 +205,10 @@ const RULES = [
   // [mux:7] leg replaced: connected next pool peer 208.161.116.211:8333 (fd 266) addrv2=1
   { name: 'legReplaced', re: /\[mux:(\d+)\]\s*leg replaced:\s*connected next pool peer\s*(\S+)\s*\(fd\s*(\d+)\)\s*addrv2=(\d)/, apply: (m) => ({ kind: 'peer_connect', leg: +m[1], addr: m[2], host: addrParts(m[2])?.host, fd: +m[3], addrv2: m[4] === '1', reason: 'leg replaced' }) },
   // [mux:9] next peer 86.147.78.44:8333 unreachable: connect: Operation now in progress (leg stays down)
-  { name: 'legDown', re: /\[mux:(\d+)\]\s*next peer\s*(\S+)\s+unreachable:\s*(.+?)\s*\(leg stays down\)/, apply: (m) => ({ kind: 'peer_unreachable', leg: +m[1], addr: m[2], host: addrParts(m[2])?.host, reason: m[3].trim() }) },
+  // 2026-09-16 (audit L6): was `unreachable:\s*(.+?)\s*\(leg stays down\)`, which is cubic
+  // on a long run of spaces -- 20,000 of them did not finish in 300 s. The lazy capture
+  // now meets a literal straight away, and the apply trims what the two `\s*` used to.
+  { name: 'legDown', re: /\[mux:(\d+)\]\s*next peer\s*(\S+)\s+unreachable:(.+?)\(leg stays down\)/, apply: (m) => ({ kind: 'peer_unreachable', leg: +m[1], addr: m[2], host: addrParts(m[2])?.host, reason: m[3].trim() }) },
   // [dl:7] 209.38.162.73:8333 connection dropped (revents 0x11); re-dialing
   { name: 'legDropped', re: /\[dl:(\d+)\]\s*(\S+?)\s+connection dropped\s*\(revents\s*(\S+?)\)(?:;\s*(\S+))?/, apply: (m) => ({ kind: 'peer_drop', leg: +m[1], addr: m[2], host: addrParts(m[2])?.host, revents: m[3], follow: m[4] || null }) },
   // [net] feeler 47.232.103.88:8333 -> dead
@@ -217,7 +227,7 @@ const RULES = [
     },
   },
   // [mempool] recent-rejects filter: 128 KB shared (...)
-  { name: 'rejectFilter', re: /\[mempool\]\s*recent-rejects filter:\s*([^\s]+)\s*(?:KB|MB|B)?\s+shared/, apply: (m) => ({ kind: 'reject_filter', size: parseSize(m[1] + (/\s?(KB|MB|B)$/i.test(m[1]) ? '' : 'KB')) }) },
+  { name: 'rejectFilter', re: /\[mempool\]\s*recent-rejects filter:\s*([^\s]+)(?:\s*(?:KB|MB|B))?\s+shared/, apply: (m) => ({ kind: 'reject_filter', size: parseSize(m[1] + (/\s?(KB|MB|B)$/i.test(m[1]) ? '' : 'KB')) }) },
 
   // ---- the 2026-09-08 bench build (v0.0.1, built 03:02) rewrote these lines ----
   // Measured the same day against that node's own log: of 1,702 lines the rules
@@ -237,16 +247,21 @@ const RULES = [
   // unit to fill a gap.
   {
     name: 'bandwidthTick',
-    re: /\[dlc\]\s*--\s*recv\s*([^\s(]+)\s*\(avg\s*([^)]+)\)\s*\|\s*write\s*([^\s(]+)\s*\(avg\s*([^)]+)\)\s*\|\s*floor\s*([^()]+?)\s*\(median\s*([^)]+)\)\s*\|\s*banned\s*(\d+)\/(\d+)(?:\s*\|\s*(events.*?))?\s*--/,
+    // 2026-09-16 (audit L6): every `\s*` in front of a capture that could also match
+    // spaces now hands over to a first character that cannot (`[^\s)]`), and no lazy
+    // capture is followed by `\s*` -- the captures keep their trailing spaces and the
+    // apply trims them. The old form retried the same run of spaces from both sides and
+    // went quadratic on a long one.
+    re: /\[dlc\]\s*--\s*recv\s*([^\s(]+)\s*\(avg\s*([^\s)][^)]*)\)\s*\|\s*write\s*([^\s(]+)\s*\(avg\s*([^\s)][^)]*)\)\s*\|\s*floor\s*([^\s()][^()]*?)\(median\s*([^\s)][^)]*)\)\s*\|\s*banned\s*(\d+)\/(\d+)(?:\s*\|\s*(events.*?)|\s*)--/,
     apply(m) {
       const counters = {};
       for (const [, k, v] of (m[9] || '').matchAll(/\b(events|rot|wait|help|fail)\s+(\d+)/g)) counters[k] = +v;
       return {
         kind: 'bandwidth',
         netRate: parseRate(m[1]),
-        avgNetRate: parseRate(m[2]),
+        avgNetRate: parseRate(m[2].trim()),
         diskRate: parseRate(m[3]),
-        avgDiskRate: parseRate(m[4]),
+        avgDiskRate: parseRate(m[4].trim()),
         floor: parseRate((m[5] || '').trim()),
         poolMedianText: (m[6] || '').trim() || null,
         banned: +m[7],
@@ -274,7 +289,10 @@ const RULES = [
   // floor this tick:`, `average since start:`) stay with their own rules.
   {
     name: 'bandwidthTickFields',
-    re: /\[dlc\]\s*--\s*(.+?)\s*--/,
+    // 2026-09-16 (audit L6): `\s*(.+?)\s*--` retried every space run from both sides
+    // (quadratic). The capture now starts on a non-space and runs to the first `--`; its
+    // trailing spaces are trimmed with each segment below, so the fields are the same.
+    re: /\[dlc\]\s*--\s*(\S.*?)--/,
     apply(m) {
       const out = { kind: 'bandwidth', extraFields: [], extraValues: null };
       let claims = 0;
@@ -331,7 +349,8 @@ const RULES = [
   // the stored/applied figures survive whatever the node does to the prose.
   {
     name: 'dlcProgressFields',
-    re: /\[dlc\]\s*==\s*(.+?)\s*==/,
+    // 2026-09-16 (audit L6): same rewrite as bandwidthTickFields, same reason.
+    re: /\[dlc\]\s*==\s*(\S.*?)==/,
     apply(m) {
       const out = { kind: 'dlc_progress', extraFields: [] };
       let claims = 0;
@@ -429,7 +448,7 @@ const RULES = [
   // re-windowed, and that is decoded as negative rather than dropped.
   {
     name: 'dlcWorkerPeer',
-    re: /\[dlc\]\s*w(\d+)\s+(\S+?)\s+chunks=(\d+)\s+blocks=(\d+)\s*\(\+(-?\d+) blk\/s,\s*([^)]+)\)(?:\s*[\[(]([^\])]*?)[\])])?/,
+    re: /\[dlc\]\s*w(\d+)\s+(\S+?)\s+chunks=(\d+)\s+blocks=(\d+)\s*\(\+(-?\d+) blk\/s,\s*([^\s)][^)]*)\)(?:\s*[\[(]([^\])]*?)[\])])?/,
     apply(m) {
       const a = addrParts(m[2]);
       const note = (m[7] || '').trim() || null;
@@ -475,7 +494,11 @@ const RULES = [
   // Again: stored beside the others, not averaged with them.
   {
     name: 'catchupProgress',
-    re: /\[utxo_live\]\s*catchup progress:\s*height=(\d+)\/(\d+)\s*\((\d+\.?\d*)%\)\s*([\d.]+)\s*blk\/s\s*\(avg\s*([\d.]+)\)\s*eta\s*(\S+)\s*\|\s*(.*?)\s*\(([\d.]+)\s*ms\/blk over (\d+)\)/,
+    // 2026-09-16 (audit L6): the phase text was `\|\s*(.*?)\s*\(`, quadratic on spaces;
+    // it is now everything between the bar and the parenthesis. Only the `name N%` pairs
+    // are read out of it, so the spaces it now keeps change nothing. The eta stops at a
+    // bar, so a run of bars is not re-scanned once for every bar in it.
+    re: /\[utxo_live\]\s*catchup progress:\s*height=(\d+)\/(\d+)\s*\((\d+\.?\d*)%\)\s*([\d.]+)\s*blk\/s\s*\(avg\s*([\d.]+)\)\s*eta\s*([^\s|]+)\s*\|(.*?)\(([\d.]+)\s*ms\/blk over (\d+)\)/,
     apply(m) {
       // Groups: 1 height 2 of 3 pct 4 blk/s 5 avg 6 eta 7 phase text 8 ms/blk 9 samples.
       // An earlier cut of this apply() read 8/9/10 and returned msPerBlk 155 for a
@@ -496,7 +519,7 @@ const RULES = [
   //   12 input run(s) unlinked; apply never waited
   {
     name: 'utxoCompaction',
-    re: /\[utxo_live\]\s*compaction done in\s*([\d.]+)s\s*\((\d+) run\(s\)\s*\[[^\]]*\)\s*of\s*(\d+)[^;]*;\s*started at height\s*(\d+)\)?:\s*manifest_n\s*(\d+)\s*->\s*(\d+),\s*merged into run\s*(\d+),\s*(\d+) flushed meanwhile,\s*(\d+) input run\(s\) unlinked;\s*apply\s*(never waited|waited[^;,]*)/,
+    re: /\[utxo_live\]\s*compaction done in\s*([\d.]+)s\s*\((\d+) run\(s\)\s*\[[^\]]*\)\s*of\s*(\d+)(?:[^;\d][^;]*)?;\s*started at height\s*(\d+)\)?:\s*manifest_n\s*(\d+)\s*->\s*(\d+),\s*merged into run\s*(\d+),\s*(\d+) flushed meanwhile,\s*(\d+) input run\(s\) unlinked;\s*apply\s*(never waited|waited[^;,]*)/,
     apply(m) {
       const waited = m[10] !== 'never waited';
       return {
@@ -575,7 +598,7 @@ const RULES = [
   // median 59 s, p95 393 s apart on production.
   {
     name: 'dialTopUpFails',
-    re: /\[dl\]\s*outbound top-up:\s*(\d+)\s*dial\(s\) failed(?:,\s*first\s+(\S+):\s*(.+?))?\s*$/,
+    re: /\[dl\]\s*outbound top-up:\s*(\d+)\s*dial\(s\) failed(?:,\s*first\s+(\S+):(.+))?\s*$/,
     apply(m) {
       const a = m[2] ? addrParts(m[2]) : null;
       return {
@@ -625,7 +648,9 @@ const RULES = [
   // event list, which is what it is for.
   {
     name: 'dialBackgroundFail',
-    re: /\[dial\]\s*(\S+?):\s*background dial failed:\s*(.+?)\s*$/,
+    // 2026-09-16 (audit L6): `:\s*(.+?)\s*$` became `:(.+)$` (here and in dialTopUpFails):
+    // the same text once trimmed, and one pass to the end instead of one per space.
+    re: /\[dial\]\s*(\S+?):\s*background dial failed:(.+)$/,
     apply(m) {
       const a = addrParts(m[1]);
       return { kind: 'peer_reject', direction: 'outbound', addr: a?.addr ?? m[1], host: a?.host ?? m[1], reason: m[2].trim(), severity: 'warn' };
@@ -708,9 +733,19 @@ function localFromLogTs(dateTime, ms) {
   return new Date(+y, +mo - 1, +d, +h, +mi, +s, +ms).getTime();
 }
 
+// LONG LINES (2026-09-16, audit L6). Every rule runs unanchored on the server's main
+// thread, so a line's length is a cost every rule pays. No line this node prints comes
+// near 8 KB (the longest in the fixtures is a few hundred bytes); anything past that is
+// cut before matching, and the event says so (`truncated`: the characters dropped).
+// Together with the rewritten patterns above, a 20,000-space line parses in
+// a few milliseconds where `legDown` alone used to not finish in 300 s.
+export const MAX_LINE = 8192;
+
 // One line in, one event out (or null for a continuation/blank line).
 export function parseLine(line) {
   if (!line) return null;
+  let cut = 0;
+  if (line.length > MAX_LINE) { cut = line.length - MAX_LINE; line = line.slice(0, MAX_LINE); }
   const trimmed = line.replace(/\r$/, '');
   if (!trimmed.trim()) return null;
 
@@ -738,6 +773,7 @@ export function parseLine(line) {
         out.text = rest.trim();
         out.rule = rule.name;
         out.severity = out.severity ?? classify(tagBase, rest);
+        if (cut) out.truncated = cut;
         return out;
       }
     }
@@ -751,14 +787,25 @@ export function parseLine(line) {
     text: rest.trim(),
     severity: classify(tagBase, rest),
     rule: null,
+    ...(cut ? { truncated: cut } : {}),
   };
 }
 
 // Lines arrive in chunks; keep the trailing partial line for the next round.
+//
+// 2026-09-16 (audit L6): the partial line used to grow without limit, so a log that
+// never printed a newline was held whole in memory and handed to every rule at once.
+// `carry` now keeps at most MAX_LINE characters -- the front of the line, where the
+// timestamp and tag are -- and parseLine would cut it there anyway. What is dropped is
+// counted in `state.carryDropped`, so a mangled log shows up as a number, not silence.
 export function splitLines(buf, state = { carry: '' }) {
   const text = state.carry + buf;
   const parts = text.split('\n');
   state.carry = parts.pop() ?? '';
+  if (state.carry.length > MAX_LINE) {
+    state.carryDropped = (state.carryDropped ?? 0) + state.carry.length - MAX_LINE;
+    state.carry = state.carry.slice(0, MAX_LINE);
+  }
   const out = [];
   for (const p of parts) { const e = parseLine(p); if (e) out.push(e); }
   return out;

package/server/collect/markets.js

@@ -106,6 +106,22 @@ export const BOOKS = {
 export const DEPTH_STEP = 50;     // dollars a level on the depth grid: fixed, so snapshots compare as the price moves
 export const DEPTH_SPAN = 0.12;   // how far either side of the mid the grid reaches
 export const DEPTH_AGOS = [60, 300, 600, 1800, 3600];
+// BOUNDS ON WHAT AN EXCHANGE CAN MAKE US DO (2026-09-16, audit L5). The grid size was
+// ceil(mid x 0.24 / 50) with the mid taken from the books themselves, so one absurd book --
+// bid 60,000, ask 2e10, answering alone -- made 48 million levels, blocked pollBooks for
+// 10 s and held 5 GB for the hour the snapshot is kept. None of that takes a malicious
+// exchange, only a broken, compromised or intercepted one. So:
+//   - a book whose mid is more than DEPTH_SANE from the median of every other book and
+//     every recent ticker is not drawn; its row says why (an exchange answering nonsense
+//     is reported, never silently dropped -- rule 8);
+//   - the grid never exceeds DEPTH_MAX_LEVELS (at $50 a level that is a mid near $400,000
+//     before it bites; today's is about 370 levels);
+//   - a reply body is read up to MAX_BODY_BYTES and no further (Coinbase's whole book, the
+//     largest, measured 1.1 MB on 2026-09-11), and a redirect is an error, not a new host.
+export const DEPTH_SANE = 0.2;
+export const DEPTH_MAX_LEVELS = 2000;
+export const MAX_BODY_BYTES = 5 * 1024 * 1024;
+const TICKER_REF_MS = 600_000;    // how old a ticker may be and still vouch for a book's price
 const r3 = (v) => Math.round(v * 1000) / 1000;
 
 // A book as cumulative depth on the grid p0 + i*step: bids[i] is the BTC bid at or above that
@@ -136,11 +152,36 @@ export function depthOf(book, p0, n, step = DEPTH_STEP) {
 }
 
 const UA = 'BlockYard (self-hosted Bitcoin node monitor)';
+
+// A reply body, read no further than `limit` bytes (2026-09-16, audit L5). A declared
+// Content-Length past the limit is refused before reading; otherwise the stream is read
+// chunk by chunk and cancelled the moment it passes the limit, so a hostile or broken
+// endpoint costs at most `limit` bytes of memory, not whatever it cares to send inside
+// the 8 s timeout. A reply object with no stream (the tests' stubs) falls back to json().
+export async function readJsonCapped(r, limit = MAX_BODY_BYTES) {
+  const declared = Number(r.headers?.get?.('content-length'));
+  if (Number.isFinite(declared) && declared > limit) throw new Error(`reply of ${declared} bytes is over the ${limit}-byte limit`);
+  const reader = r.body?.getReader?.();
+  if (!reader) return r.json();
+  const chunks = [];
+  let total = 0;
+  for (;;) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    total += value.byteLength;
+    if (total > limit) {
+      reader.cancel().catch(() => {});
+      throw new Error(`reply over the ${limit}-byte limit`);
+    }
+    chunks.push(value);
+  }
+  return JSON.parse(Buffer.concat(chunks.map((c) => Buffer.from(c.buffer, c.byteOffset, c.byteLength))).toString('utf8'));
+}
 const median = (xs) => (xs.length ? (xs.length % 2 ? xs[(xs.length - 1) / 2] : (xs[xs.length / 2 - 1] + xs[xs.length / 2]) / 2) : null);
 
 export class MarketFeed {
   constructor(cfg = {}, { log = () => {}, fetchImpl = globalThis.fetch, now = Date.now, exchanges = EXCHANGES } = {}) {
-    this.cfg = { tickerMs: 15_000, candleMs: 300_000, bookMs: 30_000, idleAfterMs: 600_000, timeoutMs: 8_000, candles: 168, ...cfg };
+    this.cfg = { tickerMs: 15_000, candleMs: 300_000, bookMs: 30_000, idleAfterMs: 600_000, timeoutMs: 8_000, candles: 168, maxBodyBytes: MAX_BODY_BYTES, ...cfg };
     this.log = log;
     this.fetch = fetchImpl;
     this.now = now;
@@ -180,9 +221,11 @@ export class MarketFeed {
   }
 
   async get(url) {
-    const r = await this.fetch(url, { headers: { 'user-agent': UA, accept: 'application/json' }, signal: AbortSignal.timeout(this.cfg.timeoutMs) });
+    // redirect 'error' (2026-09-16, audit L5): every URL above is the exchange's own API
+    // host; a 3xx pointing somewhere else is not followed.
+    const r = await this.fetch(url, { headers: { 'user-agent': UA, accept: 'application/json' }, redirect: 'error', signal: AbortSignal.timeout(this.cfg.timeoutMs) });
     if (!r.ok) throw new Error(`HTTP ${r.status}`);
-    return r.json();
+    return readJsonCapped(r, this.cfg.maxBodyBytes);
   }
 
   async pollTickers() {
@@ -231,15 +274,41 @@ export class MarketFeed {
       }
     }));
     if (!books.size) return;
-    const mids = [...books.values()].map((b) => {
+    const midOf = (b) => {
       let bb = -Infinity, ba = Infinity;
       for (const [p] of b.bids) if (p > bb) bb = p;
       for (const [p] of b.asks) if (p < ba) ba = p;
       return (bb + ba) / 2;
-    }).sort((a, b) => a - b);
+    };
+    const bookMids = new Map([...books].map(([id, b]) => [id, midOf(b)]));
+    // Sanity (2026-09-16, audit L5): each book against everyone else -- the other books'
+    // mids and every ticker younger than ten minutes. With one book answering, the tickers
+    // are the check; with nothing to compare against, the book stands as before.
+    const tickers = this.exchanges.map((ex) => this.rows.get(ex.id)?.ticker)
+      .filter((t) => t?.last > 0 && this.now() - t.at <= TICKER_REF_MS).map((t) => t.last);
+    for (const [id, m] of bookMids) {
+      const others = [...[...bookMids].filter(([k]) => k !== id).map(([, v]) => v), ...tickers].filter((v) => Number.isFinite(v) && v > 0).sort((a, b) => a - b);
+      const ref = median(others);
+      const bad = !(Number.isFinite(m) && m > 0) ? 'no usable mid price'
+        : ref != null && Math.abs(m - ref) / ref > DEPTH_SANE ? `mid ${Math.round(m)} is more than ${DEPTH_SANE * 100}% from the other exchanges (${Math.round(ref)}); book not drawn`
+          : null;
+      if (bad) {
+        books.delete(id);
+        const row = this.rows.get(id);
+        if (row) row.bookError = { message: bad, at: this.now() };
+      }
+    }
+    if (!books.size) return;
+    const mids = [...books.keys()].map((id) => bookMids.get(id)).sort((a, b) => a - b);
     const mid = median(mids);
-    const p0 = Math.floor((mid * (1 - DEPTH_SPAN)) / DEPTH_STEP) * DEPTH_STEP;
-    const n = Math.ceil((mid * 2 * DEPTH_SPAN) / DEPTH_STEP) + 1;
+    let p0 = Math.floor((mid * (1 - DEPTH_SPAN)) / DEPTH_STEP) * DEPTH_STEP;
+    let n = Math.ceil((mid * 2 * DEPTH_SPAN) / DEPTH_STEP) + 1;
+    if (n > DEPTH_MAX_LEVELS) {
+      // Clamped: keep the mid in the middle of the grid rather than letting the grid stop
+      // short of it.
+      n = DEPTH_MAX_LEVELS;
+      p0 = Math.max(0, Math.floor((mid - (n / 2) * DEPTH_STEP) / DEPTH_STEP) * DEPTH_STEP);
+    }
     const snap = { at: this.now(), mid, p0, n, ex: {} };
     for (const [id, bk] of books) snap.ex[id] = depthOf(bk, p0, n);
     this.depthHist.push(snap);

package/server/collect/mining.js

@@ -43,6 +43,16 @@ export function parsePushes(hex) {
     const op = bytes[i];
     let n = op;
     let head = 1;
+    // 2026-09-16 (audit L4): a scriptSig may END on an OP_PUSHDATA opcode with its length
+    // bytes missing -- consensus allows any bytes after the BIP34 height, so a pool can
+    // put this in its own block for free. readUInt16LE/readUInt32LE past the end threw
+    // ERR_OUT_OF_RANGE, the monitor's lane retried that block forever and every later
+    // block waited behind it. The length is read only when all of its bytes are there;
+    // a truncated frame header ends the walk like any other unparseable frame.
+    if (op === 0x4c) head = 2;
+    else if (op === 0x4d) head = 3;
+    else if (op === 0x4e) head = 5;
+    if (i + head > bytes.length) break;
     if (op === 0x4c) { n = bytes[i + 1]; head = 2; }
     else if (op === 0x4d) { n = bytes.readUInt16LE(i + 1); head = 3; }
     else if (op === 0x4e) { n = bytes.readUInt32LE(i + 1); head = 5; }
@@ -54,6 +64,26 @@ export function parsePushes(hex) {
   return { consumed: i, total: bytes.length, pushes: out };
 }
 
+/**
+ * decodeCoinbase that cannot throw (2026-09-16, audit L4). The decoder is meant never to
+ * throw on any bytes, and the fuzz test holds it to that; this is the belt to that pair of
+ * braces for the two lanes that call it on untrusted blocks. A coinbase that still fails
+ * to decode is a fact about THAT block -- permanent, so it is recorded as unparseable (an
+ * unknown pool, `decodeError` saying why) and the lane moves on. Retrying it would only
+ * stall every block queued behind it, which is exactly what L4 found.
+ */
+export function decodeCoinbaseSafe(hex) {
+  try {
+    return decodeCoinbase(hex);
+  } catch (err) {
+    return {
+      parseable: false, truncatedAt: 0, height: null, tagText: null, tag: null,
+      commitment: null, extraNonce: null, raw: typeof hex === 'string' ? hex : '',
+      decodeError: String(err?.message ?? err),
+    };
+  }
+}
+
 /**
  * The longest printable prefix of a push. Pool tags and extra nonces share one frame
  * more often than they get a frame each, so "is this frame text" is the wrong question;
@@ -257,6 +287,8 @@ export function minerRow({ height, hash, decoded, stats, at }) {
     extraNonce: decoded?.extraNonce ?? null,
     commitment: decoded?.commitment ?? null,
     rawCoinbase: decoded?.raw ?? null,
+    // 2026-09-16 (audit L4): present only when the coinbase could not be decoded at all.
+    ...(decoded?.decodeError ? { decodeError: decoded.decodeError } : {}),
   };
 }