[Juliusolsson05]

Closes #1247.

Verified failure

On the owner's real tldr.json (328 records, one exactly at the 400-char limit), one over-limit record made every store call throw TLDR must contain 1–400 characters. The validator threw instead of returning false. The result:

• every tldr_update and goal_set failed;
• the peeks and Agent Activity were empty;
• the enforcement hooks threw.

A half-written goal completion did the same. Plan: docs/plans/2026-09-25-tldr-store-invalid-record.md (plan-only commit first).

Fix

• Invalid record: set aside per identity, never guessed or repaired. That identity has no current record and can report again.
• Preserved bytes: the original file is kept byte for byte at <file>.invalid-<digest>.json before any write can drop the record; one copy per content.
• Malformed container: still refuses, since a write through it would destroy every record.
• Validation: stored text uses a non-throwing check, including completion notes and history entries.

Review follow-ups (in this PR)

• Reads survive a failed copy: if the evidence copy cannot be made, reads still work, and writes are refused until the copy exists.
• Revisions continue above a set-aside record, so live readers (TLDR overlay, Close Completed) never discard a fresh record as stale.
• History salvage:
  • keeps every valid entry;
  • writes an evidence copy with no .json extension, so history eviction never counts it;
  • moves an oversized history aside whole;
  • leaves an unreadable history untouched rather than replacing it.
• An unchanged re-post repairs a salvaged history (review C). The file on disk is rewritten, so the history view stops failing.
• Salvage takes nothing from a damaged history of a different identity.

Evidence

• Real records, with texts redacted to same-length markers: testing/fixtures/tldr-store/real-records-2026-09-25.json.
• Four tests are red on main (one rewrites the old "refuse the whole file" pin); the container test already passed.
• Mutants killed: refuse-again, no-preserve, random copy name, throwing validator.
• tsc -b is clean; src/main/tldr passes (65 tests).
• Every surviving mutation from reviewers B and C is pinned (C: continuing at a revision-32 record, the salvage identity check, a set-aside revision below 1, the salvaged re-post).

🤖 Generated with Claude Code

[Juliusolsson05]

Final disposition (pre-merge), head 5362ee6. Three reviewers: A and B (two rounds each) and C (third reviewer per steering q37, on the final head).

Reviewer	Round 1	Round 2
A (correctness, consumers)	FIX-BEFORE-MERGE	FIX-BEFORE-MERGE
B (tests, real data)	FIX-BEFORE-MERGE	MERGE

Findings and dispositions:

Round 2

• A, major: if the raw read of a history file also failed (for example chmod 000), the history was treated as empty and the next report replaced it with no copy. Fixed in 97d6ce0. The raw read now throws, the file is left alone, and the report still succeeds because both appendHistory callers catch history failures. A test checks the bytes are unchanged.
• A, minor: salvage skipped the 512 KiB history size cap and loaded the whole file. Fixed in 97d6ce0. A history file over the cap is renamed to .invalid-oversize-<uuid> without being read. A test covers this.
• B, pinning gap (mutation survived): no test catches setting the carried-over revision to 1, because the test record is already revision 1. Not fixed. The code is correct (B's probe went from revision 12 to 13). Not blocking.
• B, pinning gap (mutation survived): no test catches removing unpreserved = null. Without it, the warning would repeat on every write. Not fixed. Only affects log output. Not blocking.

Round 1

• A1, major: an interrupted preserved-copy write was trusted as complete. Fixed in 02a0fb9 (write to a temp file, then atomic rename; an existing copy is accepted only if its bytes match).
• A2, major: one invalid history entry erased that identity's history. Fixed in 02a0fb9 (raw bytes preserved, valid entries kept). The unreadable-file remainder was fixed in 97d6ce0.
• A3, major: one bad entry still made the Goal Loop store fail as a whole. Out of scope here. Fixed by fix(goal-loop): one unreadable loop no longer loses every goal loop (#1248) #1258 (merged).
• A4, major: re-reporting a set-aside identity reset its revision to 1. Fixed in 02a0fb9 (numbering continues above the set-aside revision).
• A5, minor: a set-aside record reads as "never reported". Accepted as the plan's policy.
• A6, minor: distinct invalid versions pile up copies with no limit. Accepted. It needs repeated outside edits, and a normal write drops the record.
• B1, minor: a failed copy failed every read. Fixed in 0a0622f (reads succeed; the first write retries the copy and is refused until it succeeds).
• B2, B3, B4, minor: tests did not cover over-limit completion notes, over-limit history entries, or the commit null-prototype guard. Fixed in 02a0fb9 and 0a0622f. B confirmed in round 2 that all three mutations are now caught.

Caveats / residuals:

• A carried-over revision lasts only while the app runs. Once the dropped record is gone from disk and the app restarts, that identity starts again at revision 1.
• Copy names, warning text, and the two pinning gaps above have no tests.

Reviewer C (q37), on the final head: MERGE-READY with four minors. All four are fixed in this head's parent commit:

• C1 (test strength): the revision-continuation test used the at-limit record, which is revision 1, so "always continue at 2" passed. It now uses the highest real revision (32). The mutant dies.
• C2 (behaviour): an unchanged re-post after a salvage returned early, leaving the damaged file on disk, so the history view kept failing. It now rewrites the salvaged rows. A new test covers it and the mutant dies.
• C3 (test strength): salvage's identity check was untested. A damaged history from another identity now donates nothing; the mutant dies.
• C4 (test strength): the set-aside revision ≥ 1 guard was untested. A −5 revision now continues at 1; the mutant dies.

The body now describes every review follow-up. src/main/tldr passes (65 tests), and `npx tsc -b` is clean. Merges on a green gate that contains current main.

🤖 Generated with Claude Code