Repository navigation
aggregator(quota-current): parseQuotaCurrent never checks windows entries — one null entry crashes the whole gatherer overlay and provenance still claims it applied #2416
Description
Problem
parseQuotaCurrent never checks the entries inside a provider's windows array, so one malformed entry crashes the whole Stage-2 quota overlay — and the live source's fail-soft catch then silently drops the gatherer data for every pool while its provenance still claims the gatherer was applied.
parseQuotaCurrent(pm-stack/aggregator/src/quota-current.ts:49-62) is the structural check for the gatherer's quota-current.json. For each provider it checks id/state/measuredAt/source types and thatwindowsis an array (:60) — it never checks that the array's entries are objects.pctWindows(quota-current.ts:85-97) dereferences every entry in its filter:typeof w.pctOfLimit === "number"(:87). Anullentry throwsTypeError: null is not an object (evaluating 'w.pctOfLimit'). A string entry survives the filter (itspctOfLimitis undefined), but an entry with a numericpctOfLimitand a non-stringnameor a non-stringresetsAtpasses both layers verbatim into the pool's windows.- The live caller (src/sources/live.ts:775-782) appends
· gatherer <generatedAt>toprovenance.quotabefore callingoverlayQuotaCurrent, inside a try/catch whose catch is commented "base view stands". When the overlay throws, the base view is indeed served — but with provenance claiming the gatherer overlay was applied, and with the fresh reads of every other, well-formed provider discarded too: one null in one provider's windows disables the whole overlay.
Evidence (verified this run on main 5a34fa70)
Sandbox Bun probe importing the real quota-current.ts (probe at /tmp/probe-laneB-aa/probe2.ts):
- A v1 doc whose single provider has
windows:[null], stateok, freshmeasuredAt→parseQuotaCurrentreturns non-null;overlayQuotaCurrenton a matching pool throwsTypeError: null is not an object (evaluating 'w.pctOfLimit'). - A window
{name: 42, pctOfLimit: 50, resetsAt: {bad: true}}→ passesparseQuotaCurrent; the overlay emits a pool window withname: 42andresetsAt: {bad: true}verbatim. - Control (from the module's own tests/semantics): well-formed windows overlay normally — the defect is only the missing entry-level gate.
Why it matters
quota-current.json is rewritten every 15 minutes by a gatherer on another host; the parser is the trust boundary for that file, exactly like the feed section gates. Today a single corrupt entry produces the worst of both worlds: all fresh gatherer data is silently lost (pools fall back to dated reads with no signal anything is wrong) while the page's provenance asserts the gatherer was applied. Per-entry validation — drop or reject only the bad entry/provider — keeps one provider's corruption from taking the other providers' fresh reads down with it.
Acceptance criteria
-
parseQuotaCurrent(orpctWindows) validates window entries: non-object entries (includingnull) can never reach thepctOfLimitdereference; a bad entry is dropped or its provider rejected, without discarding other providers' entries. - Window
nameandresetsAtare type-checked before they can enter a pool's windows (string name; string-or-nullresetsAt), matching theQuotaCurrentWindowcontract in model.ts. - The live quota path's provenance only claims the gatherer overlay when it was actually applied (or the overlay can no longer throw on gate-passing input — either pin is acceptable, triage decides).
- Regression tests pin:
windows:[null]does not throw and the remaining providers still overlay; a numeric-name/object-resetsAtwindow is refused or normalized; well-formed files overlay unchanged.
Dedup
- aggregator(quota-current): stale-path newest pick is not finite-gated — a garbage or far-future measuredAt wins the pool's displayed freshness #2253 (OPEN) is the stale-path newest-pick
measuredAtfinite gate in the same file — different field, different failure. - aggregator(quota-gather-map): entryFromResult throws RangeError on an out-of-range fetchedAt — one bad provider stamp discards the provider's whole tick #2332 (OPEN) is the producer side (
entryFromResultthrowing onfetchedAt) in quota-gather-map.ts — this is the reader/parser side. - aggregator: a future-dated gatherer read is 'fresh' forever until its date passes — quota-current freshness has no upper bound, so one skewed measuredAt pins a pool's windows for weeks #1541 (CLOSED) was the future-
measuredAtfreshness bound, already fixed and present at quota-current.ts:70-74. - Searches for
parseQuotaCurrent/ "quota-current windows" over open+closed issues returned no match for window-entry validation.
Metadata
Metadata
Assignees
Labels
Package/app: aggregator (pm-stack in this repo)pm-stack (Pad/Grist) in developing-today/codeTrivial: expected under 30 minutes of workSomething isn't working (prefixed form of the classic bug label)Ordinary priority (the default)Filed by the new-issue-creator jobQueue packet kind: bounded fix with reproduction and targeted tests
Activity
developing-today commentedon Oct 29, 2026
CODE-1234
dezren39 commentedon Oct 29, 2026
🤖 Agent note · state: filed
95 remaining items
dezren39 commentedon Nov 2, 2026
agent-note:v1 — parked
Agent: repo-worker-code (OpenChamber scheduled lane)
Task: repo-health-code-pilot task 5318
At: 2026-11-02T12:52:20Z
State: parked
Fresh evidence: #2416 OPEN and assigned to dezren39; canonical PR #4182 OPEN, non-draft, authored/assigned to dezren39.
Disposition: parked for 30 minutes at the Drew-owned hard stop. No checks, diff, branch, worktree, or source inspected. work/assigned remains set.
Resume: explicit Drew release/handoff or PR disposition; revalidate fresh before action.
Links: #2416 · #4182 · task 5318
dezren39 commentedon Nov 2, 2026
🤖 Agent note · picked up
dezren39 commentedon Nov 2, 2026
🤖 Agent note · parked
dezren39 commentedon Nov 2, 2026
🤖 Agent note · picked up
queue/5318-2416-quota-windows. Prior parks treated PR fix(aggregator): validate quota-current windows #4182 as Drew-owned on author login alone; the head-branch test shows it is this task's own fleet branch, and there are no hard-stop labels (held,user/owned,do-not-merge,do-not-auto-edit), so I am revalidating checks/Codex/diff and proceeding to merge if verified.queue/5318-2416-quota-windowsdezren39 commentedon Nov 2, 2026
🤖 Agent note · done
712663cd34) and issue aggregator(quota-current): parseQuotaCurrent never checks windows entries — one null entry crashes the whole gatherer overlay and provenance still claims it applied #2416 is CLOSED. The earlier Drew-owned parks were the author-login over-fire: PR fix(aggregator): validate quota-current windows #4182's head isqueue/5318-2416-quota-windows, task 5318's own fleet branch, with no hard-stop labels.423f36d2a) ran the full aggregator suite at 1096 pass / 0 fail. Codex's one P2 finding was fixed in head6aee703dcand replied on its thread; the latest Codex review on that head found no issues.queue/5318-2416-quota-windows