aggregator(feed): isFleetFeed never checks registry — a non-array container crashes registry()/coverage(), and coverage()'s unfiltered .filter throws on a [null] entry that registry() handles fine

Problem

The fleet feed's registry section is never checked by isFleetFeed
(pm-stack/aggregator/src/feed.ts:207-219), and its two live-source
consumers handle it in two different unguarded ways:

registry() (pm-stack/aggregator/src/sources/live.ts:1009-1010)
iterates it directly: for (const r of feed.registry) if (isSessionRecord(r)) incoming.push(r). A non-iterable container
(plain object, number) throws TypeError: ... is not iterable
before the entry filter ever runs.
coverage() (live.ts:1073) calls
(feed?.registry ?? []).filter((r) => r.source === "claude-code")
— with no isSessionRecord filter at all. A non-array container
(string, object, number) has no .filter and throws; and an array
containing a null entry also throws (r.source dereferences
null), even though registry() filters that same entry out fine.

Evidence (verified this run, main `7d1b081c`)

feed.ts:38-39: FleetFeed.registry?: SessionRecord[] — identity
records (impl(dashboard): slice 3 — pluggable pages (DNS register first), comments everywhere, agent/session identity registry #906 §3) from sandbox OpenCode + Jules + Muse launches.
feed.ts:207-219: isFleetFeed checks only version,
generatedAt, quota.pools and attention — no registry check.
live.ts:1009-1010: registry() for-of over the raw container.
live.ts:1073: coverage() unfiltered .filter((r) => r.source === "claude-code") — the only registry consumer that does not pass
entries through isSessionRecord (the durable-store load at
live.ts:632 does Array.isArray(parsed) ? parsed.filter( isSessionRecord) : [], so the store path is safe; the feed path
is not).
Uncaught call sites: server.ts:604 (/sessions) and :613
(/api/registry.json) await source.registry() with no catch;
attentionContext() (server.ts:273) awaits source.coverage()
with no catch and backs /attention, /today, the board render
and /api/coverage.json (:753-755). (Other registry() callers
at :159/:172/:822 do catch.)

Laptop Bun probe (~/git/fleet/probe-2026-10-29-laneA-feedregistry/,
the REAL liveSource built via loadConfig exactly as
test/orchestration.test.ts builds it; feed.ts, sources/live.ts
and config.ts md5-identical to main 7d1b081c, Bun 1.4.2; feeds
written to a temp dir, registry store pointed at the temp dir —
entry counts include the laptop server's live sessions, which
registry() merges in by design):

`registry` in feed	`isFleetFeed`	`src.registry()`	`src.coverage()`
absent (control)	true	OK	OK
valid array (1 record)	true	OK — record merged	OK
`[null]` (entry-level)	true	OK — filtered by `isSessionRecord`	throws `TypeError: null is not an object (evaluating 'r.source')`
`"abc"` (string)	true	OK — chars filtered out	throws `TypeError: (feed?.registry ?? []).filter is not a function`
`{...}` (object)	true	throws `TypeError: {} is not iterable`	throws `.filter is not a function`
`42` (number)	true	throws `TypeError: number is not iterable`	throws `.filter is not a function`

Why it matters

The collector assembles the registry from three independent launch
sources; the section is documented as the identity record of record
for /sessions, author identities and cross-repo session links.
One drifted container value 500s /sessions and
/api/registry.json; one null entry — which the sibling consumer
handles correctly — 500s every surface backed by coverage()
(attention, today, board, coverage JSON). The two consumers
disagreeing about the same section's hygiene is the bug: the feed
path needs the same array + isSessionRecord discipline the
durable-store path already has (live.ts:632).

Related but distinct: #2408/#2376/#2485 are field-level gaps
inside records that pass isSessionRecord (taskRefs, lastSeenAt);
#2453 is the projects container in items()/projects(). This
one is the registry container plus coverage()'s missing entry
filter — no open or recently closed issue covers it (checked this
run: title/keyword searches for the feed registry gate return only
the field-level registry issues above and the other feed siblings
#2427/#2429/#2439/#2445/#2446/#2450/#2451).

Acceptance criteria

A feed passing isFleetFeed can no longer throw in registry()
or coverage() over its registry section: a non-array container
(string, object, number) and an array containing null/non-record
entries both degrade to "no feed records" (the documented
absent-section behaviour), and /sessions, /api/registry.json,
/attention, /today and /api/coverage.json render normally.
coverage()'s Claude-record count uses the same entry hygiene as
every other registry consumer (isSessionRecord, or the gate
guarantees it) — pinned by triage together with the layer choice
(gate-level array check in isFleetFeed vs Array.isArray guards
at both consumers), consistent with the feed-gate sibling rulings.
Regression tests cover: registry as a string, as an object, as a
number, and as [null] — registry() resolves, coverage()
resolves, and a well-formed registry still merges and counts its
records unchanged.

🤖 Agent note · filed

Agent: new-issue-creator-code-a
Session / ID: new-issue-creator-code-a cron run 2026-10-29 22:05 CDT
Found via: filed this run
Task: Filed the feed registry container/entry gap: isFleetFeed (feed.ts:207-219) never checks registry; registry() (live.ts:1009-1010) for-of throws on object/number containers, and coverage() (live.ts:1073) filters with no isSessionRecord — non-array containers have no .filter, and a [null] entry throws on r.source even though registry() filters it fine. Uncaught at server.ts:604 (/sessions), :613 (/api/registry.json) and via attentionContext (:273) for /attention, /today, /api/coverage.json. Probe on main 7d1b081, laptop ~/git/fleet/probe-2026-10-29-laneA-feedregistry/probe.ts (real liveSource via loadConfig as in test/orchestration.test.ts; feed.ts/live.ts/config.ts md5-identical to main).
Expectation: effort xs; done when triage pins the layer (isFleetFeed gate vs Array.isArray at both consumers + isSessionRecord hygiene in coverage(), consistent with the feed-gate siblings and the store path at live.ts:632) and routes a small_fix packet with the named regression tests.
Links: aggregator(feed): isFleetFeed never checks registry — a non-array container crashes registry()/coverage(), and coverage()'s unfiltered .filter throws on a [null] entry that registry() handles fine #2539 aggregator(feed): isFleetFeed never checks registry — a non-array container crashes registry()/coverage(), and coverage()'s unfiltered .filter throws on a [null] entry that registry() handles fine #2539 · aggregator(feed): non-array projects crashes items()/projects() — the .filter(isProjectPoolItem) call itself throws, taking down board/today/roadmap #2453 (projects container, distinct section) · field-level registry issues aggregator(registry): non-array taskRefs passes isSessionRecord and crashes mergeRecords' spread — a string one silently splits into single-character refs #2408/aggregator(registry): non-string lastSeenAt passes isSessionRecord and crashes mergeRecords sort — /sessions and /api/registry.json fail once the registry grows #2376/aggregator(registry): malformed taskRefs elements pass every gate and crash /sessions at render — an array of bad refs merges, persists, then refUrl throws #2485 (distinct)

🤖 Agent note · parked — Drew-owned PR boundary

Agent: OpenChamber scheduled lane (repo-worker-code)
Session / ID: OpenCode session ses_e5e6495a3a4ffeuo6k3NS8K6x5; queue task 5361
Fresh evidence: aggregator(feed): isFleetFeed never checks registry — a non-array container crashes registry()/coverage(), and coverage()'s unfiltered .filter throws on a [null] entry that registry() handles fine #2539 is OPEN and assigned to Drew; canonical PR fix(aggregator): sanitize optional registry feed #4196 is OPEN and authored by Drew on the task branch. Prior progress records implementation complete and CI pending.
Disposition: parked for 30 minutes. No source, PR, or existing worktree touched.
Resume condition: explicit handoff or ownership release; then revalidate issue aggregator(feed): isFleetFeed never checks registry — a non-array container crashes registry()/coverage(), and coverage()'s unfiltered .filter throws on a [null] entry that registry() handles fine #2539, PR fix(aggregator): sanitize optional registry feed #4196, checks, and reviews before work.
Queue: task 5361 is parked until 2026-11-02T09:16:36Z.
Links: aggregator(feed): isFleetFeed never checks registry — a non-array container crashes registry()/coverage(), and coverage()'s unfiltered .filter throws on a [null] entry that registry() handles fine #2539 · fix(aggregator): sanitize optional registry feed #4196

agent-note:v1 — state: picked-up at=2026-11-02T09:40:00Z (OpenChamber scheduled lane)

Agent: repo-worker-code
Session / ID: OpenCode session ses_e5e645eb913ffeCS1Ub77JJ6g3; queue task 5361
Fresh state: aggregator(feed): isFleetFeed never checks registry — a non-array container crashes registry()/coverage(), and coverage()'s unfiltered .filter throws on a [null] entry that registry() handles fine #2539 is OPEN and assigned to dezren39; canonical task PR fix(aggregator): sanitize optional registry feed #4196 is OPEN and authored by dezren39 on queue/5361-2539-registry-sanitize. The test check has failed; CodeRabbit is neutral/skipping.
Disposition: revalidated Drew-owned PR hard stop. No source, PR, branch, or worktree changes.
Next: park 30 minutes; resume only after explicit handoff or ownership release, then revalidate issue, PR, checks and reviews.
Links: aggregator(feed): isFleetFeed never checks registry — a non-array container crashes registry()/coverage(), and coverage()'s unfiltered .filter throws on a [null] entry that registry() handles fine #2539 · fix(aggregator): sanitize optional registry feed #4196

agent-note:v1 — state: parked at=2026-11-02T09:42:45Z (OpenChamber scheduled lane)

Agent: repo-worker-code
Session / ID: OpenCode session ses_e5e645eb913ffeCS1Ub77JJ6g3; queue task 5361
Fresh evidence: aggregator(feed): isFleetFeed never checks registry — a non-array container crashes registry()/coverage(), and coverage()'s unfiltered .filter throws on a [null] entry that registry() handles fine #2539 is OPEN and assigned to dezren39; canonical PR fix(aggregator): sanitize optional registry feed #4196 is OPEN and Drew-authored on queue/5361-2539-registry-sanitize. Its test check failed; CodeRabbit is neutral/skipping.
Disposition: parked for 30 minutes because the Drew-owned PR hard stop applies. No source, PR, branch, or worktree changes made. Existing parked labels remain aligned; work/assigned remains set.
Resume condition: explicit handoff or ownership release; then revalidate issue aggregator(feed): isFleetFeed never checks registry — a non-array container crashes registry()/coverage(), and coverage()'s unfiltered .filter throws on a [null] entry that registry() handles fine #2539, PR fix(aggregator): sanitize optional registry feed #4196, checks and reviews before work. Queue task 5361 is parked until 2026-11-02T10:12:31Z.
Links: aggregator(feed): isFleetFeed never checks registry — a non-array container crashes registry()/coverage(), and coverage()'s unfiltered .filter throws on a [null] entry that registry() handles fine #2539 · fix(aggregator): sanitize optional registry feed #4196

🤖 Agent note · picked up

Agent: queue worker (repo-worker-code), lane E shift
Session / ID: task 5361
Found via: queue claim
Task: Resuming task 5361 for issue aggregator(feed): isFleetFeed never checks registry — a non-array container crashes registry()/coverage(), and coverage()'s unfiltered .filter throws on a [null] entry that registry() handles fine #2539 from the awaiting_ci checkpoint: canonical PR fix(aggregator): sanitize optional registry feed #4196 (branch queue/5361-2539-registry-sanitize) already implements the loadFeed registry sanitization. The earlier ownership park was the shared-account false positive — PR fix(aggregator): sanitize optional registry feed #4196 is a fleet PR bound to task 5361 by branch name and body, not Drew-owned work. Revalidating PR fix(aggregator): sanitize optional registry feed #4196 checks and Codex findings fresh, then merging when verified.
Expectation: effort xs; done = PR fix(aggregator): sanitize optional registry feed #4196 merged, issue aggregator(feed): isFleetFeed never checks registry — a non-array container crashes registry()/coverage(), and coverage()'s unfiltered .filter throws on a [null] entry that registry() handles fine #2539 closed, task 5361 completed.
Links: PR fix(aggregator): sanitize optional registry feed #4196 · branch queue/5361-2539-registry-sanitize

🤖 Agent note · done

Agent: queue worker (repo-worker-code), lane E shift
Session / ID: task 5361
Found via: queue claim
Task: PR fix(aggregator): sanitize optional registry feed #4196 merged (merge commit d7b6e8a0d). The loadFeed registry sanitization for issue aggregator(feed): isFleetFeed never checks registry — a non-array container crashes registry()/coverage(), and coverage()'s unfiltered .filter throws on a [null] entry that registry() handles fine #2539 is on main: absent registry stays absent, non-array sections become an empty registry, malformed rows drop individually via isSessionRecord, and registryDropped records drops — registry() and coverage() now consume the same safe rows.
Expectation: done. Verification: merge conflict with current main resolved as a union with the PAYG sanitizer (aggregator(feed): isFleetFeed never checks payg — one malformed line crashes usage() and /quota #2450) — diff vs main is exactly this change; laptop bun test test/feed.test.ts test/orchestration.test.ts test/registry-hygiene-2408.test.ts on the merged tree: 86 pass, 0 fail. Codex review clean on both heads (ae2c8698f, 90312318c: no findings). The earlier CI test failure on PR fix(aggregator): sanitize optional registry feed #4196 was only the two pre-existing main failures (slice-3 dns/sessions/pages; hub service detail), verified against clean main by the previous shift.
Links: PR fix(aggregator): sanitize optional registry feed #4196 · branch queue/5361-2539-registry-sanitize

Navigation Menu

Repository navigation

aggregator(feed): isFleetFeed never checks registry — a non-array container crashes registry()/coverage(), and coverage()'s unfiltered .filter throws on a [null] entry that registry() handles fine #2539

Problem

Evidence (verified this run, main `7d1b081c`)

Why it matters

Acceptance criteria

35 remaining items

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

aggregator(feed): isFleetFeed never checks registry — a non-array container crashes registry()/coverage(), and coverage()'s unfiltered .filter throws on a [null] entry that registry() handles fine #2539

Description

Problem

Evidence (verified this run, main 7d1b081c)

Why it matters

Acceptance criteria

Activity

dezren39 commented on Oct 30, 2026

35 remaining items

dezren39 commented on Nov 2, 2026

dezren39 commented on Nov 2, 2026

dezren39 commented on Nov 2, 2026

dezren39 commented on Nov 2, 2026

dezren39 commented on Nov 2, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Evidence (verified this run, main `7d1b081c`)