Repository navigation
aggregator(feed): isBurnSegment accepts negative tokens, non-date from/to and inverted ranges — garbage burn rows survive sanitizeQuotaView and render as measured history #3428
Description
Problem
isBurnSegment — the element guard for the quota view's burn history, used by sanitizeQuotaView in pm-stack/aggregator/src/feed.ts:322-331 — checks only types:
typeof v.provider === "string" &&
typeof v.pool === "string" &&
typeof v.from === "string" &&
typeof v.to === "string" &&
isFiniteNumber(v.tokens)So a segment with a negative token count, a non-date from/to, an impossible calendar date, or an inverted range (from after to) passes the gate, is counted as well-formed, and renders in the "Burn between resets" table (src/render.ts:1994-1999) as measured history: fmtDate returns a garbage string verbatim when it does not parse, and negative tokens print with toLocaleString() as a negative burn.
Evidence (verified this run, main 574c04a)
Laptop probe ~/git/fleet/probe-2026-11-01-laneA-feedquota/ (copies of the real src/ tree, feed.ts md5 e564f17aea918d5281fd37d433a01017, identical to main; bun 1.4.2, real isBurnSegment). Control: a well-formed segment passes. Also passing (isBurnSegment=true):
tokens: -12345from: "banana"to: "2026-02-30T01:00:00Z"(a day that never existed;Date.parserolls it to Mar 2)from: "2026-10-02T00:00:00Z", to: "2026-10-01T01:00:00Z"(inverted range)
The shared strict primitives already exist in the same package — isIsoDate and isNonNegative in src/validate.ts, whose header states the ingest contract: shape, element types, value ranges, and real calendar dates, validated once at the boundary. The sibling guards in the same file follow it (isSnapshotRecord at src/snapshots.ts:313-316 refuses a negative limit and an impossible resetsAt); the burn guard does not.
Why it matters
Burn segments are the historical record the quota page presents as measured throughput between resets. A corrupt collector write that lands here is not dropped-and-counted like every other malformed element in sanitizeQuotaView — it is presented as fact (negative burn, a reset interval that runs backwards, a February 30th boundary), and because sanitizeQuotaView only counts what its guards refuse, the corruption is invisible in the dropped counts that are supposed to surface exactly this kind of loss.
Acceptance criteria
isBurnSegmentrefuses: afromortothat is not a real ISO calendar date (isIsoDate); a negativetokens(isNonNegative); an inverted range (from > to).- Malformed segments drop individually in
sanitizeQuotaViewwithdroppedBurncounting them (existing aggregator(feed): isFleetFeed checks only that quota.pools is an array — burn/choices, pool entries and windows unvalidated, one malformed pool crashes /quota #2429 behaviour for shape failures). - Regression tests in
test/feed.test.tsnext to the existing "malformed burn segments drop individually" test: negative tokens, garbage/impossiblefrom/to, and an inverted range all drop and count; the well-formed segment fixture is unchanged.
Dedup
Distinct from the quota-window gate gap filed alongside this one (different guard, different consumers — pool state/guidance vs the burn-history table; cross-linked there), #3365 (snapshot rollup guard), #2470 (quota-extract resetsAt emission), and #3364 (coverage census guard). Searched open + closed for isBurnSegment before filing.
Activity
developing-today commentedon Nov 1, 2026
CODE-1310
dezren39 commentedon Nov 1, 2026
🤖 Agent note · filed
8 remaining items
dezren39 commentedon Nov 2, 2026
🤖 Agent note · parked
isBurnSegmentvalue validation for issue aggregator(feed): isBurnSegment accepts negative tokens, non-date from/to and inverted ranges — garbage burn rows survive sanitizeQuotaView and render as measured history #3428 — implemented and opened as PR fix(aggregator): validate burn segment values in isBurnSegment (#3428) #4179.queue/6081-3428-burn-segment, head a7126b0)bun test test/feed.test.tspasses 38/38 including the new value-malformation regression test. Parked 20 minutes for one reason only: the Codex review of PR fix(aggregator): validate burn segment values in isBurnSegment (#3428) #4179 has not landed yet, and an undispositioned Codex finding blocks merge under the fleet gate. Resume: read PR fix(aggregator): validate burn segment values in isBurnSegment (#3428) #4179's Codex findings, disposition each (fix or reply), merge, close issue aggregator(feed): isBurnSegment accepts negative tokens, non-date from/to and inverted ranges — garbage burn rows survive sanitizeQuotaView and render as measured history #3428, complete task 6081.dezren39 commentedon Nov 2, 2026
🤖 Agent note · picked up
bun test test/feed.test.tson the laptop at that head — 38 pass, 0 fail. The PR's CItestcheck remains QUEUED in the documented GitHub Actions backlog (infra queue, not a failure).Merge pull request #4179 from developing-today/queue/6081-3428-burn-s…
dezren39 commentedon Nov 2, 2026
🤖 Agent note · done
bun test test/feed.test.tsat that head — 38 pass, 0 fail. The PR's CItestcheck was still QUEUED in the documented GitHub Actions backlog at merge time (infra queue, not a failure); merging proceeded under the standing merge authority with the fix verified locally.