Harden WarningRegistry against a malformed registry file

[jgamblin]

Summary

A Diagnostics result constructs a WarningRegistry (src/diagnostic/diagnostics.ts), and WarningRegistry.read() threw on unparseable or wrong-shaped registry JSON. Because validation builds a Diagnostics for every result, a corrupt warnings.json turned every validation call — including otherwise-successful ones — into a thrown exception. This makes the registry fail soft so a bad file can no longer take down validation.

This PR is a targeted robustness fix to src/registry/warnings.ts plus smoke-test coverage. No validation semantics change; behavior for a valid or missing registry is unchanged.

Changes

• read() fails soft. On a JSON parse error or invalid shape it now warns on stderr and returns no warnings, instead of throwing. Validation is never taken down by a malformed registry file.
• addWarning() refuses to clobber. If the existing file could not be read, addWarning() throws rather than overwriting it, so a corrupt registry's contents are never silently destroyed.
• Warn once per corruption episode. A module-level set suppresses duplicate stderr lines (validation constructs a registry per result, so a corrupt default registry would otherwise emit one line per record). The entry is cleared on the next successful read, so a later re-corruption of the same path is reported again rather than swallowed for the process lifetime.
• Tests (scripts/test-local.mjs): malformed JSON, valid-JSON-of-the-wrong-shape (both assert the stderr warning is surfaced), the no-clobber addWarning guard against both corrupt forms (with a byte-for-byte before/after check), and a corrupt → repair → re-corrupt recurrence test. console.warn is captured so output stays clean.

npm run test:local passes.

Notes

• Independent of Add CI workflow and node --test suite #12 — this touches only src/registry/warnings.ts and scripts/test-local.mjs, neither of which Add CI workflow and node --test suite #12 modifies, so the two can merge in any order.
• Accepted tradeoffs (open to feedback): the fail-soft read is whole-file (one invalid entry discards all warnings from that file), and the corruption signal is stderr rather than an in-band Diagnostics field. Both are deliberate for the fail-soft goal; happy to surface the load error programmatically instead/as well if preferred.

🤖 Generated with Claude Code