Refuse a torn export.pdb instead of converting it (G1d)

[jrgutier]

Implements W1b from .omc/plans/playlist-phantom-entry-root-cause.md — and this is the actual root-cause fix for the phantom playlist entry, now that forensics on the real drive have identified it.

What happened

A conversion published two playlist entries the settled export.pdb does not contain — track 444 spliced second-to-last into Organic House - Top 100, track 2984 mid-chain into walker-royce. convert exited 0; only a later verify caught it.

Evidence recovered from the drive:

Event	UTC
rekordbox last wrote export.pdb	12:09:38
convert started	12:09:52 — 14 s later
convert finished	~12:12:21
verify ran	12:12:24

export.pdb has not been modified since 12:09:38, so convert and verify read the same file. That rules out the stale-source explanation previously assumed. Parsed today, the unchanged file yields exactly verify's expected lists, with 444 and 2984 in no playlist at all — deterministically.

So the read at 12:09:52 saw a page image that no longer exists, on removable media where mtime reflects a metadata flush rather than the final byte landing. A stale slot read as present parses cleanly, lands in a coherent chain, and downstream nothing can distinguish it from a real entry.

The fix

The page header already carried the contradiction. Each page declares num_rows alongside num_row_offsets — and the walker decoded that field and threw it away. Now:

• present-bit count must equal the declared num_rows
• every row offset must point into the heap between the page header and the backward-growing row index (previously bounded only by page size, so stale index bytes could parse as a row)

Validated against real hardware before enforcing

Check	Result
Data pages where popcount == num_rows	997 / 997
Present row bodies outside the heap	0
Tombstoned slots still parsing as deletions	104
Real file after the gate	identical — 3,673 tracks, 45 playlists, 3,872 entries

Scope — stated plainly

This catches the demonstrated signature class, not torn reads in general. An image whose header was written before the pages it describes satisfies both checks and still passes. That residue is why the plan also carries an independent pre-publish oracle (W1d).

Note this also means W1's source fingerprint alone would not have caught this: convert would have hashed the torn bytes and verify the settled ones, reporting "stale source, re-run convert" — laundering a real fault into benign user activity.

Verification

699 tests (3 new), 88% branch coverage, ruff + mypy clean. Both gate tests confirmed red first.

🤖 Generated with Claude Code

https://claude.ai/code/session_01V3aF4y4GdsuJta2bfYUZ8w