DOG-010: ULOG row injection + one-bad-line permanent rebuild DoS

Now:: OPEN

Sev:: HIGH

dog/ULOG.c emits log rows with plain URIutf8Feed (ULOG.c:40) — nothing rejects or escapes \n, \t, SP, or # in URI components, even though abc ships URIutf8FeedSafe (abc/URI.h:62-71) for exactly this trust boundary and worktree FILENAMES flow into rec->uri.path. A file named x\n0\tdel\t?refs/heads/main forges a complete extra attribution row. Worse, any malformed/non-monotonic line bricks the log: ulog_scan_log (ULOG.c:233-235) aborts on the FIRST ULOGBADFMT/ULOGCLOCK, so once the sidecar goes stale (clone, sidecar deleted, RO anon fallback, crash) EVERY subsequent ULOGOpen fails permanently — one crafted filename is a durable DoS on the wtlog. Method: Issues.

Input

Context

Emit boundary: ULOGu8sFeed (ULOG.c:28-43) uses URIutf8Feed, not URIutf8FeedSafe; callers ULOGAppendAt (:657-682), ulog_wt_cb (:1156).
Fail-hard rebuild: ulog_scan_log (:233-235) refuses the whole log on the first bad row instead of skip-and-continue.
ron60 token overflow: ts/verb drain via RONutf8sDrain (ULOG.c:89,104) has no 10-char cap; an 11+ char token silently aliases to an arbitrary ron60 that can still pass monotonicity. ULOG.md:23 promises ≤10 chars but nothing gates.
Sidecar offsets trusted after only sentinel + last-row checks (ulog_idx_is_fresh :420-433); intermediate 40-bit offsets are used by ULOGRow (:700-708) / ulog_row_key_bytes (:767-790) to form slices up to 2^40 past a 1 GiB booking — safe only incidentally.

Goals

Validate/escape at ULOGu8sFeed: route URI through URIutf8FeedSafe and reject ts/verb/URI bytes outside the row alphabet (tab/newline/#/SP).
Rebuild survives a bad row: ulog_scan_log skips-and-continues on ULOGBADFMT (log a warning) rather than refusing the entire log.
Enforce the ≤10-char ron60 cap in ULOGu8sDrain (fail ULOGBADFMT past 10).
Bounds-check off < u8bDataLen(data) before forming a row slice in ULOGRow and ulog_row_key_bytes.

Constraints

dog/ libdog, ABC style; error codes RON60, ULOG-prefixed, ≤10 chars.
Round-trip of well-formed logs stays byte-identical.

WIP

Design decisions

Escaping vs rejection: prefer REJECT (a filename with a raw newline is already pathological) so the on-disk row grammar stays trivially greppable (the greppability rule per Tickets).

TODOs

T1 repro: property/fuzz case feeding a filename with \n/\t through ULOGu8sFeed→scan; assert no forged row and no permanent-fail rebuild. (dog/fuzz has no ULOGu8sDrain target today — TOK/WEAVE/NEIL only.)
T2 escape/reject at the feed; ≤10-char ron60 cap at the drain.
T3 skip-and-continue rebuild in ulog_scan_log.
T4 offset bounds in ULOGRow/ulog_row_key_bytes.
T5 fix stale docs (ULOG.h:170-172, ULOG.md:46-48): monotonicity guarantee is now conditional (fresh sidecar / idx==NULL skip the scan).

Blockers and bummers

Pointer-poke style in the same offset paths tracked under PTR-002.
Audit 2026-07-07: re-verified in libdog HEAD 79612854 — plain URIutf8Feed still at ULOG.c:40, ulog_scan_log still fail-hard on the first bad row (:233-234 return o / fail(ULOGCLOCK)). ULOG-003 be89684d touched only booked-index capacity (ulog_idx_push FILEBookEnsure), none of this ticket. WIP fix UNLANDED in worktree ~/src/DOG-010 (ULOG.c modified).

Outcome

OPEN — filed 2026-07-06, the libdog code-quality review session.