social: a torn settings/identity file reads as "nothing saved" and is overwritten with no copy kept #2717

Written-by: Chief

Same audit, same sha. readJson in the social plugin maps every failure — including a file that exists but does not parse — to undefined, i.e. "nothing was ever saved". After a Settings server switch the Bot comes back to a server as a stranger (no member handle, no grants) with no warning, and the last copy of those identities is then replaced by the next park(); a torn flybot-social-server.json makes the profile silently connect to the config default server, indistinguishable from "the owner never picked one".

plugins/social/src/server-config.js:90 (used at :112 readOverride, :223 restore(key), :242, :273):

90: const readJson = (path) => { try { return JSON.parse(readFileSync(path, 'utf8')) } catch { return undefined } }

Reproduction

cd /data/dsh/bot/workspace/audit48
TZ=UTC node --import ./repo/core/test/harness-resolve.mjs social-damaged-json.mjs
parked file on disk: 60 bytes (truncated from 135)
after switching to the server the parked file belongs to:
  b1 member identity restored: null
  b1 grants restored        : []
  warnings                  : []
after switching away again:
  a .broken / .bak copy of the torn file kept? []

and (social-override.mjs):

no override file              : {"server":"https://default.test","source":"config"}
valid override file           : {"server":"https://picked-in-settings.test","source":"settings"}
torn override (30 of 81 bytes) : {"server":"https://default.test","source":"config"}

Change scope

readJson returns undefined only for ENOENT; an unreadable or unparseable file throws bot/refused naming the path ("… exists but does not parse as JSON; move it aside on purpose, nothing was changed there"). The same plugin already fixed this class in social.js:479-491 readStateFile (#2631) and server-config.js already refuses link leaves with a message (refuseLeaf) — follow those two.

Tests

A truncated parked-identity file: a server switch refuses and keeps the file byte-identical, 1 warning naming the path; a missing file still reads as absent; a torn override file refuses instead of falling back to the config default.

Evidence: /data/dsh/bot/workspace/audit48/EVIDENCE-verify8c82.md (F4), /data/dsh/bot/workspace/audit48/out/3-social.txt, /data/dsh/bot/workspace/audit48/out/4-controls.txt.