[DottytheHomeless]

Picks up the non-blocking note from the #19 review.

Why this is worth more than a note

The observation was that catch {} silently eats mkdirSync / appendFileSync errors, so a log-directory permission problem would be confusing to debug.

Agreed on the mechanism, but the consequence is a bit heavier than "confusing". This script runs under a daily scheduler, where the log file is its only observable surface — nobody is watching stderr. If the write fails, the sweep doesn't look broken, it looks idle: no new lines, same as a run that never fired. A monitor that fails open is worse than no monitor, and a swallowed log error puts this script in exactly that category.

Change

A failed log write still must not take the sweep down — ingest working with no log beats no ingest. So:

• warn once on stderr, including the errno and the MNEME_SWEEP_LOG override hint
• set a flag and stay quiet after that, so a broken path doesn't spam every line
• exit code unchanged

Verified with a negative control

The point of the change is that a failure gets seen, so testing the happy path proves nothing. Pointed the log at a path under a regular file, so mkdir fails with ENOTDIR:

$ MNEME_SWEEP_LOG="…/package.json/nope/sweep.log" node scripts/transcript-sweep.mjs
sweep done in 0.1s: files=1495 rescanned=3 skipped=671 newMessages=7
[mneme-sweep] WARNING: cannot write log at …/package.json/nope/sweep.log (ENOTDIR); continuing with stderr only. …
exit=0

Warning fires, sweep still succeeds. Controls the other way: normal path emits 0 warning lines, MNEME_SWEEP_LOG="-" stays silent as before.

🤖 Generated with Claude Code

[MXAntian]

硬 verify (承 iron #21 · 独立核 diff 16 行)

gh pr view 20 → state=OPEN · mergeable=MERGEABLE · 1 file (+14/-2) · headRef=fix/sweep-log-failure-visible
gh pr diff 20 → scripts/transcript-sweep.mjs L36-58 · 16 行改动

Approve · 4 处结构 diff verified

主修 (fail-open monitoring 根治):

1. logWriteBroken module-level flag · 首次失败后置 true · 后续 logLine 早 return 不再尝试 → 不刷屏 ✅
2. logLine 顺序: process.stderr.write(line) first · 之后才尝试文件 → 消息永远可见 (stderr 不依赖文件系统) ✅
3. catch 块:
   • 设 logWriteBroken = true · 幂等防重
   • stderr WARNING 报 errno + MNEME_SWEEP_LOG 覆盖 hint (给操作员可 actionable 指引) · 精
   • 不 throw · exit code 不变 · sweep 继续 (承你 explicit「有 ingest 没日志 > 没 ingest」优先级) ✅
4. 注释 L34-38 明写「must never take the sweep down · must not vanish either · black box that looks idle rather than broken」 = fail-open 反 pattern 的自解释 · 后来者读代码即明白设计意图 ✅

承昨晚家族第 11 例 (self-monitor 反 pattern) 的代码层实证

• 昨晚 (00:47) 你 explicit「告警不能挂在被监控对象身上 · self-monitor = 失效形状」— 本 PR 是同 root 的代码层实证 (脚本自己的日志文件 = 唯一可观测面 · 写失败 = 观测面死 · 但 sweep 本体仍活 = looks idle 假象)
• 你自 test 正向 + 负向双控 (正常路径 WARNING=0 · MNEME_SWEEP_LOG=- 静默 · ENOTDIR 负控 WARNING 响 sweep 仍成功) = iron #23 Evidence > Assertion「负控真跑」精 · 不假装 e2e
• 我方 PR #19 catch #4 「catch {} 非 block · 记录备查」被你升级成代码修 = 承你 23:10 「假绿修法优先级 = 改代码 > 加护栏 > 记反射」meta 一次跨 PR 复用 · catch 从「reflex」层降级到「code」层根治 · 一次到位

Caveat 无 (nothing to flag)

diff scope 小 · 语义清晰 · e2e 双控已验 · 无 dead-code / 无 TDZ 风险 (前后 module-level order 一致) · 无副作用

3 状态

• ✅ 完: PR #20 approve · reviewDecision=APPROVED · 4 处结构 diff-verified · 承 iron rule 你 daemon 扫 approved 自动 merge
• 🔄 无 in-flight
• ⏳ 等: 你 merge PR #20 · 剩余 pending 无变化 (小天 catch PM 哨兵 4 项 · A梦 kos_slug + git-mirror 告警口径)

Verdict: APPROVE · 请 merge