fix(backend): counter parity in plan/sub runners, FK-safe batch writes, onchain version gate

H4: runPlanTest + runSubPlanTest now increment testedNodes only when
result.actualMbps != null (else failedNodes++), and call recomputeCounters(state)
before the terminal status='done' — mirroring runAudit's reconciliation so the
two subscription runners no longer over-count tested vs failed. The new else
branch lives inside if(result); the thrown-error path is a separate (result
falsy) branch, so no double failedNodes++.

M8: continuous.js gates insertBatchResult on batchId > 0 to avoid an FK violation
when an upstream insertBatch failed and currentBatchId stayed 0.

M7: onchain-report.js _decodeCsv rejects any SNTR1 record whose version != v2
(returns null) instead of misparsing a future v3+ memo as v2.

Author: Sentinel-Bluebuilder

audit/continuous.js

@@ -281,13 +281,18 @@ async function _runOnePass(loopState, batchId, frozenNodes = null) {
     _emitScoped('result', { result: raw, batchId });
     const payload = _sanitizeBatchNodeResult(raw, batchId);
     _emitScoped('batch:node:result', payload);
-    // Persist to batch_results (non-blocking, non-fatal)
-    _getDb().then(db => {
-      if (db) {
-        try { db.insertBatchResult(batchId, payload); }
-        catch (err) { console.error(`[continuous] insertBatchResult failed (batch ${batchId}, ${payload?.address}): ${err.message}`); }
-      }
-    }).catch(err => console.error(`[continuous] _getDb failed (batch ${batchId}): ${err?.message || err}`));
+    // Persist to batch_results (non-blocking, non-fatal). Guard on batchId > 0:
+    // if insertBatch failed upstream (logged, non-fatal) currentBatchId stays 0,
+    // and writing insertBatchResult(0, …) would violate the FK to a non-existent
+    // batch row (foreign_keys=ON) and spam errors for every node in the pass.
+    if (batchId > 0) {
+      _getDb().then(db => {
+        if (db) {
+          try { db.insertBatchResult(batchId, payload); }
+          catch (err) { console.error(`[continuous] insertBatchResult failed (batch ${batchId}, ${payload?.address}): ${err.message}`); }
+        }
+      }).catch(err => console.error(`[continuous] _getDb failed (batch ${batchId}): ${err?.message || err}`));
+    }
   }
 
   // Use injected mock runner if provided (test path), otherwise resolve real pipeline.

audit/pipeline.js

@@ -1724,16 +1724,23 @@ export async function runPlanTest(planId, state, broadcast) {
     const _ptSnippet = _ptRaw.length > 4096 ? _ptRaw.slice(-4096) : (_ptRaw || null);
 
     if (result) {
-      state.testedNodes++;
       result.inPlan = true;
       result.planIds = [planId];
       result.diag = result.diag || {};
       result.diag.planId = planId;
       result.diag.subscriptionId = subscriptionId;
       result.diag.viaSubscription = true;
-      if (result.slaApplicable && result.pass15mbps) state.passed15++;
-      if (result.pass10mbps) state.passed10++;
-      if (result.passBaseline) state.passedBaseline++;
+      // Classify exactly as runAudit / recomputeCounters do: only an
+      // actualMbps != null result counts as tested (passed); a null-mbps
+      // result is a soft failure — otherwise testedNodes over-counts.
+      if (result.actualMbps != null) {
+        state.testedNodes++;
+        if (result.slaApplicable && result.pass15mbps) state.passed15++;
+        if (result.pass10mbps) state.passed10++;
+        if (result.passBaseline) state.passedBaseline++;
+      } else {
+        state.failedNodes++;
+      }
       upsertResult(state, result);
       saveResults(state);
       broadcast('result', { result, state });
@@ -1767,6 +1774,9 @@ export async function runPlanTest(planId, state, broadcast) {
 
   emergencyCleanupSync();
   await _finalizeOnchainReporter();
+  // Reconcile live-incremented counters against results[] — mirrors runAudit
+  // so the final persisted summary matches the authoritative classifier.
+  recomputeCounters(state);
   state.status = 'done';
   state.completedAt = new Date().toISOString();
   state.currentNode = null;
@@ -2198,7 +2208,6 @@ export async function runSubPlanTest(planId, subscriptionId, granterAddr, state,
     const _spSnippet = _spRaw.length > 4096 ? _spRaw.slice(-4096) : (_spRaw || null);
 
     if (result) {
-      state.testedNodes++;
       result.inPlan = true;
       result.planIds = [planId];
       result.diag = result.diag || {};
@@ -2208,9 +2217,18 @@ export async function runSubPlanTest(planId, subscriptionId, granterAddr, state,
       result.diag.feeGranted = !_selfGranter;
       result.diag.selfGranter = _selfGranter;
       result.diag.granter = granterAddr;
-      if (result.slaApplicable && result.pass15mbps) state.passed15++;
-      if (result.pass10mbps) state.passed10++;
-      if (result.passBaseline) state.passedBaseline++;
+      // Classify exactly as runAudit / recomputeCounters do: only an
+      // actualMbps != null result counts as tested (passed); a null-mbps
+      // result is a soft failure. Without this, testedNodes over-counts and
+      // the live header (passed = testedNodes) is wrong until a recompute.
+      if (result.actualMbps != null) {
+        state.testedNodes++;
+        if (result.slaApplicable && result.pass15mbps) state.passed15++;
+        if (result.pass10mbps) state.passed10++;
+        if (result.passBaseline) state.passedBaseline++;
+      } else {
+        state.failedNodes++;
+      }
       upsertResult(state, result);
       state.resumeHeadAddr = null;
       saveResults(state);
@@ -2251,6 +2269,9 @@ export async function runSubPlanTest(planId, subscriptionId, granterAddr, state,
 
   emergencyCleanupSync();
   await _finalizeOnchainReporter();
+  // Reconcile live-incremented counters against results[] — mirrors runAudit
+  // so the final persisted summary matches the authoritative classifier.
+  recomputeCounters(state);
   state.status = 'done';
   state.completedAt = new Date().toISOString();
   state.currentNode = null;

core/onchain-report.js

@@ -170,7 +170,9 @@ export function decodeMemo(memo, hrp = DEFAULT_HRP) {
     return _decodeCsv(memo);
   }
   if (memo.startsWith(`${MAGIC}${SEP}v`)) {
-    // Future versions / unknown — try CSV-style anyway, return null on failure
+    // Unknown / future SNTR1 version (e.g. v3+). The v2 CSV parser would
+    // best-effort-decode it into confidently-wrong records, so refuse it and
+    // return null (undecodable) instead. _decodeCsv enforces ver === 'v2'.
     return _decodeCsv(memo);
   }
 
@@ -189,6 +191,10 @@ function _decodeCsv(memo) {
   const headerParts = lines[0].split(SEP);
   if (headerParts[0] !== MAGIC) return null;
   const ver = headerParts[1] || '';
+  // Only the supported wire version is parseable. A future layout (v3+) must
+  // NOT be coerced through the v2 parser into wrong records — treat as
+  // undecodable and return null so callers can skip/ignore it.
+  if (ver !== `v${VERSION}`) return null;
   const region = (headerParts[2] || '').replace(/-/g, '').trim() || null;
   let baselineMbps = 0;
   let startedAt = 0;