feat(chapel): Wave-3 rehab — chpl 2.8.0 compat + decoupled FFI smoke (closes #29) (#31)

* feat(chapel): Wave-3 rehab — chpl 2.8.0 compat + decoupled FFI smoke (closes #29)

Wave 3 of the echidna#146 Chapel rehabilitation arc.

Chapel 2.8.0 compatibility:
- DocudactylHPC.chpl: FileSystem.stat removed; switch to OS.POSIX.stat +
  struct_stat (3 sites). forall task-private intent made ndjsonWriter
  const-shadow; add `with (ref ndjsonWriter)` clause (matches existing
  begin-with-ref-timer pattern at line 201).
- NdjsonManifest.chpl: string[range] and string.createCopyingBuffer
  became throws; wrap with try/catch preserving the existing "return
  empty on error" contract (4 sites).

Decoupled FFI smoke (per echidna pattern):
- src/chapel/smoke.chpl (46 lines) exercises ddac_version /
  ddac_crypto_sha256_name / ddac_init / ddac_free without pulling in
  the DocudactylHPC metalayer.
- Justfile: check-smoke / build-smoke / run-smoke recipes; check-chapel
  uses --main-module DocudactylHPC to disambiguate the two proc main().
- hpc-ci.yml: new strict `build-smoke` job (no continue-on-error);
  CHAPEL_VERSION bumped 2.3.0 → 2.8.0.

ADR docs/decisions/2026-05-30-docudactyl-chapel-rehab.md documents the
scope adjustment: docudactyl's parallel-dispatch surface (forall idx in
dynamic(...)) is embarrassingly-parallel with deterministic per-locale
aggregation, NOT speculative like echidna's parallelProofSearchSpeculative.
Echidna's ParallelSoundness.agda theorems do not apply; docudactyl's
invariants (at-most-once / aggregation-commutativity / cache-coherence /
checkpoint-resumability) are documented informally and deferred to a
follow-up if formal mechanisation becomes load-bearing.

check-abi job retains continue-on-error: true — Idris2 source-bootstrap
on ubuntu-24.04 is environmental fragility, separate from docudactyl
correctness. build-smoke is the strict gate the pattern actually wants.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(ci): add missing runtime deps unblocking the HPC pipeline

The pre-existing apt install step omitted `liblmdb-dev` even though
`ffi/zig/build.zig:145` links against lmdb (and `libarchive` + `libcurl`
similarly). All three most recent main runs of "HPC Build & Test" had
failed at the Zig FFI build step with:

  error: unable to find dynamic system library 'lmdb' using strategy
  'paths_first'

Add the missing -dev (build) and runtime (libNNNt64) packages so the
Zig FFI builds, the resulting .so loads in build-chapel + build-smoke,
and the smoke gate this PR introduces actually runs (it was being
SKIPPED via `needs: build-ffi`).

Fix-at-source for the pipeline; no .zig source changes.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(zig): pre-existing Zig 0.15.2 compile errors (surfaced by smoke gate)

Three pre-existing Zig 0.15.2 errors in ffi/zig/src/* that were masked
by the missing liblmdb-dev apt package (fixed in the prior commit). With
lmdb resolving, the actual compile runs and 3 errors fire:

1. financial_extract.zig:252 — `var j = i + 4;` never mutated.
   Fix: `const j = i + 4;`. Zig 0.15 enforces var-vs-const strictly.

2. gpu_ocr.zig:221 — `fn freeTesseract(_handle: ?*anyopaque) void`
   triggers "unused function parameter" in 0.15 even with `_` prefix.
   Fix: rename to `handle` and `_ = handle;` in the body. The body is
   intentionally empty (cleanup is delegated to ddac_free in the main
   FFI) — the explicit discard is the Zig 0.15 idiom.

3. hw_crypto.zig:117 — inline-asm output syntax changed in 0.15.
   Old:  `: ({eax}) = "={eax}" -> u32,` (lvalue + arrow type)
   New:  `: [_] "={eax}" (eax),`         (named binding + lvalue)
   The local `eax` / `ebx` / `ecx` / `edx` vars are written back
   directly; same observable semantics, modernised syntax.

These match [[reference_zig_015_breaking_changes]] (estate-wide Zig
0.14 → 0.15 migration debt). ast-check passes locally on all three
files. Full build requires liblmdb-dev (now installed in CI).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/hpc-ci.yml

@@ -32,7 +32,9 @@ permissions:
 
 env:
   ZIG_VERSION: '0.15.2'
-  CHAPEL_VERSION: '2.3.0'
+  # Chapel 2.8.0 is required by docudactyl#29 — FileSystem.stat was
+  # removed; code now uses OS.POSIX.stat. echidna#146 set the same floor.
+  CHAPEL_VERSION: '2.8.0'
   IDRIS2_VERSION: '0.8.0'
 
 jobs:
@@ -58,7 +60,8 @@ jobs:
             libpoppler-glib-dev libglib2.0-dev \
             libtesseract-dev libleptonica-dev \
             libavformat-dev libavcodec-dev libavutil-dev \
-            libxml2-dev libgdal-dev libvips-dev
+            libxml2-dev libgdal-dev libvips-dev \
+            liblmdb-dev libarchive-dev libcurl4-openssl-dev
 
       - name: Build FFI (ReleaseFast)
         run: cd ffi/zig && zig build -Doptimize=ReleaseFast
@@ -80,6 +83,69 @@ jobs:
             ffi/zig/zig-out/lib/libdocudactyl_ffi.a
           retention-days: 1
 
+  # ═══════════════════════════════════════════════════════════════════════════
+  # Job 2a: FFI Smoke — decoupled from the metalayer (docudactyl#29 / echidna#146)
+  # ─────────────────────────────────────────────────────────────────────────────
+  # Builds and runs `src/chapel/smoke.chpl` linked against the Zig FFI library
+  # WITHOUT pulling in the full DocudactylHPC metalayer. Strict gate: if the
+  # FFI ABI surface or the chapel/Zig boundary regresses, this fails fast even
+  # when the metalayer build is broken. (No continue-on-error.)
+  # ═══════════════════════════════════════════════════════════════════════════
+  build-smoke:
+    name: Chapel FFI Smoke
+    needs: build-ffi
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+
+      - name: Download FFI artifacts
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+        with:
+          name: ffi-libs
+          path: ffi/zig/zig-out/lib/
+
+      - name: Install Chapel
+        run: |
+          CHPL_TARBALL="chapel-${CHAPEL_VERSION}-linux64-x86_64.tar.gz"
+          CHPL_URL="https://github.com/chapel-lang/chapel/releases/download/${CHAPEL_VERSION}/${CHPL_TARBALL}"
+          wget -q "${CHPL_URL}" -O "/tmp/${CHPL_TARBALL}"
+          tar xzf "/tmp/${CHPL_TARBALL}" -C /opt/
+          echo "CHPL_HOME=/opt/chapel-${CHAPEL_VERSION}" >> "$GITHUB_ENV"
+          echo "/opt/chapel-${CHAPEL_VERSION}/bin/linux64-x86_64" >> "$GITHUB_PATH"
+
+      - name: Install C runtime libraries (FFI .so transitively pulls these)
+        run: |
+          sudo apt-get update -qq
+          sudo apt-get install -y --no-install-recommends \
+            libpoppler-glib8t64 libglib2.0-0t64 \
+            libtesseract5 libleptonica-dev \
+            libavformat60 libavcodec60 libavutil58 \
+            libxml2 libgdal34t64 libvips42t64 \
+            liblmdb0 libarchive13t64 libcurl4t64 \
+            tesseract-ocr-eng
+
+      - name: Verify Chapel installation
+        run: chpl --version
+
+      - name: Build FFI smoke binary
+        run: |
+          mkdir -p bin
+          ABSPATH=$(cd ffi/zig/zig-out/lib && pwd)
+          chmod +x ffi/zig/zig-out/lib/libdocudactyl_ffi.so* || true
+          chpl src/chapel/smoke.chpl \
+               src/chapel/FFIBridge.chpl \
+               -o bin/docudactyl-smoke \
+               -Lffi/zig/zig-out/lib -ldocudactyl_ffi \
+               --ldflags="-Wl,-rpath,$ABSPATH"
+
+      - name: Run FFI smoke (init/version/free; no manifest required)
+        run: |
+          export LD_LIBRARY_PATH="ffi/zig/zig-out/lib:$LD_LIBRARY_PATH"
+          OUT=$(bin/docudactyl-smoke)
+          echo "$OUT"
+          echo "$OUT" | grep -qE '^\[smoke\] PASS$'
+
   # ═══════════════════════════════════════════════════════════════════════════
   # Job 2: Chapel HPC — Build + Smoke Test
   # ═══════════════════════════════════════════════════════════════════════════
@@ -115,6 +181,7 @@ jobs:
             libtesseract5 libleptonica-dev \
             libavformat60 libavcodec60 libavutil58 \
             libxml2 libgdal34t64 libvips42t64 \
+            liblmdb0 libarchive13t64 libcurl4t64 \
             tesseract-ocr-eng
 
       - name: Verify Chapel installation

Justfile

@@ -582,10 +582,36 @@ test-ffi:
     @echo "Running Zig FFI tests..."
     toolbox run -c {{toolbox}} bash -c 'export PATH="$$HOME/.asdf/shims:$$HOME/.asdf/bin:$$PATH" && cd {{zig_ffi}} && zig build test'
 
-# Check Chapel parse validity
+# Check Chapel parse validity (metalayer + smoke; --main-module
+# disambiguates the two `proc main()` files)
 check-chapel:
     @echo "Checking Chapel syntax..."
-    toolbox run -c {{toolbox}} bash -c 'export PATH="$$HOME/.asdf/shims:$$HOME/.asdf/bin:$$PATH" && chpl --parse-only {{chapel_src}}/DocudactylHPC.chpl {{chapel_src}}/*.chpl'
+    toolbox run -c {{toolbox}} bash -c 'export PATH="$$HOME/.asdf/shims:$$HOME/.asdf/bin:$$PATH" && chpl --parse-only --main-module DocudactylHPC {{chapel_src}}/DocudactylHPC.chpl {{chapel_src}}/*.chpl'
+
+# Decoupled FFI smoke (per docudactyl#29 / echidna#146 pattern).
+# Compiles just smoke.chpl + FFIBridge.chpl — does not pull in the
+# DocudactylHPC metalayer, so this gate stays green even if the
+# metalayer breaks. Build oracle for the FFI ABI alone.
+check-smoke:
+    @echo "Parse-checking FFI smoke..."
+    toolbox run -c {{toolbox}} bash -c 'export PATH="$$HOME/.asdf/shims:$$HOME/.asdf/bin:$$PATH" && chpl --no-codegen {{chapel_src}}/smoke.chpl {{chapel_src}}/FFIBridge.chpl'
+
+# Build the FFI smoke binary (links against Zig FFI library).
+build-smoke: build-ffi
+    @echo "Building FFI smoke binary..."
+    @mkdir -p bin
+    toolbox run -c {{toolbox}} bash -c 'export PATH="$$HOME/.asdf/shims:$$HOME/.asdf/bin:$$PATH" && \
+         ABSPATH=$$(cd {{zig_ffi}}/zig-out/lib && pwd) && \
+         chpl {{chapel_src}}/smoke.chpl \
+              {{chapel_src}}/FFIBridge.chpl \
+              -o bin/docudactyl-smoke \
+              -L{{zig_ffi}}/zig-out/lib -ldocudactyl_ffi \
+              --ldflags="-Wl,-rpath,$$ABSPATH"'
+
+# Run the FFI smoke (init/version/free without manifest or full metalayer).
+run-smoke: build-smoke
+    @echo "Running FFI smoke..."
+    bin/docudactyl-smoke
 
 # Check all HPC C library dependencies and versions
 deps-check:

docs/decisions/2026-05-30-docudactyl-chapel-rehab.md

@@ -0,0 +1,81 @@
+# ADR — Docudactyl Chapel Rehabilitation (Wave 3 of the echidna#146 arc)
+
+- Status: Accepted
+- Date: 2026-05-30
+- Closes: [docudactyl#29](https://github.com/hyperpolymath/docudactyl/issues/29)
+- Wave 1 reference: [echidna#146](https://github.com/hyperpolymath/echidna/pull/146)
+- Wave 2 tracker: [proven#126](https://github.com/hyperpolymath/proven/issues/126)
+- SPDX-License-Identifier: MPL-2.0
+
+## Context
+
+`docudactyl` is a distributed document-processing HPC engine for British-Library-scale corpora — 170M+ items dispatched across Chapel locales, parsing via a Zig FFI bridge to C parser libraries (poppler / tesseract / ffmpeg / libxml2 / gdal / vips). The Chapel framework lives at `src/chapel/` (11 modules, ~2,500 lines).
+
+`docudactyl#29` was filed alongside `echidna#146` (the Wave-1 Chapel metalayer rehabilitation) and `proven#126` (the Wave-2 follow-on). Each Wave-N issue applies the same shape: rewrite for chpl 2.8.0 compatibility, decouple the FFI smoke from the metalayer, flip CI to strict, and decide whether the Wave-1 `ParallelSoundness.agda` invariants apply to this repo's parallel-dispatch surface.
+
+## Decision
+
+Port the echidna#146 pattern with **two scope adjustments**:
+
+1. **No `ParallelSoundness.agda` port.** Docudactyl's parallel-dispatch surface is `forall idx in dynamic(docEntries.domain, chunkSize)` in `DocudactylHPC.chpl` — embarrassingly-parallel work distribution with deterministic per-locale-slot aggregation, not speculative search. Echidna's three theorems (first-success-wins soundness, completeness under retry, cancellation safety) are inapplicable. Docudactyl's relevant invariants — at-most-once under checkpoint resume, aggregation commutativity, L1/L2 cache coherence — are documented below and deferred to a follow-up Agda module if formal proofs become load-bearing.
+
+2. **The CI `check-abi` job retains `continue-on-error: true`.** This is documented as environmental fragility (Idris2 source bootstrap on ubuntu-24.04, not docudactyl correctness). The new `build-smoke` job is the strict gate the echidna pattern actually wants.
+
+## What landed
+
+### Chapel 2.8.0 compatibility fixes
+
+`chpl --no-codegen src/chapel/DocudactylHPC.chpl src/chapel/*.chpl` was failing with three errors before this PR; all three are now resolved. The metalayer compiles clean on chpl 2.8.0 (LLVM-built local toolchain) with only known unstable-API warnings remaining (`_pad` symbol prefixes; `dmapped`; `DynamicIters`; `string.c_str()`; cross-locale `c_addrOf`).
+
+| Site | Pre-state | Fix |
+|---|---|---|
+| `DocudactylHPC.chpl:303, 311, 373` | `FileSystem.stat(string)` removed in chpl 2.8.0 | `use OS.POSIX;` + `struct_stat` + `stat(path.c_str(), c_ptrTo(sb))`; field reads via `sb.st_mtim.tv_sec` / `sb.st_size` |
+| `DocudactylHPC.chpl:211` | `forall` task-private intent made outer `var ndjsonWriter` const-shadow; `proc ref writeResult` rejected the const actual | `forall … with (ref ndjsonWriter) { … }` (matches the `begin with (ref timer)` pattern already at line 201) |
+| `NdjsonManifest.chpl:91` | `string[range]` slicing now `throws` (UTF-8 boundary check) | `try { return line[range]; } catch { return ""; }` — preserves the existing "return empty on error" contract |
+| `NdjsonManifest.chpl:177, 182` | `string.createCopyingBuffer(c_ptrConst(c_char))` now `throws` | `try { … } catch { }` around each optional field — the SHA-256 / title fields are skipped in the rare malformed-UTF-8 case so the `forall` task is not torn down |
+
+### Decoupled FFI smoke
+
+`src/chapel/smoke.chpl` (46 lines) exercises `ddac_version` / `ddac_crypto_sha256_name` / `ddac_init` / `ddac_free` against the FFI bridge **without** pulling in the full `DocudactylHPC` metalayer. This is the echidna#146 invariant: a green smoke proves the C ABI compiles + links + returns sane data even when the metalayer is broken, so regression localisation is fast.
+
+The smoke is wired three places:
+
+- `Justfile` recipes: `check-smoke` (parse-only), `build-smoke` (binary), `run-smoke` (executes the binary)
+- `.github/workflows/hpc-ci.yml` job `build-smoke`: depends on `build-ffi`, strict (no `continue-on-error`), greps for `^\[smoke\] PASS$` in the binary output
+- `Justfile :: check-chapel` now uses `--main-module DocudactylHPC` to disambiguate the two `proc main()` files (DocudactylHPC + smoke) when globbing `src/chapel/*.chpl`
+
+### CI floor bumped
+
+`CHAPEL_VERSION: '2.3.0'` → `'2.8.0'` in `hpc-ci.yml`. The OS.POSIX migration is the proximate cause; the wider justification is that 2.8.0 is the version the rehabilitation pattern was validated against in Wave 1.
+
+## Parallel-dispatch invariants (informal — deferred to follow-up if formalised)
+
+These document the invariants the docudactyl `forall idx in dynamic(...)` loop relies on. They are NOT proved here; they are recorded so a future Agda module has a target.
+
+1. **At-most-once** — every document index in `docEntries.domain` is processed at most once. Currently enforced per-locale by `isAlreadyProcessed(idx)` (Checkpoint.chpl) gating on `recordCheckpoint`. Caveat: cross-locale resume after a topology change (e.g. 64 → 128 locales) is NOT global-atomic.
+2. **Abort-bounded** — beyond a failure-rate threshold (FaultHandler.chpl), the loop short-circuits; unprocessed indices are NOT silently dropped, they remain unprocessed and observable via the report.
+3. **Aggregation commutativity** — `accumulate(result)` writes only to `perLocaleStats[here.id]` (per-locale slot, no cross-task race); `computeGlobal` reduces by integer addition, which is commutative. SATISFIED by construction.
+4. **Cache coherence (L1)** — `(path, mtime, size)`-keyed LMDB lookups in the per-locale L1 are read-then-write within a single task; no concurrent writers to the same key.
+5. **Cache coherence (L2)** — Dragonfly L2 is shared across locales and keyed by SHA-256; concurrent `store` calls for the same key are tolerated because the value is deterministic (same SHA-256 implies same parse result). Not formally proven.
+6. **Checkpoint resumability** — resuming from a `recordCheckpoint(idx)` snapshot reproduces the same `succeededDocs / failedDocs` global stats modulo per-locale ordering. Stats are aggregated by addition, so order does not matter.
+7. **Content-type determinism** — magic-byte detection (`conduit.content_kind`) is deterministic per input file.
+
+A follow-up issue should be filed if these need formal mechanisation (Agda module path `proofs/agda/DistributedAggregationInvariants.agda`); echidna's `ParallelSoundness.agda` cannot be imported unchanged.
+
+## Wave-2 gate
+
+Per `docudactyl#29`, this PR was deferred until `proven#126` (Wave 2) "lands". At time of writing `proven#126` is still OPEN. The owner-authorised exception: the echidna#146 + proven#135 (binding-tier-1 detachable harness) pair has stabilised the rehabilitation shape; a docudactyl rehab now does not risk pattern-divergence. Should Wave 2 settle on a different shape, this ADR is the supersedable surface — the smoke target and CI gate are the load-bearing pieces that would change.
+
+## Consequences
+
+- `chpl 2.8.0` is now the floor in CI; running on `2.3.0` will fail the OS.POSIX import.
+- The metalayer build remains the same shape; only the three stat sites + `with (ref ndjsonWriter)` clause + the two throws-wrappers in NdjsonManifest differ.
+- The new `build-smoke` job runs in parallel with `build-chapel` (both `needs: build-ffi`), so wallclock CI time does not regress.
+- `check-abi` still flagged fragile; not changed in this PR.
+
+## References
+
+- [echidna#146](https://github.com/hyperpolymath/echidna/pull/146) — Wave-1 metalayer rehabilitation; canonical pattern source
+- [proven#126](https://github.com/hyperpolymath/proven/issues/126) — Wave-2 tracker
+- [docudactyl#29](https://github.com/hyperpolymath/docudactyl/issues/29) — this issue
+- chpl 2.8.0 `OS.POSIX.stat` — `/usr/share/chapel/2.8/modules/standard/OS.chpl:929-965`

ffi/zig/src/financial_extract.zig

@@ -249,7 +249,7 @@ fn extractCurrencyAmounts(text: []const u8, result: *FinancialResult) void {
                 }
             }
             if (is_currency) {
-                var j = i + 4;
+                const j = i + 4;
                 if (j < text.len and isDigit(text[j])) {
                     const parsed = parseDecimal(text, j);
                     if (parsed.end > j and result.amount_count < MAX_ITEMS) {

ffi/zig/src/gpu_ocr.zig

@@ -218,7 +218,8 @@ fn initTesseract() ?*anyopaque {
     return null; // Placeholder — actual Tesseract handle comes from ddac_init()
 }
 
-fn freeTesseract(_handle: ?*anyopaque) void {
+fn freeTesseract(handle: ?*anyopaque) void {
+    _ = handle;
     // Cleanup handled by ddac_free() in the main FFI
 }
 

ffi/zig/src/hw_crypto.zig

@@ -114,10 +114,10 @@ fn cpuid(leaf: u32, subleaf: u32) CpuidResult {
     var edx: u32 = undefined;
 
     asm volatile ("cpuid"
-        : ({eax}) = "={eax}" -> u32,
-          ({ebx}) = "={ebx}" -> u32,
-          ({ecx}) = "={ecx}" -> u32,
-          ({edx}) = "={edx}" -> u32,
+        : [_] "={eax}" (eax),
+          [_] "={ebx}" (ebx),
+          [_] "={ecx}" (ecx),
+          [_] "={edx}" (edx),
         : [_] "{eax}" (leaf),
           [_] "{ecx}" (subleaf),
     );

src/chapel/DocudactylHPC.chpl

@@ -33,6 +33,7 @@ use Version;
 use FileSystem;
 use IO;
 use Path;
+use OS.POSIX;
 
 // Minimum Chapel version required (2.7.0 for --parse-only, begin ref intent)
 param DOCUDACTYL_MIN_CHAPEL_MAJOR = 2;
@@ -207,7 +208,7 @@ proc main() throws {
   const fmtCode = outputFormatCode();
   const resultSize: c_size_t = 952; // sizeof(ddac_parse_result_t)
 
-  forall idx in dynamic(docEntries.domain, chunkSize) {
+  forall idx in dynamic(docEntries.domain, chunkSize) with (ref ndjsonWriter) {
     // Each task gets its own FFI handle (owns Tesseract/GDAL contexts)
     var handle = ddac_init();
     defer ddac_free(handle);
@@ -300,17 +301,21 @@ proc main() throws {
         // Use conduit file_size, but still need mtime from stat()
         fsize = conduitResult.file_size;
         try {
-          var finfo = stat(inputPath);
-          mtime = finfo.mtime: int(64);
+          var sb: struct_stat;
+          if stat(inputPath.c_str(), c_ptrTo(sb)) == 0 {
+            mtime = sb.st_mtim.tv_sec: int(64);
+          }
         } catch {
           // stat failed — proceed with normal parse
         }
       } else {
         // Fall back to stat() for plain manifests without conduit
         try {
-          var finfo = stat(inputPath);
-          mtime = finfo.mtime: int(64);
-          fsize = finfo.size: int(64);
+          var sb: struct_stat;
+          if stat(inputPath.c_str(), c_ptrTo(sb)) == 0 {
+            mtime = sb.st_mtim.tv_sec: int(64);
+            fsize = sb.st_size: int(64);
+          }
         } catch {
           // stat failed — proceed with normal parse
         }
@@ -370,9 +375,11 @@ proc main() throws {
           fsize = entry.size;
         } else {
           try {
-            var finfo = stat(inputPath);
-            mtime = finfo.mtime: int(64);
-            fsize = finfo.size: int(64);
+            var sb: struct_stat;
+            if stat(inputPath.c_str(), c_ptrTo(sb)) == 0 {
+              mtime = sb.st_mtim.tv_sec: int(64);
+              fsize = sb.st_size: int(64);
+            }
           } catch {
             // stat failed — skip caching
           }

src/chapel/NdjsonManifest.chpl

@@ -87,10 +87,15 @@ module NdjsonManifest {
       valEnd += 1;
     }
 
-    if valEnd > valStart then
-      return line[valStart..#(valEnd - valStart)];
-    else
+    if valEnd > valStart {
+      try {
+        return line[valStart..#(valEnd - valStart)];
+      } catch {
+        return "";
+      }
+    } else {
       return "";
+    }
   }
 
   /** Extract an integer value for a given key from a JSON line.
@@ -173,15 +178,20 @@ module NdjsonManifest {
 
       line += ',"parse_time_ms":' + parseTimeMs:string;
 
-      // Include SHA-256 if present
-      const sha = string.createCopyingBuffer(result.sha256: c_ptrConst(c_char));
-      if sha.size > 0 then
-        line += ',"sha256":' + jsonEscapeString(sha);
+      // Include SHA-256 if present (FFI strings are well-formed in practice;
+      // throws on UTF-8 boundary errors are skipped to preserve forall task)
+      try {
+        const sha = string.createCopyingBuffer(result.sha256: c_ptrConst(c_char));
+        if sha.size > 0 then
+          line += ',"sha256":' + jsonEscapeString(sha);
+      } catch { }
 
       // Include title if present
-      const title = string.createCopyingBuffer(result.title: c_ptrConst(c_char));
-      if title.size > 0 then
-        line += ',"title":' + jsonEscapeString(title);
+      try {
+        const title = string.createCopyingBuffer(result.title: c_ptrConst(c_char));
+        if title.size > 0 then
+          line += ',"title":' + jsonEscapeString(title);
+      } catch { }
 
       line += "}";