fix(registry): RegistryError on non-dict entry; atomic apply; tighten type guard + slug regex

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/app/registry.py

@@ -32,7 +32,7 @@ _TYPE_DEFAULT_INITIAL_STATE = {
     "specification": "super-draft",
     "bdd": "active",
 }
-_SLUG_RE = re.compile(r"^[a-z0-9][a-z0-9-]*$")
+_SLUG_RE = re.compile(r"^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$")
 
 
 class RegistryError(Exception):
@@ -72,6 +72,8 @@ def parse_registry(text: str) -> RegistryDoc:
     seen: set[str] = set()
     entries: list[ProjectEntry] = []
     for p in projects_raw:
+        if not isinstance(p, dict):
+            raise RegistryError(f"each project entry must be a mapping, got {type(p).__name__}")
         pid = str(p.get("id") or "").strip()
         if not _SLUG_RE.match(pid):
             raise RegistryError(f"project id {pid!r} is not a valid slug")
@@ -119,12 +121,12 @@ def apply_registry(doc: RegistryDoc, registry_sha: str) -> None:
     (skip + log), never applied. Projects absent from the registry are left in
     place (archival is out of scope for M3; they simply stop refreshing).
     """
-    conn = db.conn()
+    with db.tx() as conn:
         for e in doc.projects:
             existing = conn.execute(
                 "SELECT type FROM projects WHERE id = ?", (e.id,)
             ).fetchone()
-        if existing is not None and existing["type"] not in (None, "", e.type):
+            if existing is not None and existing["type"] != e.type:
                 log.error(
                     "registry: refusing immutable type change on project %s (%s -> %s)",
                     e.id, existing["type"], e.type,
@@ -175,6 +177,8 @@ async def refresh_registry(config: Config, gitea: Gitea) -> None:
             f"{config.gitea_org}/{config.registry_repo}/projects.yaml not found"
         )
     text = base64.b64decode(item["content"]).decode("utf-8")
+    # Prefer the file's last commit sha for provenance (production Gitea
+    # includes it on the contents response); fall back to the blob sha.
     sha = item.get("last_commit_sha") or item.get("sha") or ""
     doc = parse_registry(text)
     apply_registry(doc, sha)

backend/tests/test_registry.py

@@ -58,6 +58,7 @@ def test_parse_initial_state_defaults_per_type():
 
 @pytest.mark.parametrize("bad,msg", [
     ("projects: []\n", "at least one"),
+    ("projects:\n  - just-a-string\n", "must be a mapping"),
     ("projects:\n  - {id: 'Bad Slug', name: A, type: document, content_repo: a}\n", "valid slug"),
     ("projects:\n  - {id: a, name: A, type: nope, content_repo: a}\n", "invalid type"),
     ("projects:\n  - {id: a, name: A, type: document}\n", "content_repo"),
@@ -92,3 +93,6 @@ def test_apply_rejects_type_change_on_existing_project():
     registry.apply_registry(registry.parse_registry(changed), "s2")  # logged + skipped, no raise
     t = db.conn().execute("SELECT type FROM projects WHERE id='default'").fetchone()["type"]
     assert t == "document"  # immutable — unchanged
+    # The deployment row IS still advanced even though the project upsert was skipped.
+    drow = db.conn().execute("SELECT registry_sha FROM deployment WHERE id=1").fetchone()
+    assert drow["registry_sha"] == "s2"