fix(flowsafe): contain malformed-path URIError in P6 routers (pre-auth)

[gcharang]

Closes a confirmed pre-auth defect discovered during Track E's review (post-program hardening).

The bug

The P6 ingestion routers (signals/router.ts, goals/objective-routes.ts, schedules/router.ts) decoded the threadId/schedule-id path segment with bare decodeURIComponent before authentication and outside their try block, and createFlowsafeWorker.fetch wrapped the router calls in no try/catch. So an unauthenticated request with malformed percent-encoding — POST /api/threads/%/message, PUT /api/threads/%/goal, GET /api/schedules/% — threw a URIError out of fetch() as a per-request 500 with a logged exception. Bounded (per-request, no data leak, no amplification, no isolate crash), but a real pre-auth exposure. Track E's own webhook router already did this correctly with a local safeDecodeSegment.

The fix

• Shared helper host-kit/route-path.ts — safeDecodeSegment (zero-dependency leaf; returns undefined on malformed encoding). Internal: imported directly by the routers, not barrel-exported, so no new public API and the changeset stays a patch.
• Adopted in the three pre-auth routers → malformed encoding is route-absent (null), byte-identical to a non-matching path (no audit, no existence oracle — the null path is pre-resolve).
• Whole-class sweep: the background-tasks read route (background-tasks/routes.ts, post-auth, DO-mounted) adopts it too → malformed taskId returns its no-oracle 404 instead of throwing. Deduped the local copy from the Track E webhook router.
• Defense-in-depth: a top-level try/catch in createFlowsafeWorker.fetch contains any handler throw (present or future) as a generic 500 — no error.message leaked to the client, logged as worker-fetch-error.

Behavior-preserving for all valid paths (the removed ?? '' fallback was dead — the path-shape length guard already guarantees the segment exists; the schedules list route still yields id=undefined and composes).

Verification

• Gate: lint + typecheck + 1786 tests (94 files, +8) + build + spike:verify — green, run independently (3 gate runs across the change's evolution).
• 8 new regression tests: the helper unit (valid decode, lone %, %zz, a%, undefined), one malformed-% test per router (route-absent / 404, asserting no-audit / no-write / no-throw), and the worker backstop (an injected throwing router → generic 500 + worker-fetch-error log).
• Review lane: CLEAN. Two LOW findings resolved before commit — the helper docstring reworded to the accurate two-layer story (primary source-level defense + worker try/catch as defense-in-depth), and the helper kept internal (leaf imports everywhere, no barrel export) so patch is unambiguous and the import source is uniform. Confirmed no other decodeURIComponent/decodeURI/unescape in the defect class (run-router and the DO fetch handlers split pathname but never decode; INV-1 runIds are [a-z0-9_]).

🤖 Generated with Claude Code

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	anchorage-showcase	97cb097	Jul 18 2026, 02:23 AM