Fail closed on registry quarantine write errors

[cursor]

Bug and impact

A valid registry snapshot whose compact HTTP response fit SCP_QUARANTINE_MAX_CONTENT_BYTES could still expand past that cap when wrapped in the indented registry-fetch quarantine envelope. scp_utils.quarantine() then raised ValueError, which escaped fetch_registry() and crashed CLI/library callers instead of returning the fail-closed result shape.

Root cause

fetch_registry() handled network, JSON, and validation failures, but did not handle expected quarantine write failures after diff_snapshot() succeeded.

Fix

Catch OSError and ValueError from _write_registry_quarantine() and return {ok: false, error: "quarantine_failed", local_registry_unchanged: true}.

Validation

• RED: PYTHONPATH=src python3 -m pytest tests/test_registry_fetch_r4.py::test_fetch_fails_closed_when_quarantine_envelope_exceeds_cap -q failed on current HEAD with the uncaught ValueError.
• GREEN: same focused test passed after the fix.
• Final focused suite: PYTHONPATH=src python3 -m pytest tests/test_registry_fetch_r4.py tests/test_registry_ssot.py tests/test_security_regressions.py tests/test_appsec_fetch_body_caps.py tests/test_antigen_p1_nostr.py tests/test_registry_load_order_r5.py -q -> 73 passed, 1 skipped.
• python3 -m compileall -q src/scp and git diff --check passed.

Note: full pytest -q collection is blocked in this environment by missing mcp, a known current-main dependency issue already covered by existing open PRs.

  

[ManintheCrowds]

Audit: fail-closed fetch when quarantine write fails ported in #60 (quarantine_failed). Closing as superseded by #60.