hive-c0re: fail on an unparseable resource-limits or topology file, write both atomically

resource-limits.json and topology.json were read with parse errors
folded into an empty map, and written in place with std::fs::write. One
truncated resource-limits.json followed by a single set_limits call
rewrote the file with only that agent's entry, erasing every other
agent's CPU and memory overrides without a log line. topology.json had
the same shape: reconcile rebuilt it from the live set, losing pending
(provisioned, never spawned) names.

- agent_config::read_map / write_map are generic over the stored type.
  tool-groups and capabilities behave as before.
- resource_limits::read / effective return an error for an existing but
  unreadable file; a missing file is still the empty map. set_limits
  fails without writing on such a file, and writes atomically.
- topology: reconcile fails without writing on an unreadable file and
  writes atomically. all_agents logs the error and returns no agents,
  so a ManageRootAgent holder starts without cross-agent mounts.

Read-path behaviour on an unreadable resource-limits.json, per caller:
- write_dropins (every spawn / swap / WriteDropin): logs the error and
  keeps the limits drop-in already under /run; the agent still starts.
  With no drop-in yet (first start since boot) it writes the hive
  defaults, because no drop-in means an uncapped container.
- render_flake: propagates, so sync_agents (and spawn/rebuild/destroy
  jobs) fail. An empty map would give tighter-capped agents the hive
  memoryMaxBytes.
- container_view::build_all: logs the error each scan and renders the
  rows at the hive defaults (no ContainerView wire change).
- set_resource_limits reply: propagates.

Closes #4731

hive-c0re/src/agent_config/topology.rs

@@ -17,7 +17,7 @@
 //! `lifecycle::set_nspawn_flags`.
 
 use std::collections::BTreeSet;
-use std::path::PathBuf;
+use std::path::{Path, PathBuf};
 
 use serde::Deserialize;
 
@@ -28,7 +28,7 @@ pub fn topology_path() -> PathBuf {
     crate::paths::meta_root().join(TOPOLOGY_FILE)
 }
 
-/// On-disk shapes [`read`] accepts. The array is what [`write()`] emits; the
+/// On-disk shapes [`read_from`] accepts. The array is what [`reconcile`] writes; the
 /// map is the legacy `name → parent | null` format, kept readable so a
 /// hive that upgrades across this change keeps its roster instead of
 /// blanking it until the next `reconcile` pass — and a blank roster is not
@@ -42,33 +42,51 @@ enum OnDisk {
     WithParents(std::collections::BTreeMap<String, Option<String>>),
 }
 
-/// Snapshot of the agent roster. Read on every `container_view::build_all`
-/// and every `render_flake` call. The file is small (one line per agent),
-/// so we re-read rather than caching — keeps the source of truth on disk.
-///
-/// Returns an empty set when the file is absent or unparsable. Safe
-/// degradation for fresh installs that haven't run through
-/// `meta::sync_agents` yet.
-#[must_use]
-pub fn read() -> BTreeSet<String> {
-    let path = topology_path();
-    let Ok(raw) = std::fs::read_to_string(&path) else {
-        return BTreeSet::new();
-    };
-    match serde_json::from_str::<OnDisk>(&raw) {
-        Ok(OnDisk::Roster(names)) => names,
-        Ok(OnDisk::WithParents(map)) => map.into_keys().collect(),
-        Err(_) => BTreeSet::new(),
+/// A missing file is the empty roster (a fresh install that hasn't run
+/// through `meta::sync_agents` yet).
+impl Default for OnDisk {
+    fn default() -> Self {
+        Self::Roster(BTreeSet::new())
     }
 }
 
+/// Snapshot of the agent roster in the file at `path` (normally
+/// [`topology_path`]). The file is small (one line per agent), so it is
+/// re-read rather than cached — keeps the source of truth on disk.
+///
+/// An absent file is the empty set. A file that exists but can't be read
+/// or parsed is an error, so [`reconcile`] never writes over it.
+fn read_from(path: &Path) -> std::io::Result<BTreeSet<String>> {
+    Ok(match super::read_map::<OnDisk>(path)? {
+        OnDisk::Roster(names) => names,
+        OnDisk::WithParents(map) => map.into_keys().collect(),
+    })
+}
+
 /// Every agent the roster knows about, in name order. This is the set
 /// a [`hive_sh4re::permissions::Capability::ManageRootAgent`] holder gets
 /// bind-mounted, and it is deliberately unfiltered: that capability means
 /// "may manage any agent", so the set is all of them.
+///
+/// An unreadable roster is logged and yields no agents, so the holder
+/// starts without cross-agent mounts rather than failing to start.
 #[must_use]
 pub fn all_agents() -> Vec<String> {
-    all_agents_in(&read())
+    all_agents_at(&topology_path())
+}
+
+fn all_agents_at(path: &Path) -> Vec<String> {
+    match read_from(path) {
+        Ok(topo) => all_agents_in(&topo),
+        Err(e) => {
+            tracing::error!(
+                path = %path.display(),
+                error = ?e,
+                "topology unreadable — no cross-agent mounts"
+            );
+            Vec::new()
+        }
+    }
 }
 
 /// Pure form of [`all_agents`] for unit tests.
@@ -77,33 +95,27 @@ pub fn all_agents_in(topo: &BTreeSet<String>) -> Vec<String> {
     topo.iter().cloned().collect()
 }
 
-/// Persist the roster. Sorted JSON output (`BTreeSet` iterates in key
-/// order) keeps git diffs minimal across re-writes. Best-effort —
-/// returns an `io::Error` so callers can decide whether a failure
-/// should abort their op (`sync_agents`) or just log.
-pub fn write(topology: &BTreeSet<String>) -> std::io::Result<()> {
-    let path = topology_path();
-    if let Some(parent) = path.parent() {
-        std::fs::create_dir_all(parent)?;
-    }
-    let text = serde_json::to_string_pretty(topology)
-        .map_err(|e| std::io::Error::new(std::io::ErrorKind::InvalidData, e))?;
-    std::fs::write(&path, format!("{text}\n"))
-}
-
 /// Reconcile `topology.json` against the current agent set. Adds any agent
 /// missing from the file; removes entries for agents no longer present.
 /// Returns true when the file changed and should be re-committed by the
-/// caller.
+/// caller. The write is atomic, as a sorted array (`BTreeSet` iterates in
+/// key order) to keep git diffs minimal.
 ///
 /// `pending` lists agents that have a provisioned proposed config repo
 /// but no container yet (provisioned, not yet spawned). They are KEPT
 /// (not dropped) so an agent that exists on disk but has never booted is
 /// still a name the hive knows about.
+///
+/// Fails without writing when the existing file can't be read or parsed:
+/// rebuilding it from the live set alone would drop every pending name.
 pub fn reconcile(agent_names: &[String], pending: &[String]) -> std::io::Result<bool> {
-    let (next, changed) = apply_reconcile(&read(), agent_names, pending);
+    reconcile_at(&topology_path(), agent_names, pending)
+}
+
+fn reconcile_at(path: &Path, agent_names: &[String], pending: &[String]) -> std::io::Result<bool> {
+    let (next, changed) = apply_reconcile(&read_from(path)?, agent_names, pending);
     if changed {
-        write(&next)?;
+        super::write_map(path, &next)?;
     }
     Ok(changed)
 }
@@ -138,7 +150,10 @@ pub fn apply_reconcile(
 
 #[cfg(test)]
 mod tests {
-    use super::{BTreeSet, OnDisk, all_agents_in, apply_reconcile};
+    use super::{
+        BTreeSet, OnDisk, TOPOLOGY_FILE, all_agents_at, all_agents_in, apply_reconcile, read_from,
+        reconcile_at,
+    };
 
     fn roster_three() -> BTreeSet<String> {
         ["alice", "bob", "carol"]
@@ -228,4 +243,44 @@ mod tests {
         };
         assert_eq!(names, roster_three());
     }
+
+    const TRUNCATED: &str = "[\n  \"alice\",\n  \"bob\",\n  \"do";
+
+    fn corrupt_file() -> (tempfile::TempDir, std::path::PathBuf) {
+        let dir = tempfile::tempdir().expect("tempdir");
+        let path = dir.path().join(TOPOLOGY_FILE);
+        std::fs::write(&path, TRUNCATED).expect("seed");
+        (dir, path)
+    }
+
+    #[test]
+    fn reconcile_leaves_a_corrupt_file_untouched() {
+        let (_dir, path) = corrupt_file();
+        let live = vec!["alice".to_owned(), "bob".to_owned()];
+        let err =
+            reconcile_at(&path, &live, &[]).expect_err("a corrupt file must not be rewritten");
+        assert_eq!(err.kind(), std::io::ErrorKind::InvalidData);
+        assert_eq!(std::fs::read(&path).expect("read"), TRUNCATED.as_bytes());
+    }
+
+    #[test]
+    fn all_agents_of_a_corrupt_file_is_empty() {
+        let (_dir, path) = corrupt_file();
+        assert!(all_agents_at(&path).is_empty());
+    }
+
+    #[test]
+    fn reconcile_round_trips_through_a_missing_file_and_leaves_no_temp_file() {
+        let dir = tempfile::tempdir().expect("tempdir");
+        let path = dir.path().join(TOPOLOGY_FILE);
+        assert!(read_from(&path).expect("missing file").is_empty());
+        let live = vec!["alice".to_owned(), "bob".to_owned(), "carol".to_owned()];
+        assert!(reconcile_at(&path, &live, &[]).expect("reconcile"));
+        assert_eq!(read_from(&path).expect("read"), roster_three());
+        let entries: Vec<_> = std::fs::read_dir(dir.path())
+            .expect("read_dir")
+            .map(|e| e.expect("entry").file_name())
+            .collect();
+        assert_eq!(entries, vec![std::ffi::OsString::from(TOPOLOGY_FILE)]);
+    }
 }