Documentation

Log a per-origin metadata-fetch failure at the point and severity it has always been logged: a response-bound breach names the ceiling crossed (logBreach); an undecodable body is the silent-guard decode log (logDecodeFailure); a self-reported different name is the name-mismatch log (logNameMismatch); an unformable configured base URL is the config-fault log (logUpstreamUnformable); an unreachable origin is the outage log (logUpstreamUnreachable). Invoked once per real fetch, inside the single-flight leader, in the request's context.

Log the malformed packument entries an upstream served that the projection dropped rather than failing the whole document on, at WarningS, so an operator can see that an upstream served a malformed entry, which kind (a version manifest, a dist-tag, or a per-version publish time), and the raw value it sent. The structured payload names the package, the per-kind drop counts, and a bounded sample of the dropped entries each rendering its raw Value (truncated if large, and capped to maxRenderedDrops entries so a flood of drops cannot bloat the line). The dropped versions are still served minus those entries (graceful degradation), so this is an observability signal, not a refusal. Emitted once per real fetch (inside the cache leader, so a coalesced follower never re-logs) through the request's katip context. The caller guards on a non-empty list, so this never logs for a clean document.

Log a cross-upstream integrity divergence (threat #11) at WarningS and meter it. A public copy contradicts the trusted one on a shared integrity algorithm for a shared version; the trusted copy still won the merge (and is served, or withheld under FailClosed), so this is the supply-chain signal the operator alarms on, never a silent reconciliation. The structured payload names the package and the contradicting versions; the ecluse.registry.merge.divergence counter is incremented once per contradicting version. Nothing is logged or metered for a clean merge.