fix: bound album-tracks pagination + treat non-object config as corrupt (backup, not crash) [corner-case R2 minors]

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/data/config.test.ts

@@ -411,4 +411,43 @@ describe("loadConfig error handling", () => {
     // The corrupt original is preserved verbatim (recoverable, never deleted).
     expect(readFileSync(join(dir, backups[0]), "utf-8")).toBe(garbage);
   });
+
+  // (d)/(e) Valid JSON that is NOT a non-null object (null / [] / 42 / "str") passes
+  // JSON.parse but would throw a raw TypeError in the per-field sanitize block
+  // (property access on a non-object), bypassing the corrupt-backup path. It must be
+  // treated EXACTLY like corrupt JSON: back up to *.corrupt-* (original preserved),
+  // return defaults — NOT a thrown TypeError, and NOT a silent defaults-with-no-backup.
+  it("(d) a `null` config is treated as corrupt: defaults + *.corrupt-* backup (original preserved)", () => {
+    const dir = makeTmpDir();
+    const path = join(dir, "config.json");
+    writeFileSync(path, "null", "utf-8");
+
+    let loaded: ReturnType<typeof getDefaultConfig>;
+    expect(() => {
+      loaded = loadConfig(path);
+    }).not.toThrow();
+
+    expect(loaded!).toEqual(getDefaultConfig());
+    const backups = readdirSync(dir).filter((f) => f.includes(".corrupt-"));
+    expect(backups.length).toBeGreaterThan(0);
+    expect(readFileSync(join(dir, backups[0]), "utf-8")).toBe("null");
+  });
+
+  it("(e) a non-object config (`[]` / `42`) is backed up + defaults, not a thrown TypeError", () => {
+    for (const content of ["[]", "42"]) {
+      const dir = makeTmpDir();
+      const path = join(dir, "config.json");
+      writeFileSync(path, content, "utf-8");
+
+      let loaded: ReturnType<typeof getDefaultConfig>;
+      expect(() => {
+        loaded = loadConfig(path);
+      }).not.toThrow();
+
+      expect(loaded!).toEqual(getDefaultConfig());
+      const backups = readdirSync(dir).filter((f) => f.includes(".corrupt-"));
+      expect(backups.length).toBeGreaterThan(0);
+      expect(readFileSync(join(dir, backups[0]), "utf-8")).toBe(content);
+    }
+  });
 });

src/data/config.ts

@@ -98,6 +98,26 @@ export function getDefaultConfig(): BotConfig {
   };
 }
 
+/**
+ * Move an unusable config aside to a timestamped `*.corrupt-*` backup so the data
+ * stays recoverable (it is NEVER deleted), for both the corrupt-JSON case and the
+ * parses-but-not-an-object case. Prefer an atomic same-dir rename; if that fails,
+ * copy instead. If it can't be preserved at all, rethrow rather than let the caller
+ * overwrite unrecoverable data.
+ */
+function backupCorruptConfig(path: string): void {
+  const backup = `${path}.corrupt-${Date.now()}`;
+  try {
+    renameSync(path, backup);
+  } catch {
+    try {
+      copyFileSync(path, backup);
+    } catch (backupErr) {
+      throw backupErr;
+    }
+  }
+}
+
 export function loadConfig(path: string): BotConfig {
   const defaults = getDefaultConfig();
 
@@ -120,27 +140,26 @@ export function loadConfig(path: string): BotConfig {
     throw err; // (b) transient/permission error on an existing file — do not clobber it
   }
 
-  let partial: Partial<BotConfig>;
+  let parsed: unknown;
   try {
-    partial = JSON.parse(raw) as Partial<BotConfig>;
+    parsed = JSON.parse(raw);
   } catch {
     // (c) Corrupt content: move the unreadable file aside to a timestamped backup
-    // so the data stays recoverable, then fall back to defaults. Prefer an atomic
-    // same-dir rename; if that fails, copy instead. If it can't be preserved at
-    // all, rethrow rather than let the caller overwrite unrecoverable data.
-    const backup = `${path}.corrupt-${Date.now()}`;
-    try {
-      renameSync(path, backup);
-    } catch {
-      try {
-        copyFileSync(path, backup);
-      } catch (backupErr) {
-        throw backupErr;
-      }
-    }
+    // so the data stays recoverable, then fall back to defaults.
+    backupCorruptConfig(path);
     return defaults;
   }
 
+  // (d) Parses cleanly but is NOT a non-null object (e.g. `null`, `42`, `"str"`,
+  // `[]`). The per-field sanitize below assumes an object and would throw a raw
+  // TypeError (or silently spread junk), bypassing the corrupt-backup path. Treat
+  // it EXACTLY like corrupt JSON: back it up (never delete), then return defaults.
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+    backupCorruptConfig(path);
+    return defaults;
+  }
+  const partial = parsed as Partial<BotConfig>;
+
   {
     // Normalize/sanitize guestMode on load. The WRITE path (POST /api/bot/settings)
     // sanitizes too, but a hand-edited/legacy/corrupt config.json reaches the gate