fix: read --shelf-tags before the catalog swap

load_shelf_skus ran after write_catalog, so a missing path or a malformed list
escaped as a raw traceback over a catalog that had already been replaced. It is
now read inside the try, before anything is written, so both cases fail with the
tool's own message and the destination is untouched.

Adds BadShelfListFailsBeforeTheSwapTests, which asserts the clean message and
that the output path does not exist. Re-injecting the ordering fails both tests
with the raw FileNotFoundError. Suite 274 -> 276.

recognization/code/rebuild_catalog.py

@@ -484,6 +484,10 @@ def main(argv: Optional[Sequence[str]] = None) -> int:
                 print("eval-session check cannot cover image(s) with no capture_session_id: "
                       + ", ".join(unlabelled), file=sys.stderr)
 
+        # Read the shelf list before anything is written: a bad path or a
+        # malformed list must fail here, with the tool's own message, rather
+        # than after write_catalog has already replaced the catalog.
+        shelf_skus = load_shelf_skus(args.shelf_tags)
         engine = build_ocr_engine(args.ocr)
         ocr_engine = engine if engine.available() else None
         if ocr_engine is None:
@@ -505,8 +509,7 @@ def main(argv: Optional[Sequence[str]] = None) -> int:
     # and vetoes it from the CSV alone, so it is a coverage gap, not a refusal.
     text_only = sorted(set(names) - set(kept))
     siblings = text_discriminated_siblings(kept, args.source, names)
-    small = below_pyramid_floor(kept, args.source)
-    verdict = live_ready_verdict(kept, names, load_shelf_skus(args.shelf_tags))
+    verdict = live_ready_verdict(kept, names, shelf_skus)
     report = {
         "source": args.source,
         "output": args.output,

recognization/code/test_rebuild_catalog.py

@@ -142,5 +142,47 @@ class ShelfTagListTests(unittest.TestCase):
             load_shelf_skus(self.write('{"sku_a": 1}'))
 
 
+class BadShelfListFailsBeforeTheSwapTests(unittest.TestCase):
+    """A bad --shelf-tags must not leave a replaced catalog behind.
+
+    The list is read before write_catalog runs, so a malformed file or a missing
+    path fails with the tool's own message and the destination is untouched. Read
+    after the swap, the same error would escape as a traceback over a catalog
+    that had already been replaced.
+    """
+
+    def make_source(self):
+        root = tempfile.mkdtemp(prefix="guard-src-")
+        cv2.imwrite(os.path.join(root, "sku_x1.jpg"), artwork())
+        with open(os.path.join(root, "stock.csv"), "w", encoding="utf-8") as handle:
+            handle.write("SKU_ID,product_name,price,number_in,number_out,number_on\n")
+            handle.write("sku_x1,Alpha,100,1,0,1\n")
+        return root
+
+    def run_tool(self, shelf_tags):
+        from rebuild_catalog import main
+
+        source = self.make_source()
+        output = os.path.join(tempfile.mkdtemp(prefix="guard-out-"), "catalog")
+        with self.assertRaises(SystemExit) as caught:
+            main(["--source", source, "--output", output, "--csv",
+                  os.path.join(source, "stock.csv"), "--min-views", "1",
+                  "--ocr", "none", "--shelf-tags", shelf_tags])
+        return str(caught.exception), output
+
+    def test_a_malformed_list_fails_cleanly_and_writes_nothing(self):
+        path = os.path.join(tempfile.mkdtemp(prefix="bad-tags-"), "tags.json")
+        with open(path, "w", encoding="utf-8") as handle:
+            handle.write('{"sku_x1": 1}')
+        message, output = self.run_tool(path)
+        self.assertIn("expected a JSON list", message)
+        self.assertFalse(os.path.exists(output), "the catalog was replaced before the check")
+
+    def test_a_missing_list_fails_cleanly_and_writes_nothing(self):
+        message, output = self.run_tool("/tmp/definitely-not-a-shelf-list.json")
+        self.assertIn("No such file", message)
+        self.assertFalse(os.path.exists(output), "the catalog was replaced before the check")
+
+
 if __name__ == "__main__":
     unittest.main()