diff --git a/CHANGELOG.md b/CHANGELOG.md
index 64452693..8a98db2e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,14 +1,10 @@
 # Changelog
 ## [Unreleased]
 
-### Changed
-
-- Test coverage is enforced at 100% via `fail_under` in `[tool.coverage.report]`.
-
 ### Fixed
 
 - `Store.set_haiku_version` stamps the store's own config into a recreated settings row instead of the process-global `Config`.
-- `check_source_accessible` returns `False` for a URI that fails to parse instead of raising `ValueError`.
+- `check_source_accessible` returns `False` for a URI it cannot resolve (unparseable host, unreadable path) instead of raising and aborting a full rebuild.
 
 ### Removed
 
diff --git a/haiku_rag_slim/haiku/rag/client/documents.py b/haiku_rag_slim/haiku/rag/client/documents.py
index a9698ce5..8cb916e4 100644
--- a/haiku_rag_slim/haiku/rag/client/documents.py
+++ b/haiku_rag_slim/haiku/rag/client/documents.py
@@ -570,7 +570,10 @@ def _extract_pdf_attachments(
             for i in range(attachment_count):
                 att = pdf.get_attachment(i)
                 name = att.get_name()
-                if not name:  # pragma: no cover - pypdfium2 always names them
+                # A malformed PDF can carry an attachment with an empty /F, so
+                # this is real validation on untrusted input — it just needs a
+                # hand-crafted file to reach, which no fixture here produces.
+                if not name:  # pragma: no cover - needs a malformed PDF
                     continue
                 data = bytes(att.get_data())
                 child_uri = f"{parent_uri}#attachment={quote(name, safe='')}"