Timeline

Keep the first pass metadata-only: typeof and direct length(BLOB) retain SQLite OP_Column length/type flags. Reject other storage classes without reading content. A CAST or substr in this pass can materialize a whole value before its stored-byte budget, so prefix reads now follow the complete stored-total proof.

Charge prefix reads and potential SQLite bytes separately; prove aggregate declared inflation before full driver payload reads. Both-driver EXPLAIN regressions reject full-content OP_Column operations in metadata preflight. check-in: d5eb1f3a5a user: [email protected] tags: feat/submanifest-reader, main, trunk

A BLOB-affinity column can hold TEXT; SQLite length(TEXT) stops at NUL and is not a byte-allocation bound. Cast content to BLOB in metadata and guarded payload reads so malformed dynamically typed values cannot bypass stored-byte preflight.

The adversarial TEXT fixture previously read a one-MiB payload and reserved sixteen MiB of inflation before rejecting corruption. Both drivers now reject before any payload read or inflation reservation. check-in: a08e7e9d71 user: [email protected] tags: feat/submanifest-reader, main, trunk

Never share RID-keyed cache state across prepared service transactions: protocol-fatal responses can roll back after expansion while returning a nil Go error. Reject canceled contexts before acquiring a transaction and propagate observer cancellation instead of serving densely.

Reproduce rollback, RID reuse and incorrect content under the replacement hash; verify cancellation and deadline responses do no dense work. Exercise newly shunned payload and basis suppression after prepared-proof invalidation. check-in: 632e7349e6 user: [email protected] tags: feat/submanifest-reader, main, trunk

Use metadata preflight and fixed-size inflation for ordinary reference discovery too. Bound artifacts, parser cards, stored bytes and declared expansions before payload and parser allocations. Preserve unknown retention for corrupt compression.

Retain only classification fields and structural identities, copying kept tokens so discarded wiki/forum bodies, cluster inventories and metadata cannot be pinned. Compare empty and large-body fixtures and reject oversized expansion reservations. check-in: a3c6ddef9a user: [email protected] tags: feat/submanifest-reader, main, trunk

Match Fossil 2.28 send_file and send_compressed_file payload gates. A source-first clone must expand a dependent when its stored basis is shunned rather than forwarding that withheld basis. Preserve private notices, authorization and SHA3 refusal ordering.

Exercise real encoded requests through the ordinary handler and Fossil HTTP oracle. Canonical compressed clone can name a shunned public basis without sending it; this server expands instead to preserve its source-first guarantee. check-in: a402aa5cc6 user: [email protected] tags: feat/submanifest-reader, main, trunk

Prepare verified raw references under explicit byte, card, artifact and index-slot budgets before allocating payload expansions. Use request-local cone spans over a cone-independent range index to skip excluded RID gaps without empty clone continuation pages.

Keep this internal: selected-content reconstruction still uses dense allocation behavior, ordinary pull still scans inventory, and retaining every tree node is not proof of tree-minimal emission. No public wrapper, capability grammar or client continuation changes. check-in: 065f76e22f user: [email protected] tags: feat/submanifest-reader, main, trunk

Separate immutable cone-independent raw facts from request-local classification. Validate the observer connection, database generation and post-preparation file identity under a bound transaction. Unsupported, stale and mutating requests use dense fallback without cold cone discovery while preserving sparse-origin refusal.

Exercise real clone and pull over excluded candidates, same-request writes, observer lifecycle and durable cluster advertisements across restart. Classification and inventory remain whole-store work; this does not close sparse per-round resource bounds or expose a public lifecycle API. check-in: 63e0b940eb user: [email protected] tags: feat/submanifest-reader, main, trunk