fix: budget subjektiv batches for compact verified Job results (T-704)

docs/design/subjektiv-consolidation-jobs.md

@@ -10,7 +10,10 @@ planned in T-708/T-709 are outside this Backend change.
 
 The existing backlog/byte thresholds and missing/stale/failed surface policy
 remain the launch decision. A Job captures an immutable bounded batch (up to 100
-candidate IDs) plus the Subject store revision. An empty batch is valid for a
+candidate IDs) plus the Subject store revision. Selection also reserves the Job's
+16 KiB result budget, accounting for JSON-escaped IDs appearing in both the batch
+claim and compact verified outcomes. Excess candidates remain staged for a later
+batch. An empty batch is valid for a
 surface-only rebuild. The Backend explicitly binds the Subject and candidate
 batch grant in durable Job intent before Worker execution. No subject-body
 singleton ownership or Session attribution is transferred to the Job.
@@ -49,7 +52,10 @@ structured surface outcome. It does **not** schedule a Worker-owned post-Run tas
 The result call serializes and caches the exact generated outcome for ambiguous
 submission replay. The Backend verifies every batch disposition and the current
 store revision, generation ownership and persisted ready/failed surface fields;
-it enriches the durable result with actual immutable candidate dispositions.
+it enriches the durable result with actual immutable candidate disposition
+summaries (`candidate_id` and `action`). Full reasons, affected revisions and
+source edges remain in the existing immutable receipt store; they are not copied
+into a bounded Job result. Exact replay uses the same verified compact projection.
 Thus confirmed-memory consolidation and surface readiness are separate outcomes.
 A recorded surface failure does not undo Memory. A stale/unfinished/fabricated
 surface cannot be reported completed. Final prose or Idle is never success.

docs/report/2026-10-06-t704-validation.md

@@ -88,3 +88,39 @@ including `server-full-initial-migration-fixtures.log`, `server-full-final.log`,
 `server-subjektiv-final.log`, `server-api-typescript.log`, `runtime-no-default.log`
 and `runtime-fs-only.log`. The durable report records their concrete results;
 local log paths are not a substitute for the published immutable MR source.
+
+## Bounded-result follow-up after interrupted review
+
+The first implementation was published as `d12cdc91`. Human interruption ended
+its first pending Reviewer before a verdict. On retry, the parent reread Ticket,
+MR, clean Workdir and provider source. Before the replacement Reviewer verdict,
+parent inspection identified a concrete result-budget defect: copying full
+resolution records for a 100-ID batch could exceed the common 16 KiB result bound,
+even when candidate decisions and surface generation had actually completed.
+That pending old-source review was stopped rather than treated as approval.
+
+The follow-up keeps full immutable receipts/reasons/revision/source edges in their
+existing store and persists only verified `{candidate_id, action}` summaries in
+the Job result. Batch selection conservatively budgets the complete result,
+including JSON-escaped IDs in both claim and outcome, plus a reserved bounded
+Subject/surface envelope. Candidates beyond that byte-bound stay staged. The
+common result bound is not enlarged or bypassed.
+
+A new narrow fixture closes a batch of long/escaped IDs with individual receipt
+reasons larger than 16 KiB, successfully accepts a result within the default
+bound, verifies exact replay and remaining candidates, and starts a disjoint
+followup only after cleanup. A maximum escaped-ID budget unit test proves the
+complete projected result fits, not merely its raw input IDs.
+
+Follow-up evidence (same bounded jobs setting):
+- `cargo test -p yoi-workspace-server --lib result_budget`: **2 passed**.
+- Root `cargo check`: **passed** (`fix-root-check.log`).
+- Full `cargo test -p yoi-workspace-server -- --test-threads=4`:
+  **639 library + 11 binary passed**, no skips (`fix-server-full.log`).
+- Format and `git diff --check HEAD`: **passed**.
+
+Only Server logic, Server fixtures and documentation changed in this follow-up;
+all other changed-crate/generated/Worker/Runtime results above remain applicable.
+The new commit is published on the same source selector of the existing MR and
+requires a fresh exact-source review. No target ref, tags or unrelated refs are
+pushed, and no merge/integration is performed by the Coder.