Hare/yoi
1
1
Fork 0
Code Actions Packages Releases Activity

fix: keep memory reads globally bounded

Browse Source
This commit is contained in:
Hare
2026-10-02 09:52:32 +09:00
parent 860c34b8da
commit 8f8c2676b4
5 changed files with 593 additions and 96 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/design/subjektiv-store.md
+15 -11
View File
@@ -184,17 +184,21 @@ page members.
Read accepts a positive exact revision or resolves the current revision once. A
missing historical revision never falls back to current. Markdown pagination is
line-based (default 200, maximum 1000) with an additional 16 KiB UTF-8 response
budget. It reports `body_truncated`, `body_next_offset`, and
`body_next_byte_offset`; an oversized single line resumes from the returned byte
boundary within that same line. Every continuation offset must also supply the exact
revision returned by the first page, so a current-revision change cannot mix body
versions. Provenance uses a separate immutable-revision-bound cursor and returns one
candidate/derivation reference per page. A staged candidate contains at most 10
evidence records and 10 source references, all returned together under a hard 40 KiB
serialized budget for the expanded candidate array; displayed anchor text is capped
at 64 UTF-8 bytes. Every staging path rejects larger anchor sets, so accepted
provenance is never made unreachable. Candidate evidence is the bounded
line-based (default 200, maximum 1000) with a preliminary 16 KiB UTF-8 body
cap and a global 56 KiB budget over the exact pretty-serialized model-visible
response. JSON escaping, provenance, and metadata therefore reduce the current
body page before the Worker content ceiling is reached. It reports
`body_truncated`, `body_next_offset`, and `body_next_byte_offset`; an oversized
or escape-heavy single line resumes from the returned UTF-8 byte boundary within
that same line. Every continuation offset must also supply the exact revision
returned by the first page, so a current-revision change cannot mix body versions.
Provenance uses a separate immutable-revision-bound cursor and returns one
candidate/derivation reference per page. New staged candidates contain at most 10
evidence records and 10 source references; read pages project at most two of each,
with displayed anchor text capped at 64 UTF-8 bytes and nested offsets carried by
the ordinary evidence cursor. Compatible candidates persisted before the admission
cap remain readable across as many evidence pages as needed, while every current
staging path rejects new larger anchor sets. Candidate evidence is the bounded
host-resolved anchor saved in staging; raw Session bodies are not copied
into Memory responses. Resolved, retracted, and historical revisions remain
addressable by ID.