From 94ddc8bedfb3636f57193839fa59ce9306c35a68 Mon Sep 17 00:00:00 2001
From: Quixos Development Agent 01f26965-84fa-4a79-8069-725682c13065
 <01f26965-84fa-4a79-8069-725682c13065@agents.gitea.internal.quixos.org>
Date: Sat, 31 Oct 2026 14:25:02 +0000
Subject: [PATCH 1/2] Expose bounded post-build Source Check failures to
 authors (#641)

---
 src/execution-world/metadata.ts | 20 +++++++++++++++-----
 1 file changed, 15 insertions(+), 5 deletions(-)

diff --git a/src/execution-world/metadata.ts b/src/execution-world/metadata.ts
index a06e35c..c76c5ec 100644
--- a/src/execution-world/metadata.ts
+++ b/src/execution-world/metadata.ts
@@ -1,6 +1,13 @@
 import { constants } from "node:fs";
 import { open } from "node:fs/promises";
 
+const admissionFailure = (
+  code: string,
+  kind: "file-bytes" | "total-bytes" | "owner-bytes" | "candidates",
+  measured: number,
+  limit: number,
+) => Object.assign(Error(code), { metadataAdmission: { kind, measured, limit } });
+
 /** Admission estimates, not a hard V8 heap limit. A process/cgroup ceiling is
  * still required. Charge input, parse trees and derived indexes before reading
  * or parsing. Each live candidate retains its reservation until explicit close. */
@@ -27,7 +34,8 @@ export class CandidateMetadataBudget {
   }
   acquire(owner: string) {
     if (!owner || owner.length > 4096) throw Error("INVALID_CANDIDATE_METADATA_OWNER");
-    if (this.scopes >= this.limits.candidates) throw Error("CANDIDATE_METADATA_LIMIT");
+    if (this.scopes >= this.limits.candidates)
+      throw admissionFailure("CANDIDATE_METADATA_LIMIT", "candidates", this.scopes + 1, this.limits.candidates);
     this.scopes++;
     let bytes = 0,
       closed = false;
@@ -35,8 +43,10 @@ export class CandidateMetadataBudget {
       if (closed) throw Error("CANDIDATE_METADATA_CLOSED");
       if (!Number.isSafeInteger(amount) || amount < 0) throw Error("INVALID_CANDIDATE_METADATA_CHARGE");
       const owned = this.owners.get(owner) ?? 0;
-      if (this.bytes + amount > this.limits.bytes || owned + amount > this.limits.ownerBytes)
-        throw Error("CANDIDATE_METADATA_LIMIT");
+      if (this.bytes + amount > this.limits.bytes)
+        throw admissionFailure("CANDIDATE_METADATA_LIMIT", "total-bytes", this.bytes + amount, this.limits.bytes);
+      if (owned + amount > this.limits.ownerBytes)
+        throw admissionFailure("CANDIDATE_METADATA_LIMIT", "owner-bytes", owned + amount, this.limits.ownerBytes);
       bytes += amount;
       this.bytes += amount;
       this.owners.set(owner, owned + amount);
@@ -116,8 +126,8 @@ export async function readCandidateMetadata(
   let releaseInput: (() => void) | undefined;
   try {
     const stat = await handle.stat();
-    if (!stat.isFile() || !Number.isSafeInteger(stat.size) || stat.size > limit)
-      throw Error("CANDIDATE_METADATA_FILE_LIMIT");
+    if (!stat.isFile() || !Number.isSafeInteger(stat.size)) throw Error("CANDIDATE_METADATA_FILE_LIMIT");
+    if (stat.size > limit) throw admissionFailure("CANDIDATE_METADATA_FILE_LIMIT", "file-bytes", stat.size, limit);
     // Reserve the input buffer and UTF-16 decoding before allocating either.
     releaseInput = scope.reserve((stat.size + 1) * 3);
     const bytes = Buffer.alloc(stat.size + 1);

From 7545f7392d171aa73f1decb6296f9f42601d00e6 Mon Sep 17 00:00:00 2001
From: Quixos Development Agent 01f26965-84fa-4a79-8069-725682c13065
 <01f26965-84fa-4a79-8069-725682c13065@agents.gitea.internal.quixos.org>
Date: Sat, 31 Oct 2026 14:37:36 +0000
Subject: [PATCH 2/2] Preserve authorized cold-load browser refusals and
 private aggregate metadata usage (#641)

---
 src/execution-world/metadata.ts | 17 +++++------------
 1 file changed, 5 insertions(+), 12 deletions(-)

diff --git a/src/execution-world/metadata.ts b/src/execution-world/metadata.ts
index c76c5ec..547d99e 100644
--- a/src/execution-world/metadata.ts
+++ b/src/execution-world/metadata.ts
@@ -1,12 +1,8 @@
 import { constants } from "node:fs";
 import { open } from "node:fs/promises";
 
-const admissionFailure = (
-  code: string,
-  kind: "file-bytes" | "total-bytes" | "owner-bytes" | "candidates",
-  measured: number,
-  limit: number,
-) => Object.assign(Error(code), { metadataAdmission: { kind, measured, limit } });
+const admissionFailure = (code: string, kind: "file-bytes", measured: number, limit: number) =>
+  Object.assign(Error(code), { metadataAdmission: { kind, measured, limit } });
 
 /** Admission estimates, not a hard V8 heap limit. A process/cgroup ceiling is
  * still required. Charge input, parse trees and derived indexes before reading
@@ -34,8 +30,7 @@ export class CandidateMetadataBudget {
   }
   acquire(owner: string) {
     if (!owner || owner.length > 4096) throw Error("INVALID_CANDIDATE_METADATA_OWNER");
-    if (this.scopes >= this.limits.candidates)
-      throw admissionFailure("CANDIDATE_METADATA_LIMIT", "candidates", this.scopes + 1, this.limits.candidates);
+    if (this.scopes >= this.limits.candidates) throw Error("CANDIDATE_METADATA_LIMIT");
     this.scopes++;
     let bytes = 0,
       closed = false;
@@ -43,10 +38,8 @@ export class CandidateMetadataBudget {
       if (closed) throw Error("CANDIDATE_METADATA_CLOSED");
       if (!Number.isSafeInteger(amount) || amount < 0) throw Error("INVALID_CANDIDATE_METADATA_CHARGE");
       const owned = this.owners.get(owner) ?? 0;
-      if (this.bytes + amount > this.limits.bytes)
-        throw admissionFailure("CANDIDATE_METADATA_LIMIT", "total-bytes", this.bytes + amount, this.limits.bytes);
-      if (owned + amount > this.limits.ownerBytes)
-        throw admissionFailure("CANDIDATE_METADATA_LIMIT", "owner-bytes", owned + amount, this.limits.ownerBytes);
+      if (this.bytes + amount > this.limits.bytes || owned + amount > this.limits.ownerBytes)
+        throw Error("CANDIDATE_METADATA_LIMIT");
       bytes += amount;
       this.bytes += amount;
       this.owners.set(owner, owned + amount);