[anotherjulien]

Move all 65 review TSV tables (243,550,626 payload bytes) to Git LFS and prevent new oversized ordinary Git blobs. The updated branch includes current main at 7102cffdcee8f3fd0f66aaca956472143508133f, including the ten WHO 25 oracle fixtures added by PR #49.

All 65 paths, payload lengths and SHA-256 hashes match their original bytes on that main commit. The large deletion counts represent pointer conversion; hydrated table contents are unchanged. All other repository content matches main except the six storage-policy/configuration files. The entire KB, source material, Device definitions and evidence packages are unchanged.

Storage guard

• Reject ordinary Git blobs larger than 5 MiB in the staged index and committed CI trees.
• Require canonical LFS pointers for every review TSV, including nested fixtures.
• Inspect new objects across the comparison history, catching large files that were added and then deleted.
• Retain the same nine existing large KB paths through exact path/blob exceptions. Their baseline is pinned to current main; seven fingerprints were refreshed for the KB updates already merged in docs(who-25): document gateway compatibility and hardware boundaries #49. Later changed bytes or another path are not exempt. Baseline changes remain policy changes requiring review.
• Add the Git storage policy CI job and document local checking, hydration and required-check configuration. The guard reads Git objects without downloading LFS payloads.

Historical blobs remain reachable. No history, main branch or release tag is rewritten, and no release is created.

Validation

• Passed all 11 real-Git storage regression tests and both staged-index and committed history-range storage checks against current main.
• Verified all 65 original payload hashes/lengths, canonical staged pointers, unchanged KB/source/evidence content, unchanged policy code and existing release-tag references. Git LFS integrity passed.
• Passed all nine WHO 25 regression tests against the hydrated fixtures, all 55 evidence acceptance tests, all five evidence packages, and mechanical ESG/ECV checks with zero objective failures.
• The KB and build inputs are byte-identical to the fully validated PR docs(who-25): document gateway compatibility and hardware boundaries #49 tree, so no new catalogue generation was needed locally. Fresh hosted CI runs the complete suite against this updated candidate.

Fresh exact-commit canonical-source, private catalogue, Device completeness and catalogue regressions passed. The success status was published and verified on GitHub for this candidate. Hosted CI results for the refreshed branch are pending; the earlier 16 October results apply only to the original commit.

Validated candidate: 96cdd15c1a1e1f3a89cf6a1a5b7929b3b3bef0ae. Merged into main as 88d61b3f3bf1456a708b62b0e3de6ed2242960ee on 2026-10-22. Storage, mechanical and catalogue checks had passed; broader KB/privacy CI was still running at merge time. Fresh catalogue validation was also published and verified for the main merge commit.