[ScriptedAlchemy]

Draft · Owner merge hold

This integration includes decision-model changes. Keep it in draft under the owner’s merge hold. Owner direction

After #4803 merged, ead18018 reconciled the SQLite lock regression with master. The native macOS test verified committed row visibility and independent writer exclusion across the four WAL/rollback and snapshot/immutable reader combinations. The owner’s draft and merge hold remain in place.

Consolidated application follow-up

The prior application integration #4772 merged into master on November 5, 2026. This is the single new application integration PR for subsequent issue fixes. Add focused commits here rather than opening separate issue PRs/CI lanes; preserve concurrent changes with exact-head, nonforce updates.

Included now

• Refs explore(kev): qualify decision replacements against current runtime inputs and canonical Scout evidence #4535: The HTTP evaluation runner previously read an entire untrusted decision response without a size bound. A model server could return an enormous declared or indefinite streamed JSON body, consuming unbounded memory before any answer validation.
• Bound response reads to 1 MiB plus one refusal byte, reject a declared oversize or invalid Content-Length before reading, and also reject an oversized body with no length header.
• Add a real loopback HTTP regression covering all three refusal modes. Existing small-answer transport tests remain in place.

Other commits in this draft cover bounded projection rebuilds, sealed graph verification and retirement, cold-store cursors, SQLite reader lifetimes, and the corresponding storage documentation.

Verification and gates

At 78c610e1d1, the branch incorporates master c231fb7219 and preserves both scheduler regressions in the previously conflicting fixture. Native macOS Bazel passed 46 scheduler cases, 72 HTTP runner cases, and 29 scoring cases. The HTTP suite includes real loopback responses with a declared over-limit body and an over-limit stream. Full hosted Linux run.

At 6c0cf6f77f, the branch also incorporates master be2e1349c6 and resolves the overlapping projection test imports. All 502 native macOS global database cases passed, including populated projection cleanup, foreign ownership, staged outputs and rollback. Strict Clippy passed for both library and tests. Full hosted Linux and targeted Windows verification.

On the same head all 12 cold-store tests passed, including the production cursor run with an admitted owner, a substituted symlink and a real-directory replacement. The foreign cursor bytes and directory entries survived both refusals.

This is partial progress on #4535: canonical Scout evidence export, independent labels, actual Kev inference, runtime parity and model qualification are still outstanding. Keep #4535 open.

Independent model evidence and review remain outstanding.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 992c5ac

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[ScriptedAlchemy]

Master-merge hold under the owner's latest instruction: “Merge any passing pr after you review and fix them. Don’t merge the decision model ones like kev.”

This integration still contains decision-model/HTTP-evaluation changes (including current head 9cf67ec), so it is excluded from merging into master even if CI becomes green. Review and corrective commits remain authorized. Preserve all contributor work; do not force-rewrite, remove excluded changes, reopen superseded source PRs, or create a competing application lane to bypass this hold.

Both existing TraceDecay maintenance tasks now carry this exclusion with their schedules unchanged. Ready-for-review status is not merge authorization. No merge or code change was performed by this review pass.