Repository navigation
Files Changed: reserve cumulative root receipt budgets #1103
Description
Important
Problem — Root receipt budgets are currently checked only per publish, allowing cumulative receipt and metadata limits to be exceeded.
Approach — Reserve root-wide receipt and metadata capacity transactionally before any local work begins.
Scope — in: cumulative receipt and metadata accounting, deterministic preflight reservation, rollback · out: evidence files, retention, compatibility.
Acceptance Criteria
- A known local operation exceeding max_receipts or max_metadata_bytes is refused before storage or filesystem work.
- Sequential operations cannot exceed a root's cumulative receipt or metadata budget.
- Failed or aborted preparation releases its reservation without consuming capacity.
Testing Decisions
Extend receipt storage tests with sequential boundary, concurrent reservation, rollback, and restart cases.
Key Decisions
Capacity is root-owned and reservation is transactional; no local writer silently becomes untracked.
Constraints & Invariants
Ledger infrastructure emits no session-visible receipt.
Activity