[wshallwshall]

Batch 210 follow-up from a vault re-read, decided by the batch 210 Manager on 2026-10-12. It gets its own PR because it changes a security control: the SVGZ inflate.

Merge danger

Reversible: yes -- a revert undoes it all.

Blast radius: messagefoundry/api/svg_sanitize.py (_gunzip_bounded, _vet_gzip), messagefoundry/parsing/_bounded_inflate.py (docstring), messagefoundry/transports/file.py (one build-time WARNING), docs/DANGEROUS-FUNCTIONALITY.md, samples/ech-sidecar/README.md, two changelog fragments, and tests.

Behaviour changes:

• An SVGZ attachment runs a discarding trial pass before the pass that keeps the document. An over-cap body is refused with no kept output. Small SVGZ is inflated twice, the same trial-pass cost the codec already accepts.
• A File connector with decompress set and max_decompressed_bytes off (0, None or "0") logs one WARNING at build, naming the connection and the setting, never a value. Off without decompress logs nothing, because the cap is never read then (Manager decision).
• The ECH sidecar contract gains a request-framing rule.

Evidence

• Before: the SVGZ inflate bounded only during its kept pass, and the module never called the shared bounded-inflate loop. A File byte cap turned off was silent.
• After:
  • Spy tests on bounded_inflate show a 40 MiB SVG refused with no keep_output=True call. With the bounds shrunk, an SVGZ at exactly the bound renders and one byte over is refused with no kept pass. Both spy tests fail on main.
  • A control shows a body whose head is only noise is still cleared by its first content byte.
  • Zero, None and "0" each warn exactly once; a positive cap, the default and off without decompress do not warn. The three warn cases fail on main.

Builder report (condensed). Branch b210-1129-svgz-cap, head 01a2e64d6ab4add670d611aa26282fb9066b5743, rebased onto main eb0674afb4.

• Commits:
  • 91d351f46d: SVGZ trial pass and the File cap warning (fix(verify): the self smoke passed on a message the config would have dropped (BACKLOG #1707) #1129).
  • 01a2e64d6a: the ECH sidecar framing clause (fix(webconsole): bind the user-update lane to an action-bound step-up (BACKLOG #1737) #1125), linking the DEPLOYMENT.md front-proxy section and the CONFIGURATION.md forward-proxy rule.
• Checks:
  • ruff, ruff format, four mypy legs.
  • pytest: 2639 passed on the original base; after the review fix and rebase, test_svg_sanitize, test_compression and name-run 1405 passed, and the transports subset 28 passed. The doc tests touching the changed docs passed.
  • Not run: the full suite.
• QA: code-review xhigh on the branch diff before push found no correctness defect. Two non-defect fixes were folded in: a stale _MAX_GZIP_MEMBERS comment, and a decompressor built and discarded per walk. Three were declined: the double inflate of small SVGZ, which keeps the no-kept-call property; the extra full inflate for large admitted SVGZ; and the member-join copy.
• Proposed banners: fix(verify): the self smoke passed on a message the config would have dropped (BACKLOG #1707) #1129 PROGRESS -- the SVGZ attachment inflate runs a discarding trial pass before it keeps anything, and a disabled File byte cap warns at build. fix(webconsole): bind the user-update lane to an action-bound step-up (BACKLOG #1737) #1125 PROGRESS -- the ECH sidecar contract states request framing.

[wshallwshall]

QA (BACKLOG #1129/#1125, Builder line): code-review skill xhigh on the branch diff against origin/main before the push, applying docs/REVIEW-STANDARDS.md: no correctness defect (old and new SVGZ behaviour agree; warning wired correctly; anchors resolve; no trailers); 5 non-defect findings, 2 fixed and folded in before the push (stale _MAX_GZIP_MEMBERS comment; per-walk decompressor), 3 declined with reasons in the PR body.

[wshallwshall]

Lander: enqueueing at pinned head 01a2e64. Picked up from the batch 210 Manager's 18:15Z mail.

Review proof: the QA line (code-review skill at xhigh on the whole branch diff, applying docs/REVIEW-STANDARDS.md; no correctness defect; five non-defect findings, two fixed before the push and three declined with reasons in the PR body: the double inflate of small SVGZ, the extra full inflate for large admitted SVGZ, and the member-join copy). The declined three are cost, not behaviour, and none weakens the control. All 9 required contexts are green at this head; the one non-green check of 53 is ASVS anchors (advisory), which is not required. Merge test onto main a8b4a75 plus the queued heads of 2285 and 2286: git merge-tree exit 0, self-merge control 0.