Advance Blender 5.2 web parity through M12-03D

docs/status/M12-02C.md

@@ -0,0 +1,46 @@
+# M12-02C Status
+
+status: done
+task: enforce MIME, pixel, byte, and compression-ratio budgets before preview decode
+updated: 2026-08-17 America/New_York
+enablingTask: true
+parityStateChange: false
+
+## Scope
+
+The schema 1 pre-decode planner accepts only the M12-02B content identity and an exact
+`ArrayBuffer` payload. It checks the 16 MiB encoded-byte limit before hashing, then binds the
+content SHA-256, declared MIME to the PNG/WebP container header, header dimensions to the identity,
+and dimensions to pixel and RGBA8 decoded-byte budgets. The final gate limits decoded-to-encoded
+compression ratio to 100 before any browser image decoder or decoded allocation is invoked.
+
+PNG dimensions come only from a valid signature and first IHDR header. WebP dimensions come only
+from a size-bound RIFF/WEBP VP8X, VP8L, or VP8 header. Unsupported headers, content drift, and
+dimension drift fail closed; a rejected input does not affect a following valid preview plan.
+
+## Evidence
+
+- `npm --prefix web run test:asset-preview-decode-budget` passed 5/5 M12-02B/C protocol tests.
+- The positive 513-byte Blender-generated PNG plans 64 pixels and 256 decoded RGBA8 bytes without
+  calling a decoder.
+- Eight negative cases cover payload hash/length drift, MIME mismatch, dimension mismatch,
+  over-width/height and decoded-byte budget, compression ratio, encoded-byte budget, and corrupt
+  container signature. The checked-in small preview passes immediately after each rejection.
+- `npm --prefix web run typecheck`, `npm --prefix web run lint`, and `git diff --check` passed.
+
+## Artifact Hashes
+
+- decode protocol: `3d1c491af2503a7a6012541ed43400d680f8e666cc12a54db284aeb6ac18ff63`
+- unit suite: `1a65df86d568ae8defd7cd9242f426ac900d92637eb3bed2cbb4a0fae2e86c20`
+- package commands: `8563916637fc3cb29b53432ae9b80d1dcf6269f2f5c092b595e72c6b0ada55ab`
+- manifest: `934b3ca29d905ad2f5c46f35acff4cf4b9ea291c423fb3aad4afe7e9f10e6244`
+
+## Next Task
+
+`M12-02D`: commit a catalog preview reference only after its content-addressed payload is durably
+written to OPFS.
+
+## Rollback
+
+Remove the preview decode planner, unit suite, M12-02C manifest, package command, and this status
+entry. Restore M12-02C to pending and `nextTask` to M12-02C. No parity ledger rollback is required.