# M12-04F Status

status: done
task: enforce archive entry, total, count, directory-depth, and filename-length budgets
updated: 2026-08-18 America/New_York
enablingTask: false
parityStateChange: false

## Scope

The production `asset-library-io` parser now enforces the existing compressed/uncompressed per-entry
and total-byte budgets together with a 100,000-entry limit, 64 directory levels, and a 255-byte UTF-8
filename limit. Compression-ratio and declared source-byte checks remain fail-closed in the same path.
Budget checks happen while parsing metadata, before any payload allocation or extraction.

## Evidence

- `npm --prefix web run test:library-archive-budget` passed 4/4 unit tests.
- Exact boundary cases for entry bytes, total bytes, entry count, directory depth, and Unicode filename
  bytes are accepted; one-byte overflows return stable budget errors.
- Existing compression-ratio, duplicate/prefix, and declared source-byte checks remain covered.

## Artifact Hashes

- parent manifest: `d935392fb23c2e6ad651fb6ad6cb67f8ead3d562e626bb230d2febd9d7f03b1c`
- protocol: `e02efa79668f4ee10b1c28786709eba2c93691b28ccf1155c6213dda12f59a8f`
- unit: `b0d8356c6fb348d98e28ce220052845a29439b34b3c976b21a4dbf370ea19593`
- package commands: `cfb232baa494ff59f6c8d65514a08c86332ee9354350b2a0392b6f932a7ee42c`

## Next Task

`M12-04G`: reject compression-ratio, overlapping range, duplicate path, and file/directory prefix conflicts.

## Rollback

Remove the budget checks, unit suite, manifest, package command, and this status entry. Restore M12-04E
to pending and move the machine queue back to `M12-04F`. No parity ledger rollback is required.