# M12-02C Status

status: done
task: enforce MIME, pixel, byte, and compression-ratio budgets before preview decode
updated: 2026-08-17 America/New_York
enablingTask: true
parityStateChange: false

## Scope

The schema 1 pre-decode planner accepts only the M12-02B content identity and an exact
`ArrayBuffer` payload. It checks the 16 MiB encoded-byte limit before hashing, then binds the
content SHA-256, declared MIME to the PNG/WebP container header, header dimensions to the identity,
and dimensions to pixel and RGBA8 decoded-byte budgets. The final gate limits decoded-to-encoded
compression ratio to 100 before any browser image decoder or decoded allocation is invoked.

PNG dimensions come only from a valid signature and first IHDR header. WebP dimensions come only
from a size-bound RIFF/WEBP VP8X, VP8L, or VP8 header. Unsupported headers, content drift, and
dimension drift fail closed; a rejected input does not affect a following valid preview plan.

## Evidence

- `npm --prefix web run test:asset-preview-decode-budget` passed 5/5 M12-02B/C protocol tests.
- The positive 513-byte Blender-generated PNG plans 64 pixels and 256 decoded RGBA8 bytes without
  calling a decoder.
- Eight negative cases cover payload hash/length drift, MIME mismatch, dimension mismatch,
  over-width/height and decoded-byte budget, compression ratio, encoded-byte budget, and corrupt
  container signature. The checked-in small preview passes immediately after each rejection.
- `npm --prefix web run typecheck`, `npm --prefix web run lint`, and `git diff --check` passed.

## Artifact Hashes

- decode protocol: `3d1c491af2503a7a6012541ed43400d680f8e666cc12a54db284aeb6ac18ff63`
- unit suite: `1a65df86d568ae8defd7cd9242f426ac900d92637eb3bed2cbb4a0fae2e86c20`
- package commands: `8563916637fc3cb29b53432ae9b80d1dcf6269f2f5c092b595e72c6b0ada55ab`
- manifest: `934b3ca29d905ad2f5c46f35acff4cf4b9ea291c423fb3aad4afe7e9f10e6244`

## Next Task

`M12-02D`: commit a catalog preview reference only after its content-addressed payload is durably
written to OPFS.

## Rollback

Remove the preview decode planner, unit suite, M12-02C manifest, package command, and this status
entry. Restore M12-02C to pending and `nextTask` to M12-02C. No parity ledger rollback is required.