the-custodian/docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1

Receive scanner: bounded small-input source correction

Published owner source: railiance-forge ea65606c1298db782f721f9443bafeb03cdef138, six files, ordinary hooks and primary projection verified. Existing unrelated WORK-RECORDS bytes/index were preserved. FORGE-WP-0010-T01 is done; T02 remains progress and T03 waits for native admission. Finished FORGE-WP-0006 and unpromoted FORGE-WP-0008 retain their original scopes.

The unchanged adapter reproduced the refused Custodian publication: after 90.06 seconds, 94 of 141 introduced objects were scanned and the result was unverified. It starts Gitleaks once for every object. The existing Repo Manager profile provides the correction: batch up to 64 inputs of at most 4096 bytes; retain the original stdin fragment path for larger inputs. Scanner 8.30.1, default rules, object/ref coverage, all size/count limits and the 90-second deadline are unchanged.

The final production source scans all 141 objects and one ref in 52.53 seconds. The full suite passes 49 leaf cases; five additional boundary cases bring the distinct combined coverage to 54, with zero skips. It covers actual receive-pack quarantine, historical/merge/tag/ref content, suppression attempts and limits, binary inputs, the 4096-byte boundary, larger-input stdin behavior, strict diagnostic/report handling, receiver loss, reader termination and identity-checked cleanup. Separate actual helper processes refuse unavailable and ordinary-disk storage. Raw fixture inputs exist only in private namespace tmpfs or process memory.

The original repeated-character token fixture failed its reference check: the existing stdin scanner did not detect it. No directory parity claim is made for that attempt. The fixture now generates a high-entropy synthetic value. The failed attempt is retained. The first missing-storage harness accidentally retained bwrap's default tmpfs; a later file-over-directory mount was rejected by bwrap itself. Neither counts as storage-refusal proof. The corrected unavailable-root and ordinary-disk checks both return the adapter's fixed volatile-storage-unavailable refusal. Early read-only preflight failures and syntax/setup refinements also remain visible.

Read-only native inspection verifies the intended dual-stack node, Linux 6.8, UID 1000, actual tmpfs, unchanged installed binary/scanner hashes and 166 identical installed hook fragments. It corrects the assumed repository path to /data/git/gitea-repositories. The old Helm release predates intervening live changes, so it must not be replayed for this correction.

native-preparation/ contains two proposed public Apps source files, the immutable new hook ConfigMap and a conditional Deployment patch. Only the existing startup guard command and hook ConfigMap reference change. Reused Forgejo patch helpers prove local forward/inverse restoration and exact Deployment/ConfigMap server dry runs. This is preparation, not an activation proposal ready for approval: the sealed activation/recovery executor, final drift/resource preflight, independent owner/package admission and founder go remain necessary. No native artifact, hook, Deployment, credential, policy, image or database changed.

Key evidence: combined-tests.json, scan-r2.json, build-provenance.json, native-hook-inventory.json, native-preparation/preparation.json, publication-commit.json and projection.json. Baseline reproduction is in ../receive-scanner-budget-r1/. The binary stays outside Git. Source postimages and the exact patch are retained here; owner Git is authoritative.

CUST-WP-0080 remains 2/6 coordinator tasks done with 0/16 complete native target gates closed. G01–G13 and all 116 ledger entries remain required. Latest root evidence is still unpublished remotely because the old live scanner is unchanged.