Repair file, output, and native execution limits

.design/a3-app-protocol.md

@@ -192,7 +192,7 @@ refinement tests.
   transport behavior, peer identity, durable storage, scheduling fairness, and actual daemon/process
   effects. Those remain explicit G0/C0/C2 or observation boundaries.
 - **A3-R051 — Maintainable decomposition.** `lib.rs` is a small documented facade. Production files
-  target 400 lines and may not exceed 700 without a specific reviewed architecture exception. No
+  may not exceed 500 lines without a specific reviewed architecture exception. No
   `common`, `helpers`, `manager`, `misc`, or `utils` dumping-ground modules are introduced.
 - **A3-R052 — Production evidence.** Focused ordinary tests, full resource-bounded Gate A,
   Linux/macOS/Windows CI, Foundation, Verus verify/build, and no-cheating checks all pass on the

.design/c2-process-sandbox-backplane.md

@@ -475,7 +475,7 @@ src/refinement.rs
 ```
 
 `lib.rs` files contain crate documentation, module declarations, and intentional re-exports only.
-Files split before the 700-line hard source limit and receive review at the 400-line soft budget.
+Files stay within the 500-line source limit.
 
 ### Public effect boundary
 

.design/c4-tool-system.md

@@ -191,7 +191,7 @@ checks and return evidence without claiming D1 acceptance.
 39. `REF-C4-B1-AUTHORITY-GATE` is discharged by the router authority proof, private constructor/API
     checks, exact receipt fixtures, one-use ledger, and integration tests proving no dispatcher is
     called after malformed, stale, forged, duplicate, or mismatched evidence.
-40. Every crate root is composition-only and at most 80 lines. Source files stay at or below 400
+40. Every crate root is composition-only and at most 80 lines. Source files stay at or below 500
     lines. No generic helper/common modules, catch-all errors, public dependency leakage, unsafe
     code, ignored tests, placeholder success, or reachable unfinished branch is permitted.
 
@@ -279,7 +279,7 @@ peritus-tools-quality/src/
   dispatcher.rs observation.rs render.rs error.rs
 ```
 
-Files are split further before crossing 400 lines. Roots contain module declarations and public
+Files are split further before crossing 500 lines. Roots contain module declarations and public
 re-exports only.
 
 ### Two-phase call lifecycle

.design/c6-context-memory.md

@@ -155,8 +155,8 @@ surfaces must expose consistently:
   read-only accessors. Errors shall be typed, stable, actionable, and comparable in tests.
 - **C6-R052:** Production source shall contain no `unsafe`, reachable placeholder success path,
   `todo!`, ambient I/O, global mutable state, wall-clock lookup, provider call, or effect handle.
-- **C6-R053:** Each crate shall keep the root module below 80 lines, ordinary source files below
-  the 400-line soft limit where practical and below the 700-line hard limit without exception.
+- **C6-R053:** Each crate shall keep the root module below 80 lines, ordinary source files at or below
+  the 500-line limit without exception.
 - **C6-R054:** The crates shall pass formatting, build, all-target/all-feature tests, strict
   Clippy, rustdoc warnings, architecture, ordinary-API audit, focused no-cheating Verus
   verification, and verified release build.

.design/d0-agent-loop.md

@@ -221,8 +221,8 @@ an acceptance decision.
   no model-to-effect authority, bounded counters, capability/exposure gating facts, stable tool
   result ordering, and completion eligibility.
 - **D0-R091:** Public structs shall keep fields private and expose checked constructors/accessors.
-- **D0-R092:** The crate root shall remain below 80 lines. Ordinary source files shall target fewer
-  than 400 lines and must remain below the repository hard limit. Tests shall be split by behavior.
+- **D0-R092:** The crate root shall remain below 80 lines. Ordinary source files shall remain
+  at or below the repository limit of 500 lines. Tests shall be split by behavior.
 - **D0-R093:** D0 shall add formal obligations, proof-impact registration, architecture ownership,
   ordinary-API checks, compatibility fixtures, conformance coverage, crate/root documentation, and
   a detailed changelog entry.

.design/d2-review-engine.md

@@ -169,7 +169,7 @@ shape, state transitions, parallel ownership, and verification evidence are fixe
   or unnecessary architecture/source exception.
 - **D2-R042:** The ordinary Rust API shall execute the same checked bodies after ghost erasure and
   return typed errors. Public fields remain private. `lib.rs` remains a composition/export surface
-  below 80 lines; production Rust files target 400 lines and never exceed 700.
+  below 80 lines; production Rust files stay at or below 500 lines.
 - **D2-R043:** No production dependency may offer provider execution, process/shell execution,
   workspace mutation, approval issuance, or overall acceptance authority.
 

.design/d3-scheduler-collaboration.md

@@ -170,7 +170,7 @@ separately in `.design/e0-actor-orchestrator.md`.
   caller precondition, placeholder, ignored test, or state-machine macro. Ordinary Rust executes
   the same checked bodies after ghost erasure and returns typed errors.
 - **D3-R042:** Public fields remain private. `lib.rs` files are composition/export surfaces below
-  80 lines. Production files target 400 lines and never exceed 700; domain, wire, durability,
+  80 lines. Production files stay at or below 500 lines; domain, wire, durability,
   projection, and tests remain focused modules without generic `manager`/`utils` buckets.
 - **D3-R043:** Neither production crate depends on a provider adapter, process/shell implementation,
   workspace mutator, approval issuer, or acceptance authority.

.design/e0-actor-orchestrator.md

@@ -200,7 +200,7 @@ AcTor delivery loop E0. Both are delivered sequentially by the same goal and mig
 - **E0-R051:** The crate contains no `assume`, `admit`, axiom, trusted body, `unsafe`, hidden public
   precondition, placeholder, ignored test, state-machine macro, or convenience authority bypass.
 - **E0-R052:** Public fields remain private; domain constructors are total and typed. `lib.rs` is
-  below 80 lines. Production modules target 400 lines and never exceed 700. Domain, integration
+  below 80 lines. Production modules stay at or below 500 lines. Domain, integration
   records, reducer, wire, durability, driver, recovery, and projections remain separate modules.
 - **E0-R053:** E0 depends on public contracts from B0/B1/B2/C0/C1/D0-D3. It shall not depend on
   concrete provider adapters, process/shell tools, OS sandboxes, or workspace/Git implementations.

.design/e1-harness-materialization.md

@@ -233,7 +233,7 @@ authority, and G0 daemon/CLI presentation to their already-defined slices.
   precondition, placeholder, ignored test, state-machine macro, or convenience authority bypass.
   Verus wrappers and ordinary Rust APIs are both tested.
 - **E1-R052:** Public fields remain private and constructors return typed errors. `lib.rs` remains
-  below 80 lines. Production modules target 400 lines and never exceed 700; domain, manifest,
+  below 80 lines. Production modules stay at or below 500 lines; domain, manifest,
   materialization, aggregate, wire, durability, replay, runtime, and projection concerns remain
   separate.
 - **E1-R053:** E1 depends on public B1/B3/C0/C1 contracts and shared foundation types. It does not

.design/e2-debugger.md

@@ -315,8 +315,8 @@ scaffolding-only substitutions in the acceptance criteria.
   illegal transition, idempotency conflict, journal, artifact, evidence, migration, recovery, and
   corruption. Display/debug output is redaction-safe and never includes model/trace/artifact bytes.
 - **E2-R081:** `lib.rs` only declares modules and re-exports intentional APIs. Public fields remain
-  private. Constructors validate complete invariants. Production modules are cohesive, normally
-  below 400 lines and always below the 700-line hard limit without a reviewed exception. Generic
+  private. Constructors validate complete invariants. Production modules are cohesive and stay
+  at or below the 500-line limit without a reviewed exception. Generic
   `utils`, `helpers`, `common`, `misc`, and `manager` modules are forbidden.
 - **E2-R082:** No production `TODO`, `FIXME`, `todo!`, `unimplemented!`, fake adapter, unchecked
   constructor, broad trusted wrapper, `assume`, `admit`, axiom, `external_body`, authority bypass,

.design/e3-evaluation.md

@@ -238,7 +238,7 @@ speculative distributed-consensus or unrelated release-qualification work.
 - **E3-R071:** Errors/debug output are bounded and redaction-safe: no task bodies, answers, hidden
   tests, credentials, raw output, environment values, or artifact bytes.
 - **E3-R072:** Public fields stay private; roots only declare/re-export intentional modules;
-  production modules target 400 and stay below 700 lines without review; forbidden generic module
+  production modules stay at or below 500 lines without a reviewed exception; forbidden generic module
   names are not used.
 - **E3-R073:** No production TODO/FIXME, placeholders, unchecked success, fake production adapter,
   unsafe, ignored test, `assume`, `admit`, axiom, `external_body`, or hidden proof precondition.

.design/f0-evolution.md

@@ -242,8 +242,8 @@ crates/analysis/peritus-evolution/
     verified_refinement.rs
 ```
 
-`lib.rs` remains a small documentation/export surface. Production files target 400 lines and may
-not exceed 700. A genuinely exhaustive reducer or wire mapping may receive a reviewed
+`lib.rs` remains a small documentation/export surface. Production files may
+not exceed 500 lines. A genuinely exhaustive reducer or wire mapping may receive a reviewed
 `architecture.toml` exception only after it has been split by domain concern.
 
 ### Aggregate ownership and identity

.design/g0-daemon.md

@@ -273,7 +273,7 @@ commit-before-effect ordering and invites synchronous locks across asynchronous
   responsible subsystem, and redacted source context. Public diagnostics never depend on prose
   matching.
 - **G0-R057 — Decomposition.** `lib.rs` is a documented facade and `main.rs` only parses/constructs.
-  Production modules normally remain below 400 lines and never exceed 700 without a reviewed
+  Production modules never exceed 500 lines without a reviewed
   architecture exception. Generic `manager`, `helper`, or `utils` god modules are prohibited.
 - **G0-R058 — Production evidence.** Focused tests, A2 daemon conformance, protocol/schema fixture
   drift, migration upgrades, platform IPC tests, crash matrices, strict Clippy/rustdoc, formal

.design/peritus-production-architecture.md

@@ -410,7 +410,7 @@ The physical group directories are proposed as `crates/foundation`, `crates/stat
 - Plugins never link into the daemon address space as arbitrary native dynamic libraries.
 - Every crate has a named owner, README with invariants and dependency policy, public API docs, unit tests, and a `tests/` directory for boundary behavior where warranted.
 - `src/lib.rs` and binary `main.rs` declare modules, re-export intentional API, and compose dependencies. Business logic in roots is rejected by architecture checks.
-- A source file has one named responsibility. A 400-line soft budget triggers review; a 700-line hard budget requires a checked-in exception naming why further decomposition would harm cohesion. Generated files and proof-generated expansions are measured separately.
+- A source file has one named responsibility. The source limit is 500 lines; exceeding it requires a checked-in exception naming why further decomposition would harm cohesion. Generated files and proof-generated expansions are measured separately.
 - Generic `utils.rs`, `helpers.rs`, `common.rs`, `misc.rs`, or `manager.rs` modules are prohibited unless the name is domain-qualified and responsibility is documented.
 - Libraries use typed `thiserror`-style errors with stable categories and source chaining. Dynamic context errors are allowed only at application composition/reporting boundaries.
 - Public fields are private unless they are intentionally stable wire data. Constructors enforce validity; typestate or enums prevent invalid lifecycle combinations.

CHANGELOG.md

@@ -1,5 +1,49 @@
 # Changelog
 
+## Unreleased
+
+### Fixed
+
+- Negotiate lightweight review summaries and stream contiguous structured/raw diff pages with exact current-source navigation and safe control-character previews.
+- Persist preview behavior checks with exact command, byte offsets, stream identities, and source digests; replay goal evidence after restart without rescanning or counting a duplicate check.
+- Keep attachment range types and preview output methods consistent across ordinary and Verus builds.
+- Keep filesystem diagnostics unique and bounded across directory pages; stabilize Git history against shared replacement, shallow, graft, and encoding settings; retain subjects beyond the former 4 KiB limit.
+- Record only successfully spooled process bytes after output I/O failures, search live preview streams according to their actual I/O mode, and align environment-name projections and native platform fixtures.
+- Retain large original attachments, stream selected file ranges, and expose exact version-bound attachment reads without independent host size or history-count ceilings. Bind previews and confirmation to the active conversation's writer provider and model (L126, L128, L142, L162, L261, L707–L710, L736, L798).
+- Preserve full process output and native command/environment representations; carry absent preview deadlines and resource quotas through execution, recovery records, and exact output-range reads (L090, L095, L096, L169, L193, L206).
+- Retain request archives and capture retry bytes above the former serialization limits; budget reviewer context against provider capacity and make all original review evidence available through digest-bound byte pages (L127, L170, L180, L192).
+- Page complete Git history and structured/raw diffs, preserve native paths and long lines, and bind TUI navigation and comment anchors to the displayed page (L008, L249, L254, L255, L528, L643).
+- Recover exact candidate and rollback outcomes after interrupted reference publication; remove unsupported merge advertisement and the configured-tool count gate (L644, L645, L734).
+- Synchronize cancellation tests with the actual stalled reviewer start and separately verify prompt cancellation settlement on native runners.
+- Remove workspace source/range ceilings and continue exact ranged reads and filesystem discovery/search through encoded-byte-sized pages (L007, L634, L635, L636).
+- Remove local-context archive limits and support absent aggregate artifact quotas while retaining referenced history and checked storage accounting (L057, L062, L065, L067).
+- Remove the discard-state size policy and recognize interrupted owned preparation without deleting foreign files (L148, L149).
+- Stream effect receipt frames without per-record or lifetime quotas, retain full results once, and reject unsupported receipt versions explicitly (L165, L167).
+- Bind command receipts to exact native owners, preserve receipt-linked live commands across observer replacement and startup recovery, reconcile terminal output before daemon control decisions, and require confirmed inactive ownership before acknowledging unknown effects (L166, L183).
+- Remove Git output and status quotas, preserve native status path bytes, represent unborn HEAD, and propagate index failures (L525, L527).
+- Retain patch preparation and terminal outcomes before cleanup, recover exact mutation handoff, and honor cancellation before the first target change (L552, L553, L554, L637).
+- Remove checkpoint capture file and aggregate byte quotas while retaining path safety (L003; Crosslink #104).
+- Remove patch file, byte, and operation quotas while retaining preimage checks and atomic application (L006; Crosslink #106).
+- Remove u16 checkpoint collection and index ceilings while preserving legacy identities and complete exclusion facts (L010; Crosslink #110).
+- Derive valid UTF-8 checkpoint titles without rejecting work because of generated text (L012; Crosslink #112).
+- Align checkpoint capture and restore capacity and retain typed patch errors (L013; Crosslink #113).
+- Recover complete transaction manifests above the former 16 MiB limit and deduplicate retained ancestors (L016; Crosslink #118).
+- Remove journal batch and state-history ceilings, migrate existing storage to schema 3 without changing digests, and preserve checkpoint key ordering beyond 65,535 paths (L020; Crosslink #120).
+- Remove workspace write and receipt size refusals, and stream receipt hashing (L035; Crosslink #134).
+- Preserve exact automatic-checkpoint retry lookup before recapture; no additional implementation was needed (L036; Crosslink #135).
+- Page workspace listing and search with scoped cursors, incremental inspection, and explicit omissions (L041; Crosslink #140).
+- Continue bounded workspace and reference reads without silent truncation or repeating cursors (L045; Crosslink #144).
+- Hash artifacts incrementally without the former 64 MiB refusal (L076; Crosslink #175).
+- Continue retrieval within sources using actual encoded page bounds rather than query, handle, or source-size cutoffs (L078; Crosslink #177).
+- Sample design inventory incrementally with cancellation, truthful omissions, and real workspace-list continuation (L124; Crosslink #223).
+- Page explicitly authorized references with native case rules, preserved path punctuation, and symlink confinement (L168; Crosslink #264).
+- Stream CSV validation using the selected delimiter, encoding, and row-shape contract; absent optional contracts do not block work (L172; Crosslink #307).
+- Stream JSON and YAML validation with cancellation and without whole-file size or empty-document refusals (L173; Crosslink #308).
+- Qualify SQLite migrations against explicit initial state and ordered paths, requiring repeatability, rollback, or postchecks only when selected (L174; Crosslink #309).
+- Stream source readability, report selected missing or unreadable paths, and honor Python source encodings (L175; Crosslink #310).
+- Page checkpoint and rewind coverage with full confirmation binding, durable restore summaries, stale-input protection, recovery, and TUI navigation (L712; Crosslink #744).
+- Deliver the selected 20-repair round with validated code and tracked results (Crosslink continuation #826).
+
 ## 0.0.5
 
 - Use one durable conversation and operation path across the terminal interface, CLI, WebUI,