Bound original byte preparation and preserve retry identity
Original acquisition needs a cap while bytes are being consumed, before building a complete file. This adds unused server preparation: current workspace authorization before reading, 50MiB/10,000-chunk limits with cancellation/released reader, copied chunks, PDF/UTF-8 plausibility and actual digest/size, and namespaced UUIDv5 object identity from owner/source/retry key. Changed bytes preserve the retry object identity but change the fingerprint for later no-overwrite conflict checks.
Depends on separately pending API986; reviewed dependency commits included until release. No upload/storage/SQL/signing/HTTP/MCP caller or customer/provider/rights/financial operation. Prepared bytes are not stored evidence. Later storage must prevent overwrite, reverify stored bytes, reconcile exact retries and handle confirmed orphans safely. Network deadline/upstream allocation/concurrency/storage-quota controls remain transport work; byte cap is not a duration cap or zero-copy guarantee.
Validation:13 new stream/preparation +18 inherited verifier/storage =31 cases pass; full lint/scoped TypeScript/format/diff pass. New suites failed missing modules before implementation. Synthetic local streams only, no hosted operations. See lib/context/originals/ORIGINAL-PREPARATION.md for limits and remaining controls.
Part of recoupable/app#2116 and recoupable/app#2140.
Summary by cubic
Adds unused server-side preparation that bounds original PDF/CSV byte consumption to 50MiB and 10,000 chunks before building a complete file. New helpers authorize the workspace before and after reading, reject empty, binary, or oversized content, fingerprint the actual bytes, and derive a stable UUIDv5 object key from owner/source/retry key so exact retries address the same object while changed bytes produce a different digest. Retry identity is type-independent: PDF and CSV retries of the same source map to the same .original object path, and the declared media type must match the detected bytes. UUID casing is normalized before comparison, storage keys must exactly match owner/context-originals/<uuid>.(pdf|csv|original) (malformed, foreign, or path-traversal keys are denied before reading), and preparation never acquires the stream reader until the first authorization passes or when the caller supplies digest/key/identity overrides. The default storage read downloads only from the context-private bucket and re-checks size; verification returns the bucket and rejects bytes whose size changed during the read.
- Introduces no upload, storage, SQL, signing, HTTP/MCP caller, or customer/provider operation; prepared bytes are not stored evidence.
- Depends on separately pending API986; reviewed dependency commits are included until release. Later storage must prevent overwrite, reverify stored bytes, reconcile exact retries, and handle confirmed orphans safely.
- Full lint, scoped TypeScript, format, and diff checks pass, along with the new stream/preparation and inherited verifier/storage test suites.