[SovereignTechnology]

#35 merged its own NFX store while #36 built the same slice. #36's store went through an independent adversarial review, and the same flaws turned up in #35's. This ports the review's fixes into the store on main, keeping its API, which the Studio wiring uses. #36 is closed as superseded.

Fixes (packages/seeder/src/nfx-store/store.ts)

• One size per sha256.
  • Before: a list naming a stored file, or a stored hash list, at another size was recorded at the false size (:286, :311). That skewed totalBytes, file() sizes and later cap frees. A list giving one sha256 two sizes was first-wins (:271). Once seeders store what peers send, a peer could do this at will.
  • Now: both are refused.
• Crash leftovers. The fs adapter can't list a directory, so nothing may be left on disk that no record names.
  • A put is saved as a pending record before its first file is written, and a load removes a pending put's files and .part files.
  • A removal deletes files before it saves the record list. Before, it saved first, so a crash left files nothing counted.
• The disk decides at load. A record naming a missing file, or a file of another size, is dropped with its video. Files only it named are removed.
• Damaged index.
  • A malformed record is dropped on its own; before, one bad record emptied the store.
  • A videos.json that isn't one, or of another version, is set aside, not overwritten.
• Load never throws. A store that can't load is off (loadError, puts return unavailable), and the seeder still starts. Before, it took the legacy seeder down too.
• Limits. Hash lists over 16 MiB are refused, and buffers are copied before they're checked.
• Logging. The seeder now logs a load failure and any videos dropped at load.

Tests (nfx-store.test.ts)

Each finding gets a case:

• a stored file named at another size, including the stored hash list itself;
• one sha256 listed at two sizes;
• a hash list over 16 MiB;
• an interrupted put with a .part file;
• the disk deciding between two records;
• a malformed record, and a newer-version index;
• a store that can't load.

Review

This applies findings from #36's adversarial review, so it was not reviewed again separately. The new paths are built only from validated hex, as before.

Merge

Squash, locally as sovtech.

[SovereignTechnology]

Squash-merged as 625ca50 (main, as sovtech).