# Explicit large-upload candidate — not a released package

General Blossom keeps its 16 MiB default. `ARCHY_BLOSSOM_MAX_UPLOAD_BYTES`
accepts an explicit positive decimal byte count up to 2147483648; malformed or
excessive values fail startup. No live setting or catalog entry is changed.
Podsteadr's fixture generator requires `--large-upload-candidate` to request the
2 GiB setting; the supplied immutable image must actually implement this option.
Old package images ignore the new variable and must not be represented as qualified.

The pinned upstream worker used `ReadableStream.tee()` for hash and disk branches;
the faster branch could queue ahead. `upload-worker-patch.ts` instead awaits each
complete disk write before yielding that chunk to the incremental hasher. The
patch refuses changed upstream integration and handles partial/no-progress writes.
Authentication, hash verification, temporary-file cleanup and ownership remain
upstream responsibilities. Independent review is still required.

## Recorded qualification

- Source policy/patch tests: 3 passed, including malformed limits and refusal of
  changed/repeated patch application.
- Candidate image built offline from the previously qualified immutable package;
  production source is at `6bc14b6a0`. No released version/tag assigned.
- Actual default-limit/auth/retention negatives pass.
- Actual signed 2 GiB upload, descriptor, exact tail range, service recreation,
  full-length/hash verification and owner-authorized cleanup pass with fixture
  transport source `6468ad120`.
- Containers had a 512 MiB memory limit and zero swap allowance. No OOM/kill;
  cgroup limit/reclaim events occurred. This is not a claim of ample headroom,
  concurrent-upload capacity, phone performance or Raspberry Pi compatibility.
- The initial streaming-fetch attempt failed HTTP411 because it did not deliver
  the required fixed Content-Length. The fixture now uses node:http with
  backpressure, not a whole-payload RAM buffer. Failed evidence is retained.

## Reproduction boundaries

Build `tests/apps/blossom/Upload.fixture.Dockerfile` with `docker/blossom` as its
context, a full immutable qualified `BLOSSOM_BASE`, `--pull=never`, network disabled,
and bounded resources. This delta-image recipe does not replace clean release
build/provenance acceptance. Run `run-upload-disposable.sh` with the immutable
candidate in `BLOSSOM_FIXTURE_IMAGE`; allow >5 GiB free disposable storage and a
bounded outer timeout. The script uses no external network, host ports, real keys,
wallets or persistent installed-app storage. It recreates services only against
its own named volume and cleans that volume on exit.

Remaining: required review; versioned clean package build/provenance; nonempty
ownership migration/rollback; managed service-key provisioning/rotation/start
ordering; actual manager/device acceptance. No deployment or catalog activation.