No reference sink read the declared cost: a few kilobytes of valid stream
could make the neural sink, or its C ABI, decode a clip at the 2^30-byte
cap.
- neural::ModelRegistry::with_cost_limit takes a limit on each figure of
int_payload::DeclaredCost (DeclaredCost::new, a figure left unbounded
at its type's maximum). An integer payload over it is refused before
any symbol is decoded, with the new code cost_over_limit
(int_payload::check_cost, neural::DecodeError::OverCostLimit); it is
the sink's policy, so dispatch moves on as for a capability the sink
cannot decode: a WAI1 to its fallback, a WAI2 to its next entry.
integer-payloads §8 lists the code and its routing, and §7 places the
check after the networks are planned.
- neural::declared_cost reads the cost over the parameters
resolve_verified returns, so a registry user reads it over the bytes
a pin verified without building int_payload::IntParams.
- The C ABI's neural entry points do not advertise a capability that
decodes to integer video, PCM or splat attributes, which have no
wai_decoded_t kind (neural::decodes_to_int): such a payload is
refused before it is decoded, not after.
- wai_int_payload_declared takes the parameter set's path, or null for
the header alone, and wai_int_declared_t gains working_bytes, the
multiply-accumulates (macs_lo, macs_hi) and cost_known. The header
alone fixes them for a keyframe-0 WIV1
(int_wire::Wiv1::keyframe0_working_bytes, which declared_cost now
uses too; container::DeclaredSize gains working_bytes and macs).
Tests: neural_cost_limit (its own binary, a live-bytes allocator): a
clip over the limit refused having held under 64 KiB, the next WAI2
entry decoded; the C ABI refusing the clip under 64 KiB through
wai_neural_decode_ex and wai_neural_decode_video; the cost over a
registry's set and through the C ABI equal to the library's, and
set_incomplete without a member. ffi_envelope and int_payload_cost
check the header-only figures.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
2888206f7b