fix(fs): admit standard-stream capture before growth

[chaliy]

What changed

Standard-stream file operands reserve retained capacity before writes and collection. Capture obeys configured stdout/stderr ceilings, shares the request live-memory/work budget, and checks cancellation/deadlines on each write or append. Byte/text leases survive collection, redirects and result hooks. Wrapper-owned stdin/read-copy storage and stream-copy temporary reads also receive admission; ordinary filesystem operations still delegate. Resolved copy sources use POSIX VFS spelling and root-aware absolute symlink targets on every host; the existing Windows job checks zero admission before direct/aliased device reads.

Why

Intercepted stream writes bypass filesystem quotas. Output truncation after builtin completion cannot protect the preceding allocations.

Before / After

Before: two ordinary two-byte admission configurations returned success despite zero stderr admission or a three-byte combined stdout ceiling. Both failing-first assertions exited 101 on the original source.

After: both return a resource-limit error before discarded redirects. All 45 targeted fixtures pass: capture ownership/capacity, work/cancellation, stdin/copy admission, fd/append/redirect compatibility, byte transport and static threat-ledger checks. Real Bash comparison preserves stdout hihihi, stderr hihi, and exit 0 for a two-byte alias/append fixture; the real CLI produces the same bytes.

Validation

• All-target/all-feature and lean-feature Clippy with -D warnings
• Warning-strict all-feature Rustdoc
• Format, OKF, doc links, capability/workflow/changelog checks
• cargo vet --locked; cargo deny check licenses sources
• Real CLI smoke and selected ordinary single_echo Criterion benchmark
• Full required CI and formal review tracked on this PR

Risk

Medium. Stream operands exceeding configured capture ceilings now fail before redirects, including redirects that discard output. Plain filesystem stdin reads cannot carry leases, so the wrapper conservatively retains copy charges until it drops. Temporary backend read admission relies on metadata correctness plus canonical device read ceilings.

Checklist

• Tiny positive/negative ownership and compatibility fixtures added
• Knowledge, threat model and public/Rustdoc security documentation updated
• Backward compatibility considered; bounded alias/append/pass-through behavior preserved

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	bashkit	61b89d0	Commit Preview URL Branch Preview URL	Oct 14 2026, 04:28 AM