fix: cap snapshot node count relative to file size
The 64x decompressed-body limit still let an 804 KB crafted snapshot
(repeating blocks of records) expand to 4.2 M nodes and ~500 MB of
heap, ~600x amplification; larger files exhaust memory. LoadFile now
allows at most one node per byte of file (1 Mi floor); real snapshots
use ~15 bytes per node. Limit errors on the node count are no longer
misreported as "no root node".
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- snapshot: depth limit (stack overflow in exporters), decompressed-size
limit (gzip bombs), per-node size cap and saturating aggregation
- export: sanitise exclusion patterns from snapshot metadata
- tui: drop duplicate/trash/filter results that belong to a replaced
tree; cancel duplicate search on rescan
- trash: refuse symlinked or foreign shared-filesystem trash dirs; never
overwrite an existing trashed item
- scan: no symlink following without inode identity; correct unscanned
count and keep real read errors after cancellation
Decompression and checksumming overlap with parsing via a pipe, and a
concrete-typed varint reader removes per-byte interface calls
(0.39s -> 0.29s for 458K nodes).
Andy DixonandClaude Opus 5.5