PR #18395 — checkpoint aggregate byte budget
Candidate: a92dd68865162b74942944d4575a89c66d52599d
Baseline: 0c609ab87d6066bc53c400828a69d72c6e518c9c

Fixture: temporary real Git repository, 1,600 authored paths with 12,001-byte
contents, plus a historical imported commit. Real checkpoint capture, store,
VCS driver and process collector; only thread projection lookup is supplied
by the fixture. No provider, live database or production state is used.

Pinned-main production restored during the focused regression:
  Response: 19,463,870 bytes
  Patch reads: 3
  Patch output collected: 19,463,870 bytes
  The response-cap assertion fails at runtime.
  Source log: 18395-tests-v1-red-main.log

Final candidate, standalone Node service execution outside Vitest:
  Turn response: 10,000,000 bytes
  Full-thread response: 10,000,000 bytes
  Both responses identical: true
  Patch reads: 2
  Patch sizes: 7,506,817 and 2,493,184 bytes
  Patch output collected: 10,000,001 bytes (includes one lookahead byte)
  Truncation marker present: true
  Authored path retained: true
  Imported path excluded: true
  Source log: 18395-service-proof.log

Focused validation: 81 tests across CheckpointDiffQuery, CheckpointStore and
GitVcsDriver; server typecheck and scoped lint/format pass. Query regressions
cover actual 10,000,000-byte exact fits and storage/response UTF-8 boundaries.
The exact-fit case fails on the original PR implementation. Mutations of
strict overflow detection, UTF-8 trimming and VCS budget propagation fail
at runtime, followed by exact source restoration and nine passing query tests.

This proves headless server service behavior with real Git. It does not claim
a live WebSocket/client session, native-platform verification, an overall
JSON frame-size limit, total process-output/work limit, or latency/memory
benchmark. Serialized filtered reads trade parallelism for ordered budgeting;
no later patch read starts after overflow. The active Git process still drains
excess output under its existing process timeout.