normative: §7.3 bound the cost of decoding input; §13.1 make it a safe-state precondition

Extend the evaluation ceiling to the parse step. Decoding a received artifact, and decompressing it where a transport transform was applied (Section 7.2), MUST be bounded in memory and time against adversarial input under a declared decoded-size limit, and MUST fail to the declared safe state on breach. The classic case is a decompression bomb, a tiny input that expands without bound.

Frame it as a precondition of the safe-state guarantee: a node exhausted before it can fire its declared safe state has lost the guarantee that the safe state exists, so §13.1 now states that firing presumes the node can still act. Concrete limits are declared per profile or capability (the §6.2 envelope pattern); streaming decompression under a size cap is RECOMMENDED, not required.

Signed-off-by: Chris Raynor <chris@raynor.tech>

Author: cbraynor

spec.md

@@ -301,6 +301,8 @@ How much computation a definition or a grant can trigger is itself a contract de
 
 **A restricted total predicate, only where runtime state must be tested.** A conditional safe state (Section 8.2), a readiness gate (the updates extension), and a subscription filter (Section 8.5) genuinely depend on state unknown at design time, so they cannot be pure data. These use a restricted predicate language that is total and terminating, with no unbounded loop or recursion. On the safety-critical path the full branch tree is additionally fixed and certifiable when the role is designed (the constraints of Section 8.2 and open question 30).
 
+**Bounding the cost of input.** The same ceiling applies to accepting input, not only to evaluating it. Decoding a received artifact, and decompressing it where a transport transform was applied (Section 7.2), MUST be bounded in memory and time against adversarial input, under a declared limit on decoded size. A small input that expands without bound, the decompression bomb, attacks the node's ability to act at all. A node exhausted before it reaches its declared safe state has lost the guarantee that the safe state exists (Section 13). Exceeding the bound MUST fail to the declared safe state, like any other failure, never consume unbounded resource. The concrete limits are declared per profile or per capability, the same pattern as the non-functional envelopes (Section 6.2), not fixed here. Streaming decompression under a fixed size cap is the constrained-device way to meet this, RECOMMENDED, not required.
+
 The litmus test for any new field follows directly. If evaluating it needs runtime state not known at design time, it is a bounded predicate under the Section 8.2 constraints; otherwise it is data. If it would ever need to loop or recurse over unbounded input, that is a design error, because it can be neither certified nor reimplemented from this specification alone (open question 21).
 
 A pluggable policy (a promotion or election policy, or a multi-principal arbiter, Sections 8.4 and 9) MUST resolve to a named policy from a fixed catalogue with declarative parameters, or to a bounded predicate, never to carried code. Where genuinely open-ended choice is wanted, it lives above the contract line as product behaviour (Section 1), and the protocol constrains only the declared envelope within which that choice is made. Which restricted predicate language to specify, an existing total one such as CEL or a smaller purpose-built grammar, is open question 32.
@@ -443,6 +445,7 @@ The forensic plane is the protocol's role at the edge of its own authority: wher
 
 - Safe state on loss of liveness is capability- and slot-specific and declared, never global (Section 8). A held note releases; a drive motor freewheels; an inverter anti-islands.
 - The heartbeat is the dead-man's switch that fires the declared safe state.
+- Firing the safe state presumes the node can still act. The cost of accepting and decoding input is therefore bounded and fails safe (Section 7.3), so input crafted to exhaust the node first, a decompression bomb the sharpest case, cannot defeat the guarantee.
 - The protocol's job is fast, trustworthy detection plus a declared safe default. The response (redistributing torque across the live corners, re-deriving dispatch) belongs to the certified domain controller. Safety logic is never smuggled into the communication layer.
 - This specification addresses graceful degradation. Functional safety in the IEC 61508 / ISO 26262 sense (fail-safe versus fail-operational design) is a distinct, heavier discipline and is not claimed here.