tip leaf: bound snapshot patch text (#50360)

[kvnloo]

Goal

Fork-only tip leaf for origin anomalyco#50360 — bound the patch text a snapshot diff stores.

Context

Origin tip SHA 6f375c443437e30f442fba453f57c94a49a13e24. Base: fork dev. github_writes_origin=0. Codex promote parked.

Acceptance

• CLEAN fail→pass on tip snapshot patch-bound tests (GREEN 2 / NEG 2 fail / RESTORE 2)

Return

Ship fork PR with grok bot + envelope; no origin writes.

[kvnloo]

QA: HOLD — the current implementation does not actually enforce the stated aggregate limit.

patchFor checks body.length > limit, then unconditionally does stored += body.length. So if stored is already near the budget, another individually-under-limit patch can push the turn well over it (worst case approaches 2 * limit). The existing test only proves that some tail entries lose patch text; it does not assert the aggregate invariant.

Please add a regression that asserts sum(diffs.map(x => x.patch.length)) <= limit, then change the admission check to account for the remaining budget (e.g. reject when stored + body.length > limit). Re-run GREEN / negative mutation / RESTORE on the exact origin tip.

[kvnloo]

Exact head already has stronger real-world evidence upstream: a 16.8 GB DB measurement, 2.8 GB of per-turn patch summaries, and a 447 MB worst-case row, plus focused tests. No additional factory comment needed. WAIT_EXTERNAL.