pub fn read_capped(path: &Path, max_bytes: u64) -> Result<Vec<u8>>Expand description
Read a file into memory subject to a hard byte cap, refusing
non-regular files. The size check runs on the OPEN handle (not
the path — closes the TOCTOU race where a symlink target is
swapped between metadata() and read()), and the read itself
uses Read::take so a target that grows after the metadata
check still cannot exceed the cap.
Shared between the CLI (round-16 F5) and the harness reconciler (round-17 F3) so both audit tools and the long-running server enforce identical resource bounds against on-disk tampering.