[relh]

Policy ZIPs were inflated before their decoded size was accounted for. A small upload could therefore allocate arbitrary decoded data before the BASIC compiler or neural runtime applied its limits.

Enforce a shared 64 MiB budget across decoded source, resource contents, resource names, and accounting overhead. Pin the bounded Zippy decoder to relh/zippy@d605465c98b9666f9a5232cece5a0441c10d159e in both dependency locks; upstream change: treeform/zippy#2. Each extraction receives the remaining budget and counts actual output, including false ZIP size metadata. This bounds retained package data, not total process memory.

Extend the existing native Coworld runtime harness with aggregate-overflow and forged-size cases. COWORLD_TEST_ARTIFACTS retains episode evidence for independent inspection.

Validation: existing Zippy suite and Polyworld package-loader tests pass. The compiled GotA native Coworld workflow passes 21 episodes on Linux amd64, including both new rejection cases, inside a network-disabled container limited to two CPUs and 4 GiB. Game logs attribute the failures to player zero, publish its failed status, omit game results, and retain healthy contract endpoints. The workflow uses the real compiled game and staged player files; no browser workflow was exercised. These checks establish loader/runtime behavior, not learned strength or full VM isolation.

Regression control: removing decoder limits from the actual game source lets the aggregate oversized package complete gameplay instead of producing the required player failure. The same harness fails at its 120-second missing-failure deadline. The original source was restored byte for byte; all positive and negative-control evidence is retained.

Reproduction: compile examples/gods_of_the_arena/gota.nim with -d:coworld to tmp/coworld/gota, then run nim r coworld/tools/test_runtime.nim gota with pinned POLYWORLD_DEPS and an existing COWORLD_TEST_ARTIFACTS directory.

[Codex, acting on behalf of Richard Higgins]