[helly25]

Fill source ranges and supported materializations directly into their final storage, reducing temporary allocations and copies. Owned-only decoders keep their direct read path and transfer their first block into the result.

AG;DR

Dependency: #1068 is merged as 58ba30e. This PR is now synchronized directly onto main. Five documentation-list conflicts preserve the complete child content: main's entire tree equals the original e6a60c7 parent, and the resulting synchronized tree equals the previously qualified 8c12718 head byte for byte. Normal synchronization commit/push hooks pass. Fresh main-based CI is still required; no old PR-context checks are reused. Qualification remains frozen at c6a3290, with the publication-parent test-timeout identity proof retained. Local qualification does not replace current-head CI.

Implementation:

• ReadSourceRange fills its reserved final string using resize_and_overwrite; only validated initialized counts are committed. Offset overflow, 64 MiB guard, reservation lifetime, zero-range behavior and sequential replay accounting remain.
• ReadSourceBytes uses available capacity/SSO for caller-owned reads. Incapable cursors retain direct owned reads: move the first returned block into an empty result, then append later chunks. Recheck capability for each read; preserve mixed-mode cursors, positive short reads and errors.
• Positive one-byte probes distinguish exact EOF from limit overflow, including a zero limit. Bound arithmetic by string max_size and reject impossible counts before committing length. Capacity may exceed logical size; this is not a process-memory limit.
• Nine committed tests cover capability changes, short/early EOF, reservation lifetime, exact/zero-limit probes, malformed counts, late/probe errors, maximum arithmetic and owned-only small/multichunk results. The archive format-probe owned-read counter changes from one to zero because its range now fills directly. Existing sparse, lifetime, budget and error tests remain.
• Add a manual 36-case source benchmark, explicitly indexed for clang-tidy, alongside the existing archive benchmark. No new public flag/API, external dependency, worker, lock, metadata probe or host-I/O path.

Measured evidence:

• Each host retains 300 native rows and 1,008 memory runs across baseline/range-only/bytes-only/combined, plus 50 native and 108 memory confirmation runs with a byte-identical baseline repeat. A separate 27-run tiny-case population uses one million iterations per repetition. Memory cases retain fastest seven of nine; native output/exit and complete in-memory content are checked. Builds, lint and instrumentation never overlap same-host timing.
• Confirmed 4 KiB legacy materialization improves about 28–29% on both hosts; 16 MiB memory materialization about 17% Linux/21% macOS; 16 MiB memory range about 82% Linux/29% macOS. These are kernel results, not universal command speedups. Native confirmation ranges from roughly unchanged to 3.7% slower; archive controls and reference-repeat movement remain visible.
• macOS fixed tiny legacy materialization regresses about 9.3%, from 34.9 to 38.2 ns. Caller-owned/memory tiny cases improve. Spare-capacity first reads can add a backend call; all slower cases remain documented.
• A generalized span fallback regressed Linux legacy 4 KiB reads about 24% and was rejected. Its complete 300 native/1,008 memory runs per host and the separate refinement pilot (24 native/126 memory) remain separate in the lossless archive; they are never pooled with selected results.
• Separate warmed ASan allocation diagnostics cover 36 source and 48 archive cases per variant/host. For a 16 MiB memory range, cumulative requested bytes fall from about 33.6 MB to 16.8 MB. These are request counts/bytes, not release timing or peak/RSS savings.
• Unstripped full CLI size: Linux +10,648 bytes; macOS +192 bytes.

Validation:

• All 313 selected root-and-extension release suites pass per host; Linux requires working FUSE. Five focused ASan suites pass per host, with five MSan and five TSan suites on Linux.
• Actual scoped clang-tidy passes all four changed translation units on both hosts. Final test-only early-EOF refinement reruns its target under each validated configuration and scoped lint; production/benchmark sources remain identical.
• Seven-file guards verify restoration after every source-swapping builder/diagnostic. Parent-sync rg_full release tests pass both hosts. Normal enforcing commit/push hooks and current-head GitHub CI determine readiness.
• CHANGELOG, TODO, performance analysis and release-site mapping link docs/benchmarks/direct-source-materialization-20261103.md. Its 5,695,819-byte lossless archive has SHA-256 63160535a98a05869eeff1d2ba357a9f99a62b81ef424c72c7ab4ed92f9d41e3 and preserves raw runs, source/config/link identities, scripts, probes, validation logs and rejected/setup populations.

O19b archive seeking/index/replay/admission and the remaining performance candidates stay open.