makelore/.project-docs/30-worklog/tasks/20260820-remove-download-size-check-4f8a2c1d.md

Task: Remove Learning archive size validation

Identity

• Task ID: 20260820-remove-download-size-check-4f8a2c1d
• Mode: Feature
• Branch: codex/20260820-remove-download-size-check-4f8a2c1d-remove-download-size-check
• Worktree: D:\Datas\OthersProjects\makelore-remove-download-size-check-4f8a2c1d
• Base commit: 2168e291b2
• Owner: codex
• Status: Ready for Integration

Scope

• Remove Learning project ZIP download checks that reject a response because of an archive byte limit, declared archive size, or Content-Length mismatch.
• Keep the existing authenticated Main-owned download route, controlled same-origin redirects, SHA-256 verification, ZIP signature validation, temporary-file cleanup, and atomic final rename.
• Add focused regression coverage proving a valid archive downloads even when its reported sizes are absent, inconsistent, or above the former limit.

Intent And Constraints

• Follow the user's explicit direction to download without any size validation.
• Do not expose Works credentials, upstream archive URLs, temporary paths, or final local paths to Renderer.
• Do not weaken digest or ZIP-format integrity checks; those are independent of archive size validation.
• Limit production changes to the existing Electron Main Learning download service and focused tests.
• This is a feature task, so canonical project memory remains unchanged until a later Integration Gate.

Outcome

• Electron Main no longer reads or compares archive Content-Length, project archiveBytes, actual streamed bytes, or the former 512 MiB ceiling when saving a Learning project.
• Learning project DTO projection accepts positive safe-integer archive sizes above the former client limit so those projects can reach the download flow.
• SHA-256, ZIP signature, MIME, account-binding, redirect/origin, temporary-file cleanup, and atomic rename checks remain unchanged.
• Added regressions for omitted Content-Length, inconsistent reported sizes, and metadata above the former limit.

Verification

• Red phase: the two new size-removal regressions failed against the old implementation with LEARNING_PROJECT_INVALID and LEARNING_INVALID_RESPONSE.
• Focused Learning tests: 2 files, 17 passed.
• Full unit suite via pinned pnpm 10.33.4: 176 files, 2061 passed.
• pnpm run typecheck: passed.
• pnpm run lint:check: passed with zero errors and six pre-existing warnings.
• pnpm run build:vite: passed; existing dynamic-import and chunk-size advisories only.
• git diff --check: passed.
• Independent sub-agent review was not run because the user explicitly required that no sub-agents be created; final review was performed in the primary task.

Follow-ups

• Integrate the source commit into main.
• During Integration Gate, reconcile all canonical documentation and remove the obsolete size-failure smoke cases listed in the promotion candidate below.

Promotion Candidates

• Target: ADR-005, Learning system overview/domain/current state, README.md, docs/learning-project-catalog-server-contract.md, success criteria, and the Learning release commitment.
  • Proposal: remove the client download byte ceiling and all declared/ transport size consistency requirements while retaining same-origin redirects, SHA-256, ZIP signature, temporary-file cleanup, and atomic save.
  • Evidence: explicit user direction and focused download regressions from this task.
  • Future impact: the desktop client may consume disk space according to the upstream archive size; server-side publication/storage policy may still set independent upload limits, but they are not enforced during client download.
  • Semantic conflicts: supersedes the 512 MiB and declared-size requirements in accepted ADR-005 and its derivative documentation and smoke checklist.
  • Human confirmation required: no; the user explicitly requested removal of download size validation.