Objective
Implement the smallest end-to-end scan() slice authorized by the accepted technical baseline in #272 and the conclusions of prerequisite issues.
Why it matters
This is the first production slice proving that stable source identity, bounded position-independent reads and scan-wide budgeting compose safely without prematurely implementing the full format/facet architecture.
Dependencies
Blocked by #272, #274, #273 and #275. Do not implement through an unresolved/inconclusive prerequisite without explicit scope reduction or maintainer decision.
Constraints
TDD; zero mandatory third-party runtime/normal-test dependencies; Windows/Linux/macOS public invariants; bounded hostile-input behavior; minimal public API; no FileIO/cereja.security changes; performance measured against a semantically equivalent stdlib baseline where meaningful.
Required evidence
Keep the slice boundary and links to prerequisite conclusions in this Issue/PR. Tests cover observable invariants before production code. Capture bounded work/budget exhaustion and applicable malformed/truncated cases, cross-platform CI evidence, and initial latency/bytes-read/operation behavior. Evidence belongs in tests/CI/benchmark output/Issue/PR rather than mandatory report documents.
Completion
One minimal path and bytes scan flow works; facts derive from one stable source; Reader contract is position-independent and charges the shared budget; failures/exhaustion are typed and bounded; tests and relevant benchmark evidence pass; no dependency/legacy API expansion occurred.
Out of scope
Full format coverage, ZIP preflight, PE parsing, recursive archives, write APIs, concurrency, legacy migration, or EDD tooling unless a prerequisite proves one essential to this slice.
Setup metadata: Type: Feature · Area: Scan orchestration · Risk: High · Evidence: required
Objective
Implement the smallest end-to-end
scan()slice authorized by the accepted technical baseline in #272 and the conclusions of prerequisite issues.Why it matters
This is the first production slice proving that stable source identity, bounded position-independent reads and scan-wide budgeting compose safely without prematurely implementing the full format/facet architecture.
Dependencies
Blocked by #272, #274, #273 and #275. Do not implement through an unresolved/inconclusive prerequisite without explicit scope reduction or maintainer decision.
Constraints
TDD; zero mandatory third-party runtime/normal-test dependencies; Windows/Linux/macOS public invariants; bounded hostile-input behavior; minimal public API; no
FileIO/cereja.securitychanges; performance measured against a semantically equivalent stdlib baseline where meaningful.Required evidence
Keep the slice boundary and links to prerequisite conclusions in this Issue/PR. Tests cover observable invariants before production code. Capture bounded work/budget exhaustion and applicable malformed/truncated cases, cross-platform CI evidence, and initial latency/bytes-read/operation behavior. Evidence belongs in tests/CI/benchmark output/Issue/PR rather than mandatory report documents.
Completion
One minimal path and bytes scan flow works; facts derive from one stable source; Reader contract is position-independent and charges the shared budget; failures/exhaustion are typed and bounded; tests and relevant benchmark evidence pass; no dependency/legacy API expansion occurred.
Out of scope
Full format coverage, ZIP preflight, PE parsing, recursive archives, write APIs, concurrency, legacy migration, or EDD tooling unless a prerequisite proves one essential to this slice.
Setup metadata: Type: Feature · Area: Scan orchestration · Risk: High · Evidence: required