fix(biometrics): reject oversized bundle entries before writing and bad --jobs values before replaying

[ng]

Why

CodeRabbit reviewed #837 directly once its base became dev, and the review landed just after #837 merged. Three findings are valid; this PR fixes them.

What

• extractBundle checks size limits before writing. It now applies the per-role size limit (RAW 256 MiB, text 16 MiB) before streaming an entry to disk. Previously a schema-valid tar could fill the disk before verifyBundle rejected it (CodeRabbit: Major).
• --jobs is validated first. It must be a positive whole number and is checked before any extraction. Previously --jobs four produced zero worker slots and a confusing "Missing replay output" error.
• Stale holdout wording fixed. Holdout nights can be replayed with --include-holdout, but the parity refusal and the fitCandidates doc comment still said they never were.

Declined: moving exportDataset to the coordinator's work lane. That lane also runs backtest replays, which last up to hours on Pod 5, so an export would wait behind them. The export's hash pass holds the read lane only for seconds (about 430 MB), and the HTTP route already allows one export at a time.

Test plan

• New tests: an oversized listed entry is refused before writing; --jobs values four, 4x, 0 and 1.5 are rejected before extraction; parity holdout message
• vitest scripts/biometrics-local-fit (17), tsc --noEmit, eslint

🤖 Generated with Claude Code

🛏️ Beam this PR onto a sleepypod ✨

Pick the snippet that matches your pod. Already-installed pods can't use the curl bootstraps below — sleepypod's egress firewall DROPs github.com, and the script that knows how to unblock WAN is the very file curl is trying to fetch. Use sp-update instead; it's on disk and opens WAN as its first step.

🔄 Already on a sleepypod (most common — review a PR on a running pod):

sudo sp-update fix/local-fit-review-followups

🚀 Fresh pod / first install — bootstraps from GitHub, rebuilds every push:

curl -fsSL https://raw.githubusercontent.com/sleepypod/core/fix/local-fit-review-followups/scripts/install \
  | sudo bash -s -- --branch fix/local-fit-review-followups

🎯 Pin to this exact build (run 39087121147 · 251683a) — fresh-pod path, locked to one CI artifact for reproducible review:

curl -fsSL https://raw.githubusercontent.com/sleepypod/core/251683a374b3b479518b7ffeded73fbb07db8fc1/scripts/install \
  | sudo bash -s -- \
      --branch fix/local-fit-review-followups \
      --artifact-url 'https://nightly.link/sleepypod/core/actions/runs/39087121147/sleepypod-core.zip'

🧊 Artifact: sleepypod-core · self-destructs in 30 days 💥

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
sleepypod-demo	Ignored	Preview	Oct 18, 2026 1:36am UTC

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 49 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 61c6abe3-e76f-4c81-ad62-80adf31419a4

📥 Commits

Reviewing files that changed from the base of the PR and between c8a4243 and 251683a.

📒 Files selected for processing: 6

• scripts/biometrics-local-fit/bundle.test.ts
• scripts/biometrics-local-fit/bundle.ts
• scripts/biometrics-local-fit/cli.ts
• scripts/biometrics-local-fit/fit.ts
• scripts/biometrics-local-fit/report.test.ts
• scripts/biometrics-local-fit/report.ts

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ All tests successful. No failed tests found.

📢 Thoughts on this report? Let us know!