Torrent v2 01c: prevent metadata starvation under transfer load

[linroid]

Active piece transfers could exhaust the shared buffer budget and prevent a magnet metadata request from obtaining its scratch reservation. Give transfers and metadata independent partitions under a combined exchange ceiling, so a full transfer partition still permits one metadata exchange.

Stack: based on #164 (torrent-v2-01-contracts), following #163. This is the exchange-budget slice of roadmap #162 step 01.

Reservations account against both child and parent budgets, roll back on failed admission, and release only once. Configuration rejects insufficient headroom using overflow-safe arithmetic. The existing metadata wire tests now run with the entire transfer partition reserved; a canceled handshake must release metadata reservations while preserving the transfer reservation.

Validation: full torrent JVM conformance and native runtime dependency guard pass with both pinned clients. Focused tests cover aggregate exhaustion, rollback, double-close, integer overflow, reordered/corrupt/oversized/private metadata, and cancellation cleanup.

maxExchangeBytes bounds exchange buffers only. Retained metadata, session indexes, OS allocations, production profiles, and performance/soak gates remain pending; this PR makes no total-memory or RSS claim.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-12T11:52:35.770189Z	3934a3d	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

Test Results

  465 files  + 5    465 suites  +5   3m 51s ⏱️ ±0s
2 287 tests +15  2 287 ✅ +15  0 💤 ±0  0 ❌ ±0 
2 873 runs  +25  2 873 ✅ +25  0 💤 ±0  0 ❌ ±0 

Results for commit 04bbde6. ± Comparison against base commit b1eadef.

♻️ This comment has been updated with latest results.

[linroid]

Superseded by #231 (Contracts, verification infrastructure and resource limits) in the consolidated eight-PR stack for #162.

The replacement preserves this PR's code and subsequent fixes; its description links the original head and review discussions. The only additional consolidation fix is the CI-discovered listener cancellation regression, documented on the replacement. All eight replacements have passed their required CI checks.

Closing without merging. This branch and its discussions remain available for reference. Review index: #162 (comment)