BE-019 MED: thin-pack index buffer sizing — silent object drop + >1GB balloon on corrupt input

Three sizing/typing defects in shared/store.js's thin-pack walk:

store.js:114 — indexPackByWalk sizes the resolve buffer off the DELTA length with no NOROOM grow; an object whose resolved size exceeds that is silently dropped from the index (later reads miss it).
store.js:366 — readRecord retries ANY resolve error as NOROOM, doubling the buffer up to >1GB on a CORRUPT record instead of failing fast.
store.js:92 — inferType mis-types a blob whose first bytes look like a tree/commit header, indexing it under a WRONG sha in the walk.

From the 2026-07-07 be/ review (BE/REVIEW), CONFIRMED. Method Issues.

Input

store.js:114 sizes to the delta length, but the reconstructed object is larger; no grow → SNOROOM drop, no diagnostic.
store.js:366 conflates "buffer too small" with "record corrupt" — every error path balloons.
store.js:92 inferType guesses type from leading bytes; a blob starting tree /commit is misclassified, changing its computed sha.

Buffer sizes track the RESOLVED object size (grow-on-NOROOM, capped); a corrupt record fails fast with a code, never balloons; type comes from the pack's own object header, not a byte-shape guess.

Repro-first: an object >delta-length indexes correctly; a corrupt record fails fast; a blob shaped like a tree header types as blob.