[snkmcb]

Summary

• Pin OpenStrata 0.23.20, regenerate the 12-cell source CI workflow, and update the build and install documentation. The release preflight reads the new pin from openstrata.ci.yaml.
• Check the declared expanded size of meta.json before allocating or inflating the entry in bundled SOG. Full and metadata-only reads report GSSOG-E016 when it exceeds 4 MiB.
• Add synthetic fixtures for metadata at the limit and one byte over it, plus a ZIP with exactly 64 entries.

Why?

The v0.6.0 roadmap calls for hostile-input coverage. The ZIP reader previously attempted extraction under its general per-entry budget before applying the smaller metadata budget. OpenStrata 0.23.20 also fixes how the viewer finds the managed stage for the selected target. OpenStrata release notes

Validation

• Windows, OpenUSD 26.08 and OpenStrata 0.23.20. CTest passed 18/18 with PYTHONUTF8=1, including the resolver and benchmark suites. The new oversized-metadata fixture reproduced GSSOG-E004 before the fix and passes with the expected GSSOG-E016 afterward.
• ost plugin test --workspace --up-to 5 and the corresponding --from-package run passed for PLY, SPZ, and SOG. Two aggregate packaging runs produced the same SHA-256.
• ost ci validate, workflow regeneration, release preflight, and clang-format checks passed. All three new fixtures regenerated byte-for-byte.

Checklist

• Linked the roadmap and upstream release.
• Ran the relevant local checks.
• Updated the import-limit documentation and tests.
• All new assets are synthetic fixtures.

Reviewer notes

Hosted verification for the new pin will run on this PR.