[LIghtJUNction]

Refs #80, #82, #83, #85. Client-only follow-up to #176, independent of #177's server cursor fix. Base 45470b5a46bccfc4f12ef27acccecc2f3bafce47.

Fix

Head 517f7e296fa7ef504d2066980454654ed0634598, tree 0784e6acad28d37615065c588bb7525efd8295d8.

Exactly two inserted runtime lines in MsgClient.upload and MsgClient.download: require positive non-bool integer part_bytes before source hashing, journal/partial file access or network requests. Invalid input raises invalid_part_bytes. No server code, schema, protocol/journal format or packaging changes. Full modified client blob cffffa10ccbd62249f0ad991e7c81a3cd146cdf6 independently matches the prepared two-line diff.

Real cloud RED

Run 36561926956, job 109384609384, Python 3.15.0rc2. Regression head cbd4f4f8642e50a10366fd5fe150a4cbd28052a0; actual synthetic checkout fd6bfce96dea97da81c7679953c5433896a64967 has the identical tree b37543923fb4a7ca1503be757fe1f184f44a2749.

23 cases: 14 intended failures, 9 passes, 0 errors/skips. The zero-size test records two successful signed zero-byte reads at offset 3 before a third-call guard stops the original non-progressing loop. Invalid downloads fail too late; invalid uploads access the missing source first. All four valid cross-protocol resumes and five existing client tests pass. No timeout, fake successful server response, skip or test correction.

Artifact 11029863272 independently downloaded/hashed and source.json/JUnit inspected: SHA256 b28e2465340371a16e11307adb0a238bbc4ab7bd861edf650aec7e9a1a30e5f8.

Verification

Final head has been pushed to trigger cloud verification. Both focused and full four-shard completeness/conformance/build gates still need final inspection; no green claim yet. Tests require zero requests and unchanged local file hashes/modes/mtimes on rejection, with real PostgreSQL read-only evidence and exact-byte normal resume over HTTP/PathGET/GraphQL/MCP.

Notes: docs/CLIENT_PART_BYTES_PROGRESS.md. No local project execution, production action or broad issue closure.

[LIghtJUNction]

最终专项 GREEN 已独立核验：run 36562769933，23/23 唯一 JUnit cases，0 failures/errors/skips。实际 checkout 4afe15c3584a221176989144039c08bc8b5da760 的 tree 0784e6acad28d37615065c588bb7525efd8295d8 与本 PR head 517f7e2 相同。

Artifact 11029894918 已下载，ZIP SHA256 a4c49e5260c2bce3b5936ebbdc7f9118f85bc487c8e6967698957f53843cec8c 独立匹配；source.json 和完整JUnit已检查。14个非法输入回归与四协议正常续传及现有5个客户端用例全部通过。

全量存在集成基线的4个失败（只读路径检查1个、Webhook重叠去重3个），不是本PR改动。为避免重复验证/合并，本 PR 全部提交历史已纳入 #179；由 #179 修复这些基线阻塞并统一跑最终全量。请不要单独合并此 PR；#179 接受后再标记 incorporated。