disk: refuse oversized safe_ncdu top queries

dotfiles/agents/skills/disk-space-assessment/SKILL.md

@@ -121,6 +121,8 @@ python /srv/dotfiles/dotfiles/agents/skills/disk-space-assessment/scripts/direnv
 
 This separates collectively direnv-only paths from paths retained by non-direnv roots and estimates each project's marginal uniquely retained footprint. Read `references/direnv-gc-roots.md` before interpreting or acting on the result.
 
+For very large `/nix/store` exports, use `safe_ncdu open` for read-only navigation and the Nix audit tools for noninteractive attribution. `safe_ncdu top` refuses snapshots over 128 MiB compressed by default because its jq parser may exhaust memory. Do not estimate physical store usage by summing raw ncdu JSON `dsize` fields; use `du -sx --block-size=1 /nix/store` when a hardlink-aware physical total is necessary.
+
 ## Assessment Handoff
 
 Return:

dotfiles/lib/functions/safe_ncdu

@@ -184,7 +184,14 @@ function _safe_ncdu_top {
         echo "safe_ncdu top: missing SNAPSHOT" >&2
         return 2
     fi
-    _safe_ncdu_require zstdcat jq awk || return 1
+    _safe_ncdu_require zstdcat jq awk stat || return 1
+    local compressed_size
+    compressed_size="$(stat -Lc '%s' "$snapshot")" || return 1
+    if [[ "$compressed_size" -gt 134217728 && "${SAFE_NCDU_ALLOW_LARGE_TOP:-0}" != 1 ]]; then
+        echo "safe_ncdu top: snapshot is larger than 128 MiB compressed; jq analysis may exhaust memory" >&2
+        echo "safe_ncdu top: use 'safe_ncdu open $snapshot' or a domain-specific audit instead" >&2
+        return 2
+    fi
     zstdcat "$snapshot" | jq -r --argjson limit "$limit" --arg path "$query_path" '
       def total:
         if type == "array" then