Hold 0050's budget, its floor and the order a decode waiting for room is started in

.github/coverage/pinned-surface

@@ -92,5 +92,6 @@ module  src/failure/mod.rs          The one point every failure in the core beco
 module  src/artwork/mod.rs          The decoded image, which holds no decoder yet: #50 is where the decode arrives.
 module  src/artwork/address.rs      Where a requested size becomes the size asked for and where an identifier and a tag a server sent stop being values and become part of a request. A defect here is a full-resolution fetch for a tile nobody sized, or a server choosing a path the core then sends against a host it already resolved.
 module  src/artwork/announced.rs  0053's ordered window, its bound, and which callers are sharing one entry's fetch. A defect here abandons a fetch a second tile is still waiting on, which shows a person a missing image and reads exactly like a slow server, or holds a queue proportional to a library rather than to what will be drawn.
+module  src/artwork/budget.rs  0050's bound on decoded bytes held at once, and the admission that keeps it: what a buffer costs at four bytes a pixel, the floor 0055 fixes, and the order waiting decodes are released in. A defect here allocates several maximal images at once on a television, which is the allocation 0055 exists to refuse arriving by a second route, or starves a large decode behind small ones.
 module  src/artwork/format.rs       Everything 0055 puts before a decoder: which three formats are accepted, the signature match that decides from the bytes rather than from what a server declared, and the two bounds read before pixels are allocated. A defect here hands the most attacked surface in this repository something nobody chose to accept.
 module  src/artwork/presence.rs  What an item has for one image kind. 0055 makes an absence and a refusal two different statements, and a defect here is a server sending bytes the core refused being shown as an item nobody photographed.