fix(transport): pin a compressed copy of the decrypted bundle on the import session, release the upload buffer early, document the footprint (review 2026-10-21 04/M2)

tests/ZB.MOM.WW.ScadaBridge.Transport.Tests/Import/BundleImporterLoadTests.cs

@@ -197,8 +197,7 @@ public sealed class BundleImporterLoadTests
         Assert.NotEmpty(session.DecryptedContent);
         // The decrypted payload must round-trip back to the original DTO so the
         // PreviewAsync phase can deserialize it directly from the session.
-        var roundTripped = JsonSerializer.Deserialize<BundleContentDto>(
-            session.DecryptedContent, BundleJsonOptions);
+        var roundTripped = BundleImporter.ReadSessionContent(session);
         Assert.NotNull(roundTripped);
         Assert.Single(roundTripped!.Templates);
         Assert.Equal("Pump", roundTripped.Templates[0].Name);
@@ -718,6 +717,37 @@ public sealed class BundleImporterLoadTests
         Assert.NotNull(otherSession);
     }
 
+    // ─────────────────────────────────────────────────────────────────────
+    // Review 2026-10-21 04/M2 — resident session footprint.
+    // ─────────────────────────────────────────────────────────────────────
+
+    /// <summary>
+    /// Verifies that an open session pins a compressed copy of the decrypted content
+    /// rather than the raw plaintext JSON, and that the copy round-trips to the DTO.
+    /// </summary>
+    /// <returns>A task that represents the asynchronous operation.</returns>
+    [Fact]
+    public async Task LoadAsync_pins_a_compressed_copy_of_the_content_on_the_session()
+    {
+        var rig = BuildRig();
+        var bigDescription = string.Concat(Enumerable.Repeat("pump station telemetry ", 20_000));
+        var content = SmallContent() with
+        {
+            Templates = new[] { SmallContent().Templates[0] with { Description = bigDescription } },
+        };
+        var plaintextLength = JsonSerializer.SerializeToUtf8Bytes(content, BundleJsonOptions).Length;
+        using var packed = PackEncryptedBundle(
+            rig.Serializer, rig.ManifestBuilder, rig.Encryptor, content, "secret123");
+
+        var session = await rig.Importer.LoadAsync(packed, passphrase: "secret123");
+
+        Assert.True(
+            session.DecryptedContent.Length < plaintextLength / 4,
+            $"session pins {session.DecryptedContent.Length} bytes for {plaintextLength} bytes of plaintext");
+        var roundTripped = BundleImporter.ReadSessionContent(session);
+        Assert.Equal(bigDescription, roundTripped.Templates[0].Description);
+    }
+
     // ─────────────────────────────────────────────────────────────────────
     // Register row 43 — abandoned-session release.
     // ─────────────────────────────────────────────────────────────────────