[ctoth]

Quire can write a valid loose blob and then fail to read it after reopening the repository with Dulwich 1.2.9. An 8,182-byte payload passes, while 8,183 and 200,000 bytes raise zlib.error: object header exceeds maximum size through GitStore.read_file. Native Git reads those same disk-backed objects successfully.

Require and lock Dulwich 1.2.10, which contains the upstream loose-object header parsing fix. Add a three-case public disk-store regression that verifies the loose object exists, closes the repository, reopens it and reads its contents. No production Python changes or unrelated dependency updates. Existing PR #8 remains untouched.

Validation:

• Actual installed 1.2.9: two expected regression failures, one boundary case passes.
• Actual installed 1.2.10: tests/test_git_store.py — 52 passed on Python 3.13.15.
• 1.2.10 still rejects oversized headers and enforces caller-supplied object-size limits.
• Locked install succeeds. All 36 locked Dulwich artifacts match official PyPI metadata; dependency edges and every unrelated locked package are unchanged. The 35-wheel set follows upstream's two cp313 Android API 21-to-24 tag changes.
• Full Ubuntu/Windows Python 3.11/3.13 lint, typecheck, tests and build run in the existing CI workflow.

Draft for independent review. Task evidence and exact reproduction commands are in agent-notes/fix-dulwich-loose-object-reading.md.