Limit RC10 manifest traversal

backend/tests/test_rc10_data_operations.py

@@ -161,6 +161,18 @@ def test_referenced_tile_manifest_protects_its_tiles(tmp_path: Path) -> None:
     assert tile.resolve() in expanded
 
 
+def test_ordinary_json_export_is_not_treated_as_an_artifact_manifest(tmp_path: Path) -> None:
+    audit = load_script("audit_data_operations.py")
+    storage = tmp_path / "storage"
+    export = storage / "exports" / "project" / "report.json"
+    export.parent.mkdir(parents=True)
+    export.write_text(json.dumps({"dataset_id": "not-a-file"}), encoding="utf-8")
+
+    expanded = audit.expand_manifest_references({export.resolve()}, storage)
+
+    assert expanded == {export.resolve()}
+
+
 def test_disk_pressure_uses_absolute_headroom_for_large_arrays(
     tmp_path: Path,
     monkeypatch: pytest.MonkeyPatch,