fix(reliability): preflight oversized autosave arrays

[seonghobae]

Closes #183.
Closes #214.

Current intrinsic array preflight repair — 2026-09-07

Current normal descendant is 903b317fc7a7b0d247b6994796340a7bad33163c, independently remote-verified. The previous public packed queue rejected an oversized frozen array without calling host save, but Object.isFrozen() still invoked its Proxy key trap once before the explicit array limit. Both queue and durable session share this validation function.

Test-only 4fa8d65c reproduced two failures (oversized and over-depth arrays,8 other tests passed). 31227038 keeps object frozen checks early but delays array frozen-state inspection until after existing length, remaining-value-capacity and child-depth guards. All106 autosave tests passed, but branch coverage98.93% correctly failed that acquisition. f7f511d8 adds bounded-unfrozen-array rejection:107 tests across22 files passed, changed-file statements/branches/functions/lines100%, TypeScript passed. 903b317f adds a Proposed finding to the existing doctoring record. The unchanged full coverage command at903b317f finished with893passed/1failed/894tests across158files in99.95s: the existing5000ms Word-capacity timeout remains a failure. The expired process handle is not used to reconstruct an exit code; the terminal test summary is retained.

Complete build, complete verify:package, and fresh pack at903b317f terminated exit0. All13 configuration tests plus root ESM/CommonJS/SSR/types, canonical envelope/revision, independent revision evidence, framework-free revision-evidence/envelope-identity/autosave, text-position-selector and Markdown consumers passed. Current local0.6.0 archive SHA256: f30073eabfb5e724b10cca54170b26d18fee96a9ae050317e6b1c7bf8d6fced0. Packed autosave JS/map match dist (1757e84a1b710beb159bb268172f86995913dcc05fc751dc983cd2b0d884066b / 69b1c80942e4290b7dea839fcfecbe23f5262a56ec318ff6436d408d110b72fa). The public packed queue probe passes: oversized frozen array invokes0 key traps and0 host saves; bounded mutable array rejects; valid-shaped frozen evidence saves once. Synthetic fixture digest bytes are not authenticated document hashes. This proves the package boundary, not buyer latency, durable persistence, publication or full acceptance.

The extra enumeration is consistent with ECMAScript's TestIntegrityLevel operation, which obtains own property keys after rejecting extensibility. ECMAScript specification. This is an avoided reflection step, not an arbitrary Proxy execution deadline or a measured user-facing speedup. No API, limit, dependencies, timeout, threshold, save authority or immutable-evidence requirement was relaxed. History is preserved without force/amend/reset.

Evidence: /private/tmp/inkspan-pr184-freeze-preflight.mwT5PL; earlier RED/focused/package acquisition logs remain in /private/tmp/inkspan-pr184-package.HFDyyd. Current full tests remain failed; browser/Office and hosted gates remain unproven. The prior Office test run also retained172pass/1failure because its static CI-matrix parser no longer matches protected workflow truth; PR405 is the dedicated owner for that unrelated contract repair. Office runtime coverage598statements244branches100% and docstrings100% do not erase that failure.

Current packed browser and visual findings

At903b317f and archivef30073ea, canonical browser execution failed:54passed/1failed/15notrun/70total,0flaky,140.58179s. Firefox unsafe-javascript-link timed out in afterEach's existing20-second networkidle wait; afterAll correctly rejected incomplete corpus evidence. Chromium/WebKit receipts exist; no Firefox/consensus receipt was manufactured. The first command's unsupported screenshot CLI option failed before tests and is separately retained; it is not counted as runtime evidence. Existing Playwright1.62.0 dependencies were restored offline from the unchanged lockfile.

Actual packed CwlEditor was then mounted in a small host at320x640. All9 normal/forced-colors/read-only screenshots across Chromium, Firefox and WebKit were directly inspected. Text remains readable and read-only hides the toolbar, but image insertion and Alt controls are clipped in all three editable views. Geometry confirms toolbarRight311px versus image-right322.84375/326.88333/337.515625px and Alt-right360.1875/364.699997/375.359375px. This is a visual finding, not visual acceptance, despite the interaction assertions passing. The existing responsive-toolbar owner #151 retains the fix; no duplicate CSS was added here. Browser teardown remains a separate #380 lane. Raw acquisition and scripts remain in the current evidence directory; owned server stopped, release/receipts preserved outside the tracked worktree. No shipped, physical-IME, translated-catalog or full-WCAG claim.

Historical predecessor package verification — 2026-09-07

At unchanged local and remote b775ac3718aa10ff668f3b9b2839e745877c7e8b, complete build, complete verify:package and fresh external pack terminated successfully. All13 package-configuration tests passed, together with root ESM/CommonJS/SSR/type checks and the independently staged/framework-free revision-evidence, envelope-identity, autosave, text-position-selector and Markdown consumers.

Historical local0.6.0 archive SHA-256: fe52766efa3eaefd274e885b9f8f4d4dda6f2f20fb44224bbeadd3fe6d608079. Packed autosave JS/map matched predecessor dist bytes (b7f746cab936a00e84881081a989f689c5219d48cc82d42dbbf8348aa6df6529 / bd840fa7fea53dc77fcd218d05280fc236d063ffd9f0bdc4bbacc48ce277d4a5). Map sourcesContent exactly matched predecessor src/autosave/evidenceValidation.ts (c3fecf4c02b26c012e2d44727292b58ac85a8f884b71def8a03724cff3d6b930). Tracked worktree remained clean and no release directory was introduced. Evidence: /private/tmp/inkspan-pr184-package.HFDyyd.

This is historical predecessor package-consumer evidence only. That predecessor full unit acquisition remains failed (876 passed/15 failed/891 tests plus one unhandled worker RPC timeout); focused29/types and package success do not establish full coverage, browser/Office, hosted acceptance, protected integration or publication. No source, dependency, timeout or threshold was changed during that acquisition.

Scope and authority

This Draft owns detached autosave evidence validation and resource preflight.
It rejects impossible child counts before descriptor enqueueing, includes
already-inspected and pending values in the count, and rejects over-depth
children before reading descriptors. It preserves the one-million-value and
128-level limits, dense-array/extra-key/symbol/accessor/cycle/finite-number/
negative-zero/schema checks, redacted errors and detached snapshots.

Array length is read from its intrinsic descriptor without a caller get trap.
Mandatory record descriptors and frozen state are checked before explicit
whole-record enumeration. Digests require64code units before lowercase SHA-256
validation. No transport, authentication, persistence, credentials, deployment,
model, collaboration-provider or release authority is added.

Preserved test-first lineage

• Array enumeration: RED 8c5246ee → repair e0f4f54a; combined pending-value
  and depth bounds 7138816b.
• Digest length: RED d7d8d879 → repair 6d75be18.
• Array proxy length: RED c55519c1 → repair ca8da4a1.
• Mandatory record fields: RED 245b7c60 → repair 57baa55e/fbecfa05;
  complete-but-unfrozen record assurance 62f406c2.
• Office CI experiment/revert history remains preserved; that separate
  contract is not owned by this PR.

Historical parent synchronization at b775ac3

Previous body snapshots at62f406c2/main3b38ead2 and their hosted green runs are
historical only. The current branch was refreshed from unchanged remote
e146a47f6a0fac976d719096d03b01ce21062991 by normal merge of protected
main@0b88c16f14f51b54a87eb7164f0edfb06dd60902. Merge commit:
b775ac3718aa10ff668f3b9b2839e745877c7e8b. No conflict, force push or
runtime reimplementation. The main delta is only CI exact-head workflow/test
maintenance; this PR still differs from main in its original three owner files.

Pre-merge owner regression baseline:18/18 tests passed. Post-merge owner
regressions plus exact-head CI contract:29/29 tests passed; TypeScript passed.
Normal push and independent remote SHA lookup both confirm b775ac3. Full
coverage failed:876passed/15failed tests in158files,331.31s, plus one unhandled
worker RPC timeout. Fourteen test failures are timeouts and one is a missing
toolbar image assertion; its cause is unproven. Current package, browser,
Office and hosted evidence remain separate; predecessor results do not transfer.

The broader #402 isolated-parser test run exposed a timeout in oversized
autosave evidence traversal. This existing owner already addresses avoidable
enumeration/enqueueing; no duplicate patch was added to #402. Its focused pass
does not prove that every timeout is repaired or establish a buyer latency
speedup. Local protocol/logs: /private/tmp/inkspan-pr184-current.1lXVC7.

Remaining gates

Keep Draft until dependency/release order and applicable policy are satisfied.
Refetch exact head/base, reviews/threads, all required checks and governance
before lifecycle decisions. No qualifying approval, protected merge, shipped
release or old/current evidence equivalence is implied by this body.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Restacked the autosave evidence resource preflight onto exact main@a40b9489665bed7d95af619a6079b9c51cab299a and propagated the event-specific Python matrix contract. Exact head: 6b41807557e6bdb71f08aac9878e8733bc66513f. Fresh local proof: focused autosave validation suite 5 files / 45 tests; TypeScript typecheck; full Vitest 158 files / 890 tests with 100% statements, branches, functions, and lines; production build; all packed package consumers including autosave; Python support contract 4/4. Draft and independent-approval gates remain unchanged.

[seonghobae]

@codex review

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.