fix(runtime): replace silent catches in overlay with console.warn

[hqhq1025]

Summary

• The 8 catch (_) {} blocks in packages/runtime/src/overlay.ts swallowed every error from postMessage, listener attach/detach, and setInterval calls — making sandbox iframe issues invisible.
• Replaced each with catch (err) { console.warn('[overlay] <context>:', err); } so failures surface in the iframe DevTools console without changing overlay behaviour.
• console.warn is the proper diagnostic channel inside the sandboxed renderer iframe (no IPC needed, doesn't escalate to IFRAME_ERROR loop).

Locations covered (line numbers in original):

• L60: postMessage ELEMENT_SELECTED failed
• L75: postMessage IFRAME_ERROR (error) failed
• L89: postMessage IFRAME_ERROR (unhandledrejection) failed
• L103: removeEventListener failed for <evt>
• L104: addEventListener failed for <evt>
• L107: attach window error listener failed
• L110: attach unhandledrejection listener failed
• L114: setInterval reattach failed

Compatibility / Upgradeability / No bloat / Elegance

• Compatibility: green — no API or behaviour change; identical control flow.
• Upgradeability: green — easier to diagnose iframe issues going forward.
• No bloat: green — zero new deps; +0 net lines (8 catches reshaped in place).
• Elegance: green — replaces silent failure with contextual diagnostics.

Test plan

• pnpm typecheck
• pnpm lint (exit 0; pre-existing warnings unrelated)
• pnpm --filter @open-codesign/runtime test — 3/3 passed
• Pre-commit hook ran full repo test suite — all green

[github-actions]

Findings

• [Major] Unbounded warning spam in 200ms reattach loop can become a log-amplification DoS in hostile iframe content — console.warn(...) now runs on every failed listener operation inside reattach(), which executes every 200ms, so malicious/generated code that breaks addEventListener/removeEventListener can flood logs and degrade runtime responsiveness, evidence packages/runtime/src/overlay.ts:103.
  Suggested fix:

  var warned = Object.create(null);
  function warnOnce(key, err) {
    if (warned[key]) return;
    warned[key] = true;
    console.warn('[overlay] ' + key, err);
  }
  
  // in reattach loop
  try { document.removeEventListener(spec.evt, spec.fn, true); }
  catch (err) { warnOnce('removeEventListener failed for ' + spec.evt + ':', err); }
  try { document.addEventListener(spec.evt, spec.fn, true); }
  catch (err) { warnOnce('addEventListener failed for ' + spec.evt + ':', err); }

Summary

• Review mode: initial
• 1 issue found in modified lines.
• docs/VISION.md and docs/PRINCIPLES.md: Not found in repo/docs.

Testing

• Not run (automation). Missing coverage for repeated listener-failure path to verify logging is rate-limited.

open-codesign Bot

[github-actions]

[Major] This catch now warns inside a function that runs every 200ms; if sandbox content breaks listener APIs, this can emit warnings continuously and degrade runtime (log-amplification DoS). Please gate this with warn-once or rate-limiting.

Suggested fix:

var warned = Object.create(null);
function warnOnce(key, err) {
  if (warned[key]) return;
  warned[key] = true;
  console.warn('[overlay] ' + key, err);
}

try { document.removeEventListener(spec.evt, spec.fn, true); }
catch (err) { warnOnce('removeEventListener failed for ' + spec.evt + ':', err); }

[github-actions]

Findings

• [Minor] Silent fallback reintroduced in warnOnce — console.warn failures are swallowed with catch (_) { /* noop */ }, which conflicts with the repo rule that errors must surface (UI or throw with context); this can hide diagnostics when console APIs are patched/broken, evidence packages/runtime/src/overlay.ts:26.
  Suggested fix:

  function warnOnce(key, err) {
    if (warned[key]) return;
    warned[key] = true;
    console.warn('[overlay] ' + key, err);
  }

Summary

• Review mode: follow-up after new commits
• 1 issue found in modified lines.
• docs/VISION.md and docs/PRINCIPLES.md: Not found in repo/docs.

Testing

• Not run (automation)

open-codesign Bot

[github-actions]

[Minor] warnOnce currently swallows console.warn errors (catch (_) { /* noop */ }), reintroducing a silent fallback. Please let this throw (or surface via existing iframe error channel) so failures are observable with context.

Suggested fix:

function warnOnce(key, err) {
  if (warned[key]) return;
  warned[key] = true;
  console.warn('[overlay] ' + key, err);
}