fix(reliability): harden public Markdown and local serialization boundaries

[seonghobae]

Closes #169.
Closes #171.
Closes #173.
Closes #175.
Closes #177.
Closes #181.
Closes #204.
Closes #209.
Closes #223.
Closes #226.

Consolidated single-writer boundary

This Draft remains the existing Inkspan source owner across the overlapping public Markdown adapter, editor serialization, canonical envelope encoding, SafeLink resource policy, plain-text projection, and full-document email serialization option boundaries. Protected main is the only shipped implementation authority; #118 remains the stable-release operational-acceptance boundary.

Standalone/product authority is unchanged: no service, database, network, credential, model, tenancy, durable persistence, transport, deployment, durable audit, Yjs authority, or durable PDF authority is introduced. Model/provider output remains untrusted proposal data.

Active-PR behavior

The current branch:

• bounds public Marked/Turndown entry paths before parser materialization while preserving exact UTF-8 accounting and shared defaults/hard ceilings;
• fails closed on malformed runtime option bags without invoking accessor getters, coercing unsupported values, or reflecting caller-thrown values;
• rejects non-string HTML before caller property access, browser DOM materialization, or browserless parsing with stable payload-redacted errors;
• bounds canonical-envelope output encoding and SafeLink validation before avoidable allocation/parser work;
• preserves accepted Markdown/GFM, safe image/link policy, image-alt semantics, RFC 8785 canonical bytes, editor HTML/Markdown semantics, and package/SSR/browser/Office behavior;
• validates full-document email languageTag, textDirection, and title before Markdown parser materialization; and
• detects browser capability without invoking an ambient globalThis.window accessor and neutralizes the pinned Turndown ambient-window probe so packed ESM/CJS /markdown consumers remain standalone under hostile ambient browser accessors.

These are active-PR claims only until integrated into protected main.

Test-first lineage

Branch history contains realistic RED→GREEN lineages for Markdown resource bounds, editor serialization modes, canonical envelope encoding, SafeLink validation, plain-text runtime options, email metadata, hostile option bags, non-string HTML, and ambient browser-authority isolation. Predecessor/cancelled/synthetic generations remain lineage only.

For the cross-lane defect reproduced by #381:

• RED 19e5052c440b1852b898228a3bacdf2fa3ad1b20 added the packed hostile-ambient ESM/CJS regression; exact CI 32869680521 failed specifically at packed-package consumers after typecheck, 100% coverage, and build reached the intended boundary;
• narrow repairs were ef5b707d5b2ec8dcbd99fde0af44c398a539176e, 3123981884cebd2dd81f022b25445702d6d55906, and the historical repair head e1345c45ba9bf8e75bdab8ad7f56c7d7437f1470;
• CI 32871290927 is terminal success for that contributor head and verifies the packed consumer regression. feat(reference-host): add buyer integration safety fixtures #381 must inherit this owner repair rather than duplicate it.

Current prerequisite integration — 2026-09-05

Validated local source: 94b5ca815749a7dd6bc071106eb685d2a193e4dd. The canonical #402 foundation at 637b910d25dabb363e40d535c6d89f4a5beb8c6d was inherited through a conflict-free normal merge, without dropping this owner's Markdown, canonical encoding, SafeLink or privacy deltas. The branch remains Draft and is stacked on codex/fix-python-boundary-coverage. Protected main was freshly resolved independently as 0b88c16f14f51b54a87eb7164f0edfb06dd60902; neither this PR nor #402 is shipped authority.

The inherited dependency, public TipTap type, Python matrix and declaration-boundary changes remain owned by #402. Installation used its checked-in lock file with no new version selection. The former source-reconciliation TOOL_UNAVAILABLE/divergence paragraphs are superseded by verified ancestry and this supported non-force integration.

The canonical allocation experiment was rejected and reversed normally. Its only net addition before prerequisite integration is an exact-byte test for empty containers, mixed values and numeric-looking property-name ordering. No speedup or 20ms claim follows from that experiment.

The separately retained native encoder reuse from #379 commit 9258bdbdf8ec8ca87ab25b576fe2599c88ba9040 is now consolidated here, preserving hostile-option checks and both output-size guards. The new regression was RED on receiver identity and now verifies reuse without sharing output buffers. Its source reconciliation record records the standard, alternatives, origin and historical-performance limits. #379 inherits this owner; it no longer owns a conflicting canonical source delta. The earlier 8.7% no-op diagnostic is not a current-head speedup claim.

Exact-head local evidence

On 94b5ca815749a7dd6bc071106eb685d2a193e4dd:

• pnpm coverage --maxWorkers 2: 170 files, 1,002 tests passed; 100% statements, branches, functions and lines.
• pnpm build: full declared build and strict TypeScript passed.
• pnpm verify:package: package contents, declaration boundary, ESM/CJS, strict independent consumers and framework-free public subpaths passed.
• Full repository browser suite: 70 passed across Chromium, Firefox and WebKit, including clipboard consensus; 0 unexpected, skipped or flaky tests. This is current-head source-harness evidence, not a published package claim.

The first package check correctly rejected stale pre-migration declarations left by an earlier partial build. The complete source build removed that mismatch; the failure log is retained. The verifier and its declaration guard were not weakened or changed. A successful package check is not a protected publication.

Remaining integration gates

#381 remains the reference-host consumer and inherits this owner normally. #379 retains performance acquisition; #402 retains foundation/dependency ownership; #118 retains release acceptance. No predecessor is closed or declared superseded without complete valid-delta and acceptance proof.

Before Ready or merge, refetch independent live head/base refs, ancestry and active writers, reviews and unresolved threads, effective rules, all required repository/central jobs with their actual checkout/source SHA, and current package/browser/Office/security evidence. Queued, skipped-required, cancelled, absent, failed, stale, wrong-source or model/status-only evidence is non-passing.

Keep Draft and preserve parent-before-child protected integration. No self-approval, force push, bypass, gate weakening, tag or publication.

[seonghobae]

Exact cross-lane defect handoff from the current #377 reference-host acceptance lane; this belongs here because #176 explicitly remains the sole active writer for the public Markdown adapter/serialization boundary.

Affected Inkspan evidence

• protected main: fd75c835a2a7c5d9a1f57c3e080364237d69819a;
• feat(reference-host): add buyer integration safety fixtures #381 exact head: 1fb2d317838ff0ed71001d470af650692ebd36b2;
• CI run 32864768290, exact-checkout build/test job 97857195953;
• typecheck passed; 171 test files / 921 tests passed before the only failing file;
• src/referenceHostFrameworkFreePackedBoundary.test.ts: 2 failures, ESM and CJS packed @contextualwisdomlab/cwl-editor/markdown imports;
• both processes install only the exact packed Inkspan artifact, poison ambient globalThis.window/document accessors to throw, and perform no network/model/credential setup.

First causal boundary / falsifiable RCA
The packed cwl-markdown.js and .cjs evaluate createInertBrowserFragment(). Current protected source and #176 current head both contain if (typeof window === 'undefined') return null;. In Node, when globalThis.window is an accessor, resolving window for typeof window invokes that accessor. The exact failure is Error: browser window authority is forbidden, with the ESM stack at dist/cwl-markdown.js:15128:10 and CJS stack at dist/cwl-markdown.cjs:118:2075. This falsifies the stronger standalone/headless claim that importing the Markdown subpath does not touch ambient browser authority.

This is not correctly repairable in #381: changing src/markdown/serializer.ts there would create a competing writer against #176's declared sole Markdown ownership. #381 should revalidate after this owner integrates rather than duplicate the source fix.

RED acceptance to carry here
A packed ESM+CJS regression equivalent to #381's referenceHostFrameworkFreePackedBoundary must define throwing own accessors for globalThis.window and globalThis.document, import the exact packed /markdown subpath, and execute representative markdownToPlainText/markdownToHtml/htmlToMarkdown behavior without invoking either accessor or any network/credential/model authority.

Material remedy choices

1. Preferred/smallest: make browser capability detection descriptor-safe so merely determining environment cannot execute an ambient accessor; preserve the detached-template browser path and Domino browserless fallback. Blast radius is limited to environment detection and is easy to roll back.
2. If descriptor-safe browser identity cannot be made portable across supported browsers, use the bundled standalone non-fetching parser for the public Markdown path in all runtimes and retire the ambient template dependency, but only with browser fidelity/security regressions because this changes parser-path architecture.
3. Do not weaken/remove the packed boundary test or catch the sentinel error; that would hide the authority violation.

GREEN required
Focused packed ESM+CJS hostile-ambient regression + #176 full 100% coverage/typecheck/package tests + fresh exact-head Security/SAST, then #381 must be revalidated against the integrated owner result. Pending/skipped/predecessor evidence is non-passing.

[seonghobae]

Restacked onto protected main at a40b9489665bed7d95af619a6079b9c51cab299a; exact head is 87e414faafbf839ecdc54c8b5b51940f1fa73907.

Fresh verification:

• Markdown/resource-policy stack: 20 files / 223 tests passed
• TypeScript typecheck: passed
• full Vitest suite: 170 files / 999 tests passed
• coverage: 100% statements, branches, functions, and lines
• production build and all packed-package consumers, including /markdown: passed
• Python support contract: 4 passed
• unresolved review threads: 0

This remains draft and dependency-gated by #118.

@codex review

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[seonghobae]

Canonical allocation experiment — rejected (2026-09-05 UTC)

The profile-directed experiment stayed in this existing canonical-serialization owner. No competing runtime writer was added to #379.

• Baseline: 6fbef42c6304f911f537909a5383118388921e6c.
• Exact-byte container regression: 5e90776b; preserves empty arrays/objects, mixed primitive values and lexical ordering of numeric-looking property names.
• Trial: 33bc6e16c5eceafdfd700f4a758470e019a06434, replacing per-container mapped fragments with direct string accumulation.
• Rejection/restoration: d6341cf9e96020a4129289514e583ad063a154e1. The only net change from the prior head is the 12-line regression test. Runtime source and rebuilt revision module are byte-identical to baseline.

The diagnostic protocol retained all four committed synthetic profiles from #379, one fixed untimed correctness call and 25 actual changed-transition calls per profile in each of three fresh processes per phase. All 900 measured calls across baseline/trial/recheck are retained locally; every previous/resulting revision pair matches. This is owner-built module research, not full packed-package, browser, customer workload, supported-envelope, protected-release or 20ms acceptance evidence.

Profile	Baseline median of three p95 (ms)	Trial median of three p95 (ms)	Restored-baseline recheck (ms)
small	0.686825	0.554933	1.175391
medium	2.367542	1.990209	3.978850
large	6.976941	6.546033	15.493258
stress	27.222166	26.766158	52.000450

The trial's stress difference was only -1.675%, smaller than repetition variation, with an additional 119 ESM bytes. Restored-baseline p95 values were 177.257383, 42.218900 and 52.000450ms despite identical module bytes. The available shared-host evidence therefore does not establish a causal speedup; the trial was discarded. No outlier was dropped, denominator reduced, warm-up enlarged, deadline relaxed or security check bypassed. A later host snapshot showed concurrent VM/other activity, but it does not prove the cause of any earlier sample.

Baseline/restored revision module SHA-256: 4310649f0de901ab8c075d502691b3092b20aea85038fe4284b59c6e27166fcd.
Trial module SHA-256: 00f9feeeaac093ea9e15d5c06bb8649eaac538961a1b4c65e3cb23dba2d9018a.
Node 24.19.0. Complete diagnostic protocol, samples, module copies, summary and ignored results log are retained in the local experiment evidence directory.

Current-head pnpm coverage --maxWorkers 2: 170 files, 1,000 tests passed, all four coverage dimensions 100%. Strict TypeScript passed. The trial's focused envelope/revision suite passed 48/48; this did not override the unsuccessful performance result.

The unchanged serialization contract remains aligned with RFC 8785 property ordering, Unicode preservation and primitive serialization. Reference: Rundgren, A., Jordan, B., & Erdtman, S. (2020). JSON Canonicalization Scheme (JCS) (RFC 8785). RFC Editor. Existing Inkspan negative-zero/Unicode rejection and bounded encoding semantics were preserved.

Keep Draft. Fresh hosted checks, independent review, parent reconciliation and protected integration remain required. No merge, publication or speedup is claimed.