fix(reliability): bound cyclic document snapshot traversal

[seonghobae]

Closes #217.
Closes #219.
Closes #224.
Closes #225.
Closes #231.
Closes #232.
Closes #336.

Boundary

Protected shipped truth and the frozen v0.6.0 source candidate remain main@3b38ead2d00f44eb578d0689087b9293b3dabe1e. This Draft is the canonical Inkspan writer for src/components/editorDocumentSnapshot.ts and its focused tests. It hardens detached local TipTap/custom-extension snapshots against cycles, accessors, symbols/non-enumerable properties, exotic containers, hostile reflection/proxy failures, unsupported/non-finite primitive values, lossy array shapes, and invalid runtime editor modes. Host transport, persistence, tenancy, authorization, credentials, durable audit, remote-provider authority, and model policy remain out of scope.

TDD lineage

Representative immutable RED generations include cycle 8d8540a604ae17ac9adad4a024d120027caa6003, accessor 5e054c157a0b5c7c592185e62689d5bdec0da29d, non-JSON property-shape e8163757efe561484618ff57c17738c4bc624713, exotic-container 7a5d60472bddd98a3d4f9da547463ab1d29e3bdf, non-JSON primitive aeacdb0d96f5938f3e3b60dd2f8c1f8f6d7135ff, lossy-array 16962e58621aca6fbccbeb71ef9a104d2b364143, and runtime-mode 7bdded7ce5ab6825ffb0e98b96e1aa7e937c670d. Historical GREEN evidence belongs only to its exact predecessor heads and is not transferred to the current generation.

Current repair contract

• Iterative enter/exit DFS rejects cycles without recursive call-stack growth while preserving shared acyclic references.
• Reflection uses own keys/descriptors and never evaluates accessors; hostile reflection/proxy failures become stable payload-redacted RangeError boundaries.
• Containers are restricted to arrays and plain/null-prototype objects, including compatible cross-realm plain objects.
• Object properties must be enumerable string data properties; primitive leaves must be JSON-compatible finite values.
• Arrays must expose exactly dense indices plus intrinsic length; holes, symbols, hidden/extra metadata, accessors, and lossy shapes fail closed.
• createEditorDocumentSnapshot() accepts runtime markdown or html only and rejects any other value before null-editor or live-editor state access.
• Valid TipTap JSON identity, Markdown/HTML/plain-text projections, empty-snapshot semantics, and deep freezing remain unchanged.

Protected-main synchronization

Current exact head is eafd5462db71654e7fa85fd3aa8804d7c51c55f6. It is a non-destructive two-parent synchronization commit whose first parent is the prior product head 8ba5cbe9edca324e5ac49a8969a8d68aee4e500a and whose second parent is exact protected main@3b38ead2d00f44eb578d0689087b9293b3dabe1e. The resulting tree is exact protected main plus only four intended branch-owned files:

• src/components/editorDocumentSnapshot.test.ts;
• src/components/editorDocumentSnapshot.ts;
• src/components/editorDocumentSnapshotModeRuntime.test.ts;
• src/components/editorDocumentSnapshotReflectionBoundary.test.ts.

Fresh compare reports merge base exactly 3b38ead2d00f44eb578d0689087b9293b3dabe1e, ahead 23 / behind 0, with exactly those four changed files. No force push or destructive rebase was used.

Exact-current-head evidence

For unchanged exact head eafd5462db71654e7fa85fd3aa8804d7c51c55f6, fresh exact-head refetch now proves all repository workflows are terminal success:

• CI 32101276070: completed / success;
• Security Scan 32101276077: completed / success;
• SAST Semgrep 32101276001: completed / success;
• formal reviews: 0;
• unresolved inline review threads: 0;
• GitHub reports the Draft mergeable.

These repository-local exact-head results are technical evidence only. They do not establish separately applicable central required workflows or qualifying independent approval. Predecessor, absent, queued, skipped, cancelled, stale, status-only, or model-only evidence remains non-passing.

Integration boundary

Keep Draft/unmerged while #118 freezes protected main for v0.6.0 operational acceptance and while qualifying independent approval plus every applicable central exact-head gate remain incomplete. Before any lifecycle transition, refetch the unchanged head, protected main, ancestry, mergeability, formal reviews/threads, live rules and every applicable required workflow. Do not move protected main, weaken gates, self-approve, transfer predecessor evidence, or fabricate tag/release identity.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Restacked onto current protected main and retained the iterative snapshot-validation boundary.

Validation at a67d7223aad1c31b4da23f287a28e1bf4cfb6e65:

• focused snapshot/reflection/exact-head tests: 34 passed
• typecheck passed
• full root suite: 158 files / 902 tests, 100% coverage
• production build and packed-package verification passed

Cycles, hostile reflection, lossy arrays, exotic containers, invalid primitives, and invalid runtime modes fail closed while shared acyclic values and valid TipTap snapshots remain supported. @codex review

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.