fix(reliability): preflight guarded-restore digest capability

[seonghobae]

Closes #276.

Exact stacked boundary

This Draft is stacked on the current exact predecessor PR #222 head c4cbb7b164bf9be4c758e7c8e6a0b02384b695b1, branch fix/digest-provider-preflight-221. Protected shipped truth remains separately resolved as main@3b38ead2d00f44eb578d0689087b9293b3dabe1e; #118 owns the frozen v0.6.0 publication/operational-acceptance boundary.

The prior #277 head b9ddcdd0f41832c81a716c82c76963a5fd41e70f was correctly stacked on predecessor #222 head 6efe49b7f91a8cfff2a2cd28ee281fe4feb4957f, but #222 subsequently advanced to c4cbb7b.... Fresh comparison then showed this child diverged 4 ahead / 11 behind the live predecessor even though this lane owns only two guarded-restore paths.

Current exact head bdc7f55bd9c47d99dd192352721b471df35bbe4c repairs that ancestry contradiction non-destructively. It is a two-parent restack whose first parent is prior child head b9ddcdd0... and whose second parent is current #222 head c4cbb7b.... Its tree is exact current #222 plus only:

• src/documentEnvelopeIfMatch.ts; and
• src/documentEnvelopeIfMatchDigestPreflight.test.ts.

Fresh comparison from exact current #222 -> this exact head reports merge base exactly c4cbb7b164bf9be4c758e7c8e6a0b02384b695b1, 5 ahead / 0 behind, with exactly those two changed files. No force push or destructive rebase was used.

Test-first proof

The dedicated real-editor regression landed first on 6bbd5eb3d040c45e4e2636ea687ff26df6c3845e, then the byte-path companion on 042e8d800b567d50888904b0cb8772ba41ed0833.

Exact checkout CI 31592476116 on 042e8d800b567d50888904b0cb8772ba41ed0833 reached normal setup, immutable install, typecheck, browser evidence, and every Office lane. The JS coverage job then produced the intended product RED: all three new assertions failed while 824 unrelated tests passed. Invalid providers serialized the current document (toJSON() observed 3 calls on both object and byte paths), and an accessor-backed digest capability was read twice rather than once.

Pre-restack product head a82c90598ac527ed71e9c32184783f78d1441c63 resolved the digest provider exactly once before current-document serialization, preserved the callable receiver, and reused the captured resolved capability for both the current and resulting revision digests. Those predecessor results remain lineage only after subsequent stack movements and do not transfer to the current head.

Narrow repair contract

• malformed-tag validation and destroyed-editor conflict precedence remain ahead of provider resolution;
• one usable digest capability is captured before current-document serialization;
• the exact callable receiver is preserved;
• the same captured capability is reused for both guarded revisions;
• moved-document conflicts, mismatch-without-source-inspection, object/byte source validation, schema and transaction-policy enforcement, atomic application, exact revision/envelope pairing, payload-redacted errors, and emitUpdate=false behavior remain unchanged; and
• no transport, persistence, authorization, tenancy, credential, model/provider, migration, retention, deployment, durable-audit, or release authority is added.

Exact-current-head evidence

For unchanged exact head bdc7f55bd9c47d99dd192352721b471df35bbe4c at the latest refetch:

• pull-request workflow runs returned: none;
• formal submitted reviews: 0;
• unresolved inline review threads: 0;
• GitHub reports the Draft mergeable.

Absent workflow evidence is non-passing. Every predecessor CI/Security/SAST/package/browser/Office/review/model/status result is historical after the restack and does not transfer. #299 remains the Inkspan-owned stacked-pull-request trigger-gap path; that dependency does not make absent exact-head evidence passing.

Integration dependency

Keep Draft/unmerged while #222 remains the exact predecessor and #118 owns protected publication acceptance. Any predecessor-head or child-head movement invalidates ancestry and hosted evidence. Before any lifecycle transition, independently refetch exact #222/#277 heads, ancestry, applicable repository/central workflows, formal reviews/threads, mergeability and live governance. Do not self-approve, weaken gates, transfer predecessor evidence, or fabricate tag/release identity.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Restacked onto exact parent #222 head 724f0ca4cd2053eefdba7b6b09e92189003b46f4; exact head is 37dd0f65d8a05f219e12c0c7b60466887a335829.

Fresh verification:

• guarded-restore digest preflight tests: 25 passed
• TypeScript typecheck: passed
• full Vitest suite: 158 files / 890 tests passed
• coverage: 100% statements, branches, functions, and lines
• Python support contract: 4 passed
• unresolved review threads: 0
• mergeability: MERGEABLE

This remains draft and dependency-gated by #222/#118.

@codex review

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.