fix(reliability): preflight guarded-restore digest capability

[seonghobae]

Closes #276.

Exact stacked boundary

This Draft is stacked on exact predecessor PR #222 head 2228267cc7b4f990b6a58556a74a26dda2685df8, branch fix/digest-provider-preflight-221. The stack is exact: current head a82c90598ac527ed71e9c32184783f78d1441c63 is 3 commits ahead / 0 behind that predecessor and its merge base is the predecessor head. Protected main remains the separate frozen 0.6.0 candidate e8109ec2a17de8bd6594487aa12c8c8a93cb2c03 owned by #118.

Test-first proof

The dedicated real-editor regression landed first on 6bbd5eb3d040c45e4e2636ea687ff26df6c3845e, then the byte-path companion on 042e8d800b567d50888904b0cb8772ba41ed0833.

Exact checkout CI 31592476116 on 042e8d800b567d50888904b0cb8772ba41ed0833 reached normal setup, immutable install, typecheck, browser evidence, and every Office lane. The JS coverage job then produced the intended product RED: all three new assertions failed while 824 unrelated tests passed. Invalid providers serialized the current document (toJSON() observed 3 calls on both object and byte paths), and an accessor-backed digest capability was read twice rather than once.

Narrow repair

Current production commit a82c90598ac527ed71e9c32184783f78d1441c63 resolves the digest provider exactly once before current-document serialization, preserves the callable receiver, and reuses the captured resolved capability for both the current and resulting revision digests.

Malformed-tag validation and destroyed-editor conflict precedence remain ahead of provider resolution. Moved-document conflicts, mismatch-without-source-inspection, object/byte source validation, schema and transaction-policy enforcement, atomic application, exact revision/envelope pairing, payload-redacted errors, and emitUpdate=false behavior remain unchanged.

Exact-head validation

At exact head a82c90598ac527ed71e9c32184783f78d1441c63:

• CI 31592741603: success;
• Security Scan 31592741637: success;
• SAST Semgrep 31592741616: success;
• changed production/test surface remains only src/documentEnvelopeIfMatch.ts plus src/documentEnvelopeIfMatchDigestPreflight.test.ts;
• formal reviews: 0; unresolved review threads: 0.

Integration dependency

Keep Draft/unmerged while #222 remains the predecessor and #118 owns protected registry acceptance. Any predecessor-base or source-head movement invalidates ancestry and hosted evidence; no predecessor check transfers automatically.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 392595a8-c194-4bad-94f7-3ab32ac03da0

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}