fix(reliability): preflight autosave queue save capability

[seonghobae]

Closes #353.

Test-first next-release reliability repair for the framework-free autosave queue option boundary.

Boundary and root cause

Protected shipped truth is independently resolved as main@3b38ead2d00f44eb578d0689087b9293b3dabe1e. The predecessor source at e8109ec2a17de8bd6594487aa12c8c8a93cb2c03 validated the queue option key set with Reflect.ownKeys(options) before proving the mandatory own save descriptor was usable. A malformed host value such as a Proxy over { save: 1 } could therefore execute caller-controlled key reflection even though the required capability already made the configuration impossible to accept.

Inkspan owns deterministic validation of the callback configuration it retains. Hosts continue to own transport, authorization, tenancy, durable persistence, credentials, migration, retention, deployment, and durable audit.

Test-first lineage

RED — 007875dbce37d76bdc1a14b175b5f12d91b1c02c. The test-only head added src/autosave/packageOptionPreflight.test.ts without changing production. Hosted CI run 31917450492, build/test job 95091630940, checked out that exact head. Existing tests passed and the new regression failed at ownKeysCalls: production invoked the hostile Proxy ownKeys trap once before rejecting the non-callable required save field.

GREEN source repair — 735602a30af207955b9550b638ffa0d717a1be8b. readDocumentAutosaveQueueOptions() reads the mandatory own save descriptor before global own-key enumeration and immediately rejects an absent, non-enumerable, accessor-backed, or non-callable required capability through the existing payload-redacted invalid_options error. Exact key-shape validation and optional onSnapshotChange descriptor validation run only after the required capability is valid. Unknown strings, symbols, accessors, non-enumerable fields, and reflection failures remain fail-closed.

Accepted queue behavior, callback identity/receiver semantics, detached evidence, observer isolation, single-flight ordering, lifecycle snapshots, framework-free packaging, and stable error codes/messages are unchanged.

Protected-main synchronization

Current exact Draft head is e610a391d1716e5c9c385049ee1ddfa6a1f425c4 on fix/autosave-options-preflight-353. It is a non-destructive synchronization commit whose first parent is the GREEN source head and whose second parent is exact protected main@3b38ead2d00f44eb578d0689087b9293b3dabe1e.

Fresh exact comparison resolves protected main as the merge base and reports ahead_by=3, behind_by=0. The effective delta remains exactly two owned paths:

• src/autosave/package.ts;
• src/autosave/packageOptionPreflight.test.ts.

No force push or destructive rebase is represented by this convergence.

Exact-current-head evidence

For unchanged exact head e610a391d1716e5c9c385049ee1ddfa6a1f425c4:

• repository CI 32079480748: completed / success;
• Security Scan 32079480759: completed / success;
• SAST Semgrep 32079480762: completed / success;
• the only submitted review is a predecessor Cursor COMMENTED review, not approval;
• qualifying approving reviews: 0;
• unresolved inline review threads: 0;
• GitHub reports the Draft mergeable.

These exact-head repository results are technical evidence only. They do not establish separately applicable central required workflows or qualifying independent approval. Pending, queued, skipped-required, cancelled, absent-required, stale, predecessor, status-only, and model-only evidence remains non-passing.

Integration and release boundary

Keep this PR Draft/unmerged while #118 freezes the exact protected v0.6.0 publication identity. Live governance, required workflow identities, review requirements, permissions and any applicable organization rules must be independently refetched immediately before a lifecycle transition; historical PR prose about a named ruleset is not merge authority.

Do not advance protected main, self-approve, weaken gates, transfer predecessor evidence, fabricate tag/release identity, or represent this next-release repair as shipped before #118 and every then-applicable exact-head governance gate close their boundaries.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 9fec4633-c5d3-4cad-94bc-be1f41f6e257

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[cursor]

The required-save preflight is the right fail-closed order: Object.getOwnPropertyDescriptor rejects a non-callable required capability before Reflect.ownKeys, and the existing outer catch still redacts hostile descriptor/key traps to invalid_options.

No merge on this head while #118 freezes main@e8109ec as the only v0.6.0 publication candidate. Keep Draft. Do not fold clipboard resource-preflight (#359) or throw-branding (#351) into this autosave options lane.

View PR

  

_{Sent by Cursor Automation: Fix Issues}