Current authoritative state
Protected shipped truth is exact main@3b38ead2d00f44eb578d0689087b9293b3dabe1e. The original public Markdown pre-lexer resource-bound defect is repaired on consolidated Draft PR #176 / branch fix/public-markdown-resource-options-175, the sole active writer for the overlapping Markdown/editor serialization surface and explicit closer of #171. At this issue synchronization the exact Draft head is 68aa1ed4f08e2c65826dccb02ca8f3e2da3a9407; the live PR/head plus independently resolved protected main remain lifecycle authority.
Implemented active-PR contract
The active implementation exposes the shared optional maxMarkdownBytes resource ceiling on the public Markdown conversion surface, with a 16 MiB default and 64 MiB hard maximum. It rejects obviously oversized source by UTF-16 code-unit lower bound before allocating a complete encoded copy, then performs an exact UTF-8 byte check for remaining candidates before Marked lexer/parser materialization. Invalid, non-safe-integer, zero, and over-maximum configuration fails closed through the stable payload-redacted MarkdownToHtmlResourceError policy rather than echoing authored Markdown.
The same bounded parser policy is reused by editor Markdown ingress and the other Marked-backed adapters consolidated in #176 rather than maintaining a second parser-resource implementation. Accepted Markdown/GFM, raw-HTML escaping, SafeLink/image policies, normalization/email/plain-text semantics, package/browser/Office behavior and deterministic standalone behavior remain preserved. This introduces no network, database, persistence, credentials, model/provider, authorization, tenancy, durable audit, deployment, migration or collaboration-provider authority.
Verification / integration boundary
#176 carries executable exact-boundary, non-ASCII UTF-8, invalid-configuration, parser-preflight, package-consumer and coverage tests for the shared resource policy. Current exact-head workflows, formal reviews, review threads, ancestry and live base must be refetched before lifecycle action; predecessor #170/#172 or earlier #176-head evidence does not transfer.
Keep this issue open until the repaired behavior is protected-main integrated. #176 remains Draft/unmerged while #118 owns exact protected v0.6.0 publication/provenance acceptance. Do not revive predecessor stacked resource-bound writers, move protected main, weaken gates, force-push/destructively rebase, or claim this active-PR behavior is shipped.
Current authoritative state
Protected shipped truth is exact
main@3b38ead2d00f44eb578d0689087b9293b3dabe1e. The original public Markdown pre-lexer resource-bound defect is repaired on consolidated Draft PR #176 / branchfix/public-markdown-resource-options-175, the sole active writer for the overlapping Markdown/editor serialization surface and explicit closer of #171. At this issue synchronization the exact Draft head is68aa1ed4f08e2c65826dccb02ca8f3e2da3a9407; the live PR/head plus independently resolved protected main remain lifecycle authority.Implemented active-PR contract
The active implementation exposes the shared optional
maxMarkdownBytesresource ceiling on the public Markdown conversion surface, with a 16 MiB default and 64 MiB hard maximum. It rejects obviously oversized source by UTF-16 code-unit lower bound before allocating a complete encoded copy, then performs an exact UTF-8 byte check for remaining candidates before Marked lexer/parser materialization. Invalid, non-safe-integer, zero, and over-maximum configuration fails closed through the stable payload-redactedMarkdownToHtmlResourceErrorpolicy rather than echoing authored Markdown.The same bounded parser policy is reused by editor Markdown ingress and the other Marked-backed adapters consolidated in #176 rather than maintaining a second parser-resource implementation. Accepted Markdown/GFM, raw-HTML escaping, SafeLink/image policies, normalization/email/plain-text semantics, package/browser/Office behavior and deterministic standalone behavior remain preserved. This introduces no network, database, persistence, credentials, model/provider, authorization, tenancy, durable audit, deployment, migration or collaboration-provider authority.
Verification / integration boundary
#176 carries executable exact-boundary, non-ASCII UTF-8, invalid-configuration, parser-preflight, package-consumer and coverage tests for the shared resource policy. Current exact-head workflows, formal reviews, review threads, ancestry and live base must be refetched before lifecycle action; predecessor #170/#172 or earlier #176-head evidence does not transfer.
Keep this issue open until the repaired behavior is protected-main integrated. #176 remains Draft/unmerged while #118 owns exact protected
v0.6.0publication/provenance acceptance. Do not revive predecessor stacked resource-bound writers, move protected main, weaken gates, force-push/destructively rebase, or claim this active-PR behavior is shipped.