fix(reliability): bypass caller Blob byte-reader interposition

[seonghobae]

Current authoritative state

This Blob byte-reader interposition defect is repaired on the existing canonical single-writer Draft PR #160 / branch fix/blob-size-preflight-20260811. Protected shipped truth remains exact main@3b38ead2d00f44eb578d0689087b9293b3dabe1e; current exact Draft head is 42b3a5004ec1b93181cd1ae52227b0fac2506227. The repair remains active-PR truth only until #160 integrates under live governance.

Current readBlobBytes() does not read blob.arrayBuffer from the caller-controlled instance and does not let a later mutation of Blob.prototype.arrayBuffer become payload authority. The platform byte-read method is captured when the converter module is evaluated. At call time Inkspan checks only whether that platform capability is still present so the documented FileReader/Response fallbacks remain selectable when the platform capability is unavailable; when present, the captured capability is invoked with the already-proven genuine Blob receiver. Caller-owned/subclass accessors and later prototype replacements are never executed as byte authority.

The same canonical converter lane obtains Blob size and MIME metadata through intrinsic platform getters, classifies ArrayBufferView inputs through a module-captured ArrayBuffer.isView, captures the TextDecoder instance plus intrinsic decode used for bounded SVG/XML MIME sniffing, and now also bounds declared data-URI MIME metadata before payload decoding. Those later resource/trust-boundary repairs preserve the #363 byte-reader contract. Genuine Blob subclasses, MIME precedence/sniffing, pre-read size/resource limits, browser/Node behavior, and standalone no-service operation remain preserved.

This is Inkspan-owned local conversion/trust-boundary scope and adds no transport, persistence, authorization, tenancy, credentials, network, model/provider, deployment, migration, retention, or durable-audit authority.

Test-first lineage and executable contract

src/converter/base64.fallbacks.test.ts machine-checks that:

• a genuine Blob with an own hostile arrayBuffer accessor is encoded through the platform capability and the instance accessor is never read;
• a module imported while platform method A is authoritative continues to use A after Blob.prototype.arrayBuffer is replaced with method B, so the replacement cannot substitute payload bytes;
• fallback tests vary the platform capability's presence rather than relying on a per-instance shadow;
• FileReader error behavior remains intact when the platform capability is unavailable;
• Response remains the final byte-read fallback when neither platform arrayBuffer nor FileReader is available; and
• a later replacement of ArrayBuffer.isView cannot throw into or redefine genuine view classification after the converter module has captured the platform classifier.

Exact test-only RED 7803940480bf6ea69d7bbea4b593ace7c9708ee6, CI 32241866148, build/test job 96034061559, failed exactly the late-Blob.prototype.arrayBuffer replacement regression. GREEN 754c5d87dcf3a7f18ca20b15877cb308be4924d4 captured the Blob byte-read method once at module evaluation while retaining only a live-presence check for fallback selection. Later classifier and MIME/resource hardening remains historical behavior lineage; predecessor workflow/review evidence does not transfer after head movement.

Exact-current-head evidence

For unchanged exact head 42b3a5004ec1b93181cd1ae52227b0fac2506227 against protected main@3b38ead2d00f44eb578d0689087b9293b3dabe1e at the latest fresh refetch:

• CI 32558675130: completed / success;
• build-and-test 96996743975: exact checkout, 163 test files / 912 tests, 100% statements / branches / functions / lines, with packed-package consumers, library build and demo build successful;
• Cross-engine Clipboard / Playwright 1.62.0: completed / success;
• Office Python 3.11, 3.12, 3.13 and 3.14: completed / success;
• Security Scan 32558675113: completed / success;
• SAST Semgrep 32558675118: completed / success;
• formal submitted reviews: 0;
• unresolved inline review threads: 0;
• GitHub reports the Draft mechanically mergeable.

Repository exact-head technical success is not a substitute for separately applicable central workflows, qualifying independent approval, or then-live governance. Pending, queued, skipped, cancelled, absent, neutral, failed, stale, predecessor, status-only, model-only, or vacuous evidence remains non-passing.

Integration boundary

Keep this issue open until #160 integrates under then-live governance. Keep #160 Draft/unmerged while #118 owns the frozen protected v0.6.0 publication/provenance boundary. Any #160 head/base/ruleset movement invalidates corresponding exact-head evidence and requires fresh revalidation. Do not create a competing converter writer, transfer predecessor evidence, self-approve, weaken gates, move protected main, or fabricate release identity.