fix(reliability): harden public Markdown and local serialization boundaries

[seonghobae]

Closes #169.
Closes #171.
Closes #173.
Closes #175.
Closes #177.
Closes #181.
Closes #204.
Closes #209.
Closes #223.
Closes #226.

Consolidated single-writer boundary

This Draft remains the existing Inkspan source owner across the overlapping public Markdown adapter, editor serialization, canonical envelope encoding, SafeLink resource policy, plain-text projection, and full-document email serialization option boundaries. Protected main is the only shipped implementation authority; #118 remains the stable-release operational-acceptance boundary.

Standalone/product authority is unchanged: no service, database, network, credential, model, tenancy, durable persistence, transport, deployment, durable audit, Yjs authority, or durable PDF authority is introduced. Model/provider output remains untrusted proposal data.

Active-PR behavior

The current branch:

• bounds public Marked/Turndown entry paths before parser materialization while preserving exact UTF-8 accounting and shared defaults/hard ceilings;
• fails closed on malformed runtime option bags without invoking accessor getters, coercing unsupported values, or reflecting caller-thrown values;
• rejects non-string HTML before caller property access, browser DOM materialization, or browserless parsing with stable payload-redacted errors;
• bounds canonical-envelope output encoding and SafeLink validation before avoidable allocation/parser work;
• preserves accepted Markdown/GFM, safe image/link policy, image-alt semantics, RFC 8785 canonical bytes, editor HTML/Markdown semantics, and package/SSR/browser/Office behavior;
• validates full-document email languageTag, textDirection, and title before Markdown parser materialization; and
• detects browser capability without invoking an ambient globalThis.window accessor and neutralizes the pinned Turndown ambient-window probe so packed ESM/CJS /markdown consumers remain standalone under hostile ambient browser accessors.

These are active-PR claims only until integrated into protected main.

Test-first lineage

Branch history contains realistic RED→GREEN lineages for Markdown resource bounds, editor serialization modes, canonical envelope encoding, SafeLink validation, plain-text runtime options, email metadata, hostile option bags, non-string HTML, and ambient browser-authority isolation. Predecessor/cancelled/synthetic generations remain lineage only.

For the cross-lane defect reproduced by #381:

• RED 19e5052c440b1852b898228a3bacdf2fa3ad1b20 added the packed hostile-ambient ESM/CJS regression; exact CI 32869680521 failed specifically at packed-package consumers after typecheck, 100% coverage, and build reached the intended boundary;
• narrow repairs were ef5b707d5b2ec8dcbd99fde0af44c398a539176e, 3123981884cebd2dd81f022b25445702d6d55906, and current product head e1345c45ba9bf8e75bdab8ad7f56c7d7437f1470;
• CI 32871290927 is terminal success for that current contributor head and verifies the packed consumer regression. feat(reference-host): add buyer integration safety fixtures #381 must inherit this owner repair rather than duplicate it.

Fresh exact state and divergence

Immediately before this PR-state correction:

• protected shipped truth: main@128a239f8b71ca16add4b9e15e21752d1ad63ff0;
• exact Draft head: fix/public-markdown-resource-options-175@e1345c45ba9bf8e75bdab8ad7f56c7d7437f1470;
• current-main comparison: diverged, 86 ahead / 185 behind, merge base 50ac98cfa0ad9e8dd75f93ca437a5679fed4d804;
• formal submitted reviews: 0;
• unresolved inline review threads: 0.

The branch is therefore not current-base integration evidence even though its contributor-head product tests are useful lineage.

Exact-head workflow classification

For exact contributor head e1345c45ba9bf8e75bdab8ad7f56c7d7437f1470:

• CI 32871290927: completed / success for the contributor-head behavior/package lane;
• Security Scan 32871290622: aggregate success but NON-PASSING for merge/release acceptance. Dependency-review job 97878683147 completed success while the actual Dependency review action step was skipped. The established organization-owned fail-closed Dependency Review repair path is ContextualWisdomLab/.github#810 / PR #897;
• SAST Semgrep 32871291271: aggregate success but NON-PASSING for exact-source acceptance. Job 97878684332 checked out GitHub synthetic merge f2f49fc63fe535f1d9628dcae866eaa302b3f20e (Merge e1345c45... into fd75c835...) rather than contributor head e1345c45.... That synthetic generation is also based on an older protected tip, not current main@128a239.... The established organization-owned exact-source scanner repair path is the existing central SAST owner, including .github PR #941 / issue #1222 where live;
• qualifying independent approving reviews: 0.

Aggregate green does not override a skipped required action or wrong-source checkout. Pending, queued, skipped-required, cancelled, absent, neutral, failed, stale, predecessor, status-only, model-only, wrong-checkout, synthetic-source-only, or otherwise vacuous evidence is non-passing.

Source-reconciliation failure contract

The remaining local integration blocker is branch topology, not a known unfixed Markdown product defect. Current #176 is substantially diverged from protected main. The available GitHub mutation surface exposes neither a safe high-level update-branch operation nor a freshly resolved conflict-free merge tree for current main@128a239... and e1345c45....

Therefore the exact current-base source-reconciliation mutation is TOOL_UNAVAILABLE under the present safe mutation surface. Do not emulate it by force-moving refs, destructive rebasing, guessed tree construction, reviving stale synthetic merge f2f49fc..., or copying this repair into a competing owner branch. This classification applies only to that exact reconciliation mutation; independent Inkspan lanes should continue.

Integration boundary

Keep this PR Draft and unmerged. Before any Ready/merge transition:

1. refetch protected main, exact head/live base, ancestry/mergeability, changed paths/active writers, live rules/permissions, reviews/threads, and all repository/central workflow jobs with checkout/source SHAs;
2. reconcile protected-main divergence non-destructively through a supported current-base mechanism;
3. inherit organization-owner fixes for skipped Dependency Review and exact-source SAST rather than weakening or duplicating those gates;
4. regenerate exact-current-head/live-base CI, security, SAST, coverage, browser, Office, package, SBOM/provenance and other then-required evidence;
5. obtain the qualifying independent approval required by then-live governance; and
6. transition lifecycle state only if the unchanged exact head remains gate-clean.

Do not self-approve, transfer predecessor evidence, weaken gates, fabricate release identity, force-push/destructively rebase, or represent Draft behavior as protected-main shipped truth.

[seonghobae]

Exact cross-lane defect handoff from the current #377 reference-host acceptance lane; this belongs here because #176 explicitly remains the sole active writer for the public Markdown adapter/serialization boundary.

Affected Inkspan evidence

• protected main: fd75c835a2a7c5d9a1f57c3e080364237d69819a;
• feat(reference-host): add buyer integration safety fixtures #381 exact head: 1fb2d317838ff0ed71001d470af650692ebd36b2;
• CI run 32864768290, exact-checkout build/test job 97857195953;
• typecheck passed; 171 test files / 921 tests passed before the only failing file;
• src/referenceHostFrameworkFreePackedBoundary.test.ts: 2 failures, ESM and CJS packed @contextualwisdomlab/cwl-editor/markdown imports;
• both processes install only the exact packed Inkspan artifact, poison ambient globalThis.window/document accessors to throw, and perform no network/model/credential setup.

First causal boundary / falsifiable RCA
The packed cwl-markdown.js and .cjs evaluate createInertBrowserFragment(). Current protected source and #176 current head both contain if (typeof window === 'undefined') return null;. In Node, when globalThis.window is an accessor, resolving window for typeof window invokes that accessor. The exact failure is Error: browser window authority is forbidden, with the ESM stack at dist/cwl-markdown.js:15128:10 and CJS stack at dist/cwl-markdown.cjs:118:2075. This falsifies the stronger standalone/headless claim that importing the Markdown subpath does not touch ambient browser authority.

This is not correctly repairable in #381: changing src/markdown/serializer.ts there would create a competing writer against #176's declared sole Markdown ownership. #381 should revalidate after this owner integrates rather than duplicate the source fix.

RED acceptance to carry here
A packed ESM+CJS regression equivalent to #381's referenceHostFrameworkFreePackedBoundary must define throwing own accessors for globalThis.window and globalThis.document, import the exact packed /markdown subpath, and execute representative markdownToPlainText/markdownToHtml/htmlToMarkdown behavior without invoking either accessor or any network/credential/model authority.

Material remedy choices

1. Preferred/smallest: make browser capability detection descriptor-safe so merely determining environment cannot execute an ambient accessor; preserve the detached-template browser path and Domino browserless fallback. Blast radius is limited to environment detection and is easy to roll back.
2. If descriptor-safe browser identity cannot be made portable across supported browsers, use the bundled standalone non-fetching parser for the public Markdown path in all runtimes and retire the ambient template dependency, but only with browser fidelity/security regressions because this changes parser-path architecture.
3. Do not weaken/remove the packed boundary test or catch the sentinel error; that would hide the authority violation.

GREEN required
Focused packed ESM+CJS hostile-ambient regression + #176 full 100% coverage/typecheck/package tests + fresh exact-head Security/SAST, then #381 must be revalidated against the integrated owner result. Pending/skipped/predecessor evidence is non-passing.