fix(editor): protect saves and recovery, refresh workspace checks

[chaxus]

Merge Verdict

[APPROVE] — The six audit findings are addressed, with independent review and regression validation.

20 files · +607 / -69 · editor saves, recovery, workspace source resolution, coverage

Summary

• Cancelling either save path preserves dirty state and recovery status. Cross-format exports use a separate target and keep ordinary saves linked to the original file.
• History removal retires persisted and in-memory file associations atomically, honors deletion by other tabs, and prevents an in-flight disk write from restoring a cleared link. Recovery skips unchanged SDK history while retaining appended/replaced undo changes.
• Development and Vitest resolve current workspace source from package exports, including subpaths, while production still builds package output. Coverage now measures all application/workspace source with separate module gates.

Risk Analysis

Risk	Level	Mitigation
Save outcome propagation and format isolation	Moderate	Checked all in-repository consumers; real OPFS/editor exports verify cancellation, unchanged DOCX bytes after PDF export, and subsequent write-back. Embed protocol remains unchanged.
SDK undo-history tracking	Moderate	Capture point and immutable undo-item references before export; detect appends and replacements at the same index; unknown SDK shapes retain the conservative cadence.
Asynchronous target cleanup	Moderate	Delete metadata, revisions and handles in one transaction; invalidate session links only on commit; register new ordinary links before disk I/O and never recreate them after close.
Development/build resolution	Low	Derive anchored aliases from export manifests; test stale compiled fixtures and live edits; retain production package builds and source Worker response policy.

Design Decisions

• Preserve written, cancelled and unavailable through the internal disk writer. The converter download adapter returns its underlying outcome; only successful disk completion updates dirty/recovery state.
• Identify initial cross-format exports from the current document format, and preserve the ordinary link even when an export is cancelled or fails.
• Newly chosen ordinary handles are associated before asynchronous I/O so deletion can retire them while writing; success notifications and saved flags still wait for committed bytes. No IndexedDB schema migration or recovery-retention change is needed.
• Scope the source aliases to development/tests; production remains on built workspace packages. Keep the existing global coverage thresholds and add module thresholds against the expanded measurement scope.

Code Concerns

No remaining actionable concerns after independent review. Review identified mutable undo-point items and a pending-save cleanup race; both were corrected and covered by regressions.

Verification

Check	Result
Clean baseline	173 files / 5303 unit tests passed
Final unit suite and coverage	176 files / 5323 tests passed; lines 85.06%, statements 82.61%, branches 79.64%, functions 84.56%; all module gates passed
TypeScript / oxlint / archive integrity	Passed pnpm run lint:ts; 1511 immutable evaluation artifacts verified
Formatting	Full pnpm run format:check and final changed-file checks passed
Production build	pnpm run build passed, including workspace builds, CSP, offline assets and vendor fingerprints
Real Chromium editor against production build	10 passed: cancellation, PDF/DOCX isolation, repeated/reloaded write-back, recovery and DOCX/XLSX/PPTX embed dirty state
Source resolution and Worker policy	Vite fixture loaded source instead of deliberately stale exports and reflected an edited source module; development Worker response returned its expected CSP
Reverse validation	Before fixes, 12 regression cases failed. Additional export-failure, pending-save and mutable-undo cases failed before their corrections. Disabling source aliases broke the stale-output fixture; disabling cancellation/export guards broke both new Chromium cases on their intended assertions. Restoring guards passed both against the production build.
Diff hygiene	git diff --check passed; generated outputs and local artifacts excluded

Conclusion basis

• Verified: local unit/coverage suite, production build, relevant Chromium E2E, browser-response smoke and reverse regressions.
• Reviewed: internal save contracts, cleanup transaction ownership, cross-tab reads, undo-item mutations and production/source resolution boundaries.
• Not covered locally: full Docker, Cloudflare Pages, complete E2E corpus and cross-browser suites; these remain CI checks. Production build retains its existing large local-model chunk and ineffective-dynamic-import warnings; unit tests retain two existing asynchronous rejection-handled warnings.

Implementation and regression evidence: docs/explorations/2026-10-13-save-recovery-test-workflow.md.

[cloudflare-workers-and-pages]

Deploying document with    Cloudflare Pages

Latest commit:	f0cfcc1
Status:	✅  Deploy successful!
Preview URL:	https://9a0be614.document-7hm.pages.dev
Branch Preview URL:	https://fix-save-recovery-and-test-w.document-7hm.pages.dev

View logs