fix(editor): protect recovery and harden the AI assistant

[chaxus]

Merge Verdict

[APPROVE] — Preserve recovery data and complete the assistant reliability, streaming and offline follow-ups.

62 files changed, 3634 insertions(+), 1013 deletions(-)

Summary

• Roll back recovery eviction and replacement together when a quota retry fails or is cancelled; reject oversized exported files before reading their bytes.
• Give OpenAI-compatible, Gemini, Ollama and Loopback requests a configurable five-minute deadline and 8 MiB response limit, with caller cancellation and owned reader cleanup.
• Classify safe Gemini authentication, rate-limit, service and timeout errors without retaining upstream bodies.
• Stream tool-free OpenAI-compatible/Gemini/Ollama SSE and native Loopback NDJSON answers; reject incomplete streams and accept compatible complete JSON responses.
• Prepare WebGPU, CPU, Wllama, compatibility and PDF offline assets only when needed; restore the union of prepared capabilities across deployments.
• Wait for actual service-worker page control before warming editor assets, preventing first-visit font resources from missing the offline cache.
• Extract panel configuration, destination policy, deterministic execution and workspace owners. Prevent unrelated WebGPU discovery during CPU/service setup and after panel removal.

Risk Analysis

Risk	Level	Mitigation
Recovery data loss under quota pressure	High-impact path	Atomic rollback; repeated/different failure cases; real-editor IndexedDB regression.
Partial responses and cancellation	Medium	One total lifetime/byte budget; terminal markers; UTF-8/frame boundaries; callback failure; Stop and late-response cleanup.
Offline availability through updates	Medium	Build-owned capability lists, legacy/per-capability markers, emitted-graph review and browser upgrade/offline regressions.
Panel state ownership	Medium	Live state access, existing lifecycle owners, native event regression and real workspace/request-queue tests.

Design Decisions

• Preserve eleven focused commits as requested. No schema migration, dependency changes, model-default changes or new request destination.
• Stream tool-free answers; tool-bearing and schema-constrained generation stays complete and validated before document changes.
• Runtime persistence is advisory. Cloud-only setup prepares no local inference or PDF runtime; compatibility assets are separate capabilities.
• Keep document approval, session invalidation, queue behavior and save destinations intact.

Code Concerns

No unresolved actionable findings. Independent reviews found and verified corrections for Gemini terminal settlement, Loopback host JSON compatibility, post-load CPU cache discovery and detached native disclosure events. The final scoped reviews, including the first-visit control race, are clean. The panel shrank from 3,480 to 3,116 lines, with concrete adjacent owners.

Verification

Check	Result
Full unit coverage	6,290 passed across 238 files; lines 89.56%, branches 83.08%; all repository gates pass.
Chromium regressions	All 35 distinct cases verified: 34 passed in the main run, then the corrected offline subgroup passed 3/3. Covers early stream display, safe errors, queues, workspace/review/undo, references, offline upgrades, autosave and disk save.
Docker CI regression	All 4 landing-prefetch Chromium cases pass against a fresh production Docker image; 2 deterministic control/cancellation regressions failed before the fix and pass now.
Reverse evidence	Storage rollback, response ceilings, stream/cancellation corrections, runtime activation and extracted owner guards were observed failing before their respective fixes.
Remote CI	All 20 checks on dc802d25 pass, including every E2E shard and the standard, Pages and Docker summaries, preview smoke and Cloudflare Pages. CI run.
Tooling	Archive integrity, lint, refreshed workspace declarations, app TypeScript, formatting and final production build pass.

Conclusion basis

• Verified locally against the final production build with deterministic endpoint/storage fault injection and real editor, IndexedDB, CacheStorage and service-worker paths.
• The first concurrent unit run exposed three unchanged large-fixture wall-clock timeouts; isolated reruns and the final full run passed without changing deadlines. Incomplete Cache mocks and a missing baseline online-editor warm-up were corrected with their original behavior assertions retained.
• Remote CI verifies the full configured Chromium suites across Vite, Pages semantics and Docker, plus the deployed preview smoke. Verification does not cover Firefox/WebKit, real cloud accounts, every backend's model inference or physical disk exhaustion. Existing bundler warnings remain.
• Evidence and commands: docs/explorations/2026-10-17-project-followups.md docs/explorations/2026-10-17-recovery-and-provider-request-safety.md and docs/explorations/2026-10-17-pr279-ci-followup.md.

[cloudflare-workers-and-pages]

Deploying document with    Cloudflare Pages

Latest commit:	dc802d2
Status:	✅  Deploy successful!
Preview URL:	https://9fe653a8.document-7hm.pages.dev
Branch Preview URL:	https://codex-recovery-ai-request-sa.document-7hm.pages.dev

View logs