fix(editor): protect document lifecycle and request recovery

[chaxus]

Merge Verdict

[APPROVE] — Preserve document recovery and save ownership, bound Anthropic request lifetimes, and reuse prepared runtime resources.

28 files changed, 1,551 insertions(+), 79 deletions(-); five focused commits.

Summary

• Keep fresh recovery bytes and their file association when an active document crosses retention expiry. Keep document identity independent of recovery enablement/failure, and invalidate pending Web Lock starts on stop/replacement.
• Bound Anthropic SDK JSON and SSE consumption with a configurable five-minute total deadline; preserve cancellation reasons and classify SDK timeout/overload errors safely.
• Propagate failed or superseded local opens to tools and recovery callers, consume reported errors at UI boundaries, and apply readonly within the owned open. Remove unused original-file Blob URLs.
• Copy unchanged allowlisted runtime responses from owned older app cores before fetching misses, preserving complete preparation before activation.

Risk Analysis

Risk	Level	Mitigation
Recovery integrity and file routing	High-impact paths	Actual store/target regressions, retained revision bytes/counters/handle, no URL-derived identity, delayed lock grants in both orders.
SDK cancellation and streaming	Medium	Actual installed SDK stalled JSON/SSE tests, original abort reasons, callback/reentrant cancellation, late callbacks and cleanup checks.
Entry ownership	Medium	Real entry/tool integration tests, failed source retention, cancellation across embedded/desktop replacements, UI error boundaries.
Cache ownership and updates	Medium	Exact same-origin build allowlists, owned earlier cores, cloned bytes/headers, invalid-cache fallback, marker/activation ordering.

Design Decisions

• Preserve separate topic commits as requested; use normal pushes and a new PR after fix(editor): protect recovery and harden the AI assistant #279.
• Keep document identity through recovery-only stops, and clear it at actual close/replacement boundaries. No URL fallback or storage schema migration.
• Retain SDK/client injection and existing retries/model defaults. The provider owns its total deadline, including body consumption.
• Keep the actual editor Blob URL owner; avoid creating redundant original-file URLs.
• Reuse only exact runtime URLs from earlier owned app core caches. Do not trust unrelated provider caches or activate an incomplete prepared capability.
• No dependency, vendored code, immutable archive, data destination or document approval-policy changes.

Code Concerns

No unresolved actionable findings. Four independent scoped reviews and the complete-branch review approve the final implementation and its consumers. The hypothetical custom-client stream.on() throwing path has no reachable official SDK/app trigger and is not presented as a product defect.

Verification

Check	Result
Full unit coverage	6,349 tests across 243 files pass; lines 89.67%, branches 83.19%; all repository gates pass.
Reverse evidence	New storage/identity/lock, actual SDK lifetime/error, local-open/URL, and worker reuse regressions failed before their fixes.
Browser reverse evidence	Both new real-editor regressions fail against the baseline production Docker image: missing fresh recovery bytes and two file pickers instead of one authorized target.
Real Chromium / production Docker	All 33 cases pass, including the two new regressions, save/reload targets, entry paths, recovery, queues/Stop, errors/streaming, offline upgrades and warmed cache reuse.
Tooling	Immutable archive integrity (1,511 artifacts), oxlint, workspace declarations, app TypeScript, repository formatting and production Docker build pass.

Conclusion basis

• Real source modules with controlled storage, SDK transport, lock scheduling and URL registry boundaries; real editor, IndexedDB and OPFS handle in browser regressions.
• Evidence and reproducible commands: docs/explorations/2026-10-17-document-lifecycle-followups.md.
• Not covered: live paid provider accounts, physical quota exhaustion or every browser/runtime inference backend. Existing production bundler warnings remain.

[cloudflare-workers-and-pages]

Deploying document with    Cloudflare Pages

Latest commit:	0455868
Status:	✅  Deploy successful!
Preview URL:	https://6cc41599.document-7hm.pages.dev
Branch Preview URL:	https://codex-document-lifecycle-fol.document-7hm.pages.dev

View logs