fix(reliability): reject obviously oversized rich clipboard HTML before UTF-8 encoding #163

Current authoritative state

Protected shipped truth is exact main@3b38ead2d00f44eb578d0689087b9293b3dabe1e. The original problem statement describing protected main@e8109ec2a17de8bd6594487aa12c8c8a93cb2c03 allocating a complete UTF-8 copy before an obvious rich-clipboard size rejection is historical RCA, not the current active-PR state.

The former Draft #164 is closed/superseded and must not be revived. Canonical single-writer Draft PR #359 (fix(reliability): preflight clipboard size and traversal budget) now owns this resource-preflight boundary together with #327. Current exact #359 head is 1721f10124d93bc4e1a9408cc173b1619c198c42 against protected main@3b38ead2d00f44eb578d0689087b9293b3dabe1e; GitHub reports it Draft and mechanically mergeable.

Executable contract / TDD lineage

• RED 51f9edfdff7de9072cafa8cebaf068dc39f92208: an ASCII nine-code-unit string under maxHtmlBytes: 8 still reached TextEncoder.prototype.encode; the same generation also proved the fix(reliability): bound rich-clipboard traversal queue before allocation #327 traversal-budget defect.
• GREEN 71654a8e59eecd72f2a23ebec173e4e537c927d9: reject sourceHtml.length > maxHtmlBytes before UTF-8 encoding, while preserving the exact UTF-8 byte check for in-ceiling non-ASCII input. The same source repair enforces fix(reliability): bound rich-clipboard traversal queue before allocation #327's queue invariant before child materialization.
• Current synchronized head 1721f10124d93bc4e1a9408cc173b1619c198c42 preserves existing DOM/node/depth/rich-paste semantics, redacted codes/messages, public configuration ceilings, SafeLink behavior, package/browser behavior and standalone no-service/no-network/no-database/no-credential/no-model operation.

Exact-current-head evidence

For unchanged #359 head 1721f10124d93bc4e1a9408cc173b1619c198c42, the canonical PR records terminal-success repository workflows:

• CI 32078914337: completed / success;
• Security Scan 32078914160: completed / success;
• SAST Semgrep 32078914379: completed / success;
• qualifying formal approving reviews: 0;
• unresolved inline review threads: 0.

Repository-local technical success is not qualifying independent approval and does not replace separately applicable central workflows or then-live governance. Pending, queued, skipped, cancelled, absent, stale, predecessor, status-only or model-only evidence remains non-passing.

Integration boundary

The defect is repaired on active Draft #359 but is not protected-main shipped behavior until integration. Keep this issue open and keep #359 Draft/unmerged while #118 owns exact protected v0.6.0 publication/provenance/digest operational acceptance. Draft #351 separately owns hostile thrown-value containment; do not create a competing src/extensions/SafeClipboard.ts writer. Before any lifecycle transition refetch exact head/live base, ancestry/mergeability, live governance, formal reviews/threads and every applicable repository/central workflow. Do not transfer #164 or predecessor evidence, self-approve, weaken gates, move protected main, or fabricate release identity.