fix(reliability): avoid proxy get traps while validating frozen array length #321

Defect

isDeeplyFrozenDocumentJson() advertises descriptor-safe validation that does not execute caller accessors, but its frozen-array path currently reads currentValue.length through ordinary property access after Array.isArray(currentValue). A transparent Proxy over a frozen Array can therefore execute its get trap for length during evidence validation even though every element is subsequently inspected through own data-property descriptors.

Exact observed implementation boundary: Draft #184 head 6d75be1826442531952c51698bf19e5ab54cfa53, src/autosave/evidenceValidation.ts, where the array path executes const length = currentValue.length before the resource-capacity check and Reflect.ownKeys().

Required repair

Keep #184 as the only writer for this overlapping autosave evidence-validation lane; do not create a competing branch. Add a test-only RED on that exact branch using a Proxy over a frozen Array whose get trap records reads of length; valid evidence traversal must not invoke that trap. Then replace ordinary length access with a descriptor/internal-slot-safe read that preserves array limits, hole/extra-key rejection, exact value counting, deep-freeze behavior, and the current payload-redacted failure contract. Re-run exact-head CI, Security Scan, SAST, package/browser/Office evidence, and 100% owned-production coverage before considering the repair GREEN.

No transport, persistence, credentials, tenancy, model, network, deployment, migration, retention, durable-audit, Yjs-room, or durable PDF authority is in scope.