[Fix] Verify and resolve the Codex issue sweep (#40-#63)

[DongyuZhao]

One sweep over the 24 Codex-filed issues (#40–#63). Every issue was re-verified against the current code before any fix; all 24 are factually accurate — no false positives. This PR fixes 22 of them; the remaining two (#55, #62) are commented on their threads with what blocks a complete fix.

Engine (C)

• [P1][Identity] Generate collision-resistant session lineages across isolated runtimes #40 — lineage entropy: session_host_entropy reads the platform CSPRNG (arc4random_buf / /dev/urandom / rand_s / WASI getentropy) into the lineage seed; the address/time/clock mix stays as fallback. Regression test: 64 sequential same-address sessions never collide. The ES shim now provides wasi_snapshot_preview1.random_get via crypto.getRandomValues, and a new worker test asserts distinct lineages across 8 lockstep WASM isolates.
• [P2][C] Make canonical document dumping iterative for deep ASTs #45 — iterative canonical dump: dump_node recursion replaced by an explicit frame stack with identical byte output (conformance fixtures unchanged). The issue's repro (2048-deep quotes, 256 KiB stack) now exits 0 — as does 50,000-deep. The pathological suite's session case lost its shallow-depth exception and runs at 50,000 like the one-shot cases.

ES

• [P2][ES] Replace recursive wire decoding with an iterative traversal #44 — iterative decode: NodeDecoder now decodes over an explicit post-order frame stack. Document.parse and both commit paths handle 8192-deep nesting in tests (4× the old failure threshold).
• [P2][ES][Perf] Keep small session commits proportional to the delta, not document width #48 — delta-proportional commits: commits now apply the documented mirror update — materialize added∪changed by id (new es_session_node_by_id/es_node_parent bridge exports), relink bubbled from the previous snapshot value — instead of re-enumerating every root child through the WASM boundary. Fan-out benchmark added; a one-byte edit in a 10,000-child document went from ~0.49 ms (issue's measurement) to 0.018 ms. The remaining per-commit floor is the pure-JS child-array copy of relinked parents, which is inherent to array-valued immutable snapshots.
• [P3][Docs] Fix the non-runnable ES example in the root README #61/[P3][ES] Raise the minimum supported Node.js version to Node 24 LTS #63 — docs/engines: root README example uses the real exports; packed-artifact consumer test now executes every package-importing README snippet, so names can't drift again; engines.node raised to >=24 and both READMEs updated.

Swift

• [P2][Swift] Make MarkupWalker and MarkupDumper stack-safe #46 — stack-safe walker: explicit enter/exit frames, event order preserved; 4096-deep walk/dump/commit test added.
• [P2][Swift][Perf] Avoid quadratic depth discovery when rebuilding session deltas #49 — linear rebuilds: per-entry ancestor walks replaced by memoized depths (O(delta) total). Deep-edit benchmark added; a one-byte edit at depth 5000 went from ~49 ms (issue's measurement) to 1.3 ms, scaling linearly.
• [P3][Swift] Make ParseError provide a useful localizedDescription #52 — LocalizedError: errorDescription returns the native message; test covers description, localizedDescription, and NSError bridging.
• [P3][Swift] Document the public API and make the documentation lint enforceable #53 — API docs: all 224 missing public-declaration docs written; format-swift.sh --check now runs swift format lint --strict, so a new undocumented public declaration fails CI.

Kotlin

• [P1][Kotlin] Make ScopeResolver materialization atomic with commit and close #41 — atomic scope materialization: ScopeResolver gains a Materializing state; detach() (hence commit and close) spins behind an in-flight native scopes() call, so it can never overlap mutation or free. Deterministic interleaving tests pause the reader inside the window via an internal probe and prove commit/close wait.
• [P2][Kotlin] Make MarkupWalker and MarkupDumper stack-safe #47/[P2][Kotlin] Keep the scope-free MarkupVisitor overload independent of scope materialization #51 — walker: iterative frames for the scopeful walk; the typed MarkupVisitor<Unit> overload got its own scope-free traversal and now walks retained snapshots regardless of resolver state (test uses a superseded, never-materialized snapshot; a JVM test asserts the probe never fires).
• [P2][Kotlin/JVM] Provide a usable Java facade for unsigned identity and revision APIs #54 — Java facade: bit-preserving signed views (revisionBits(), lineageBits(), rawValueBits(), beforeRevisionBits(), afterRevisionBits()), MarkupID.fromBits, @JvmStatic Document.parse, @JvmOverloads on ParseOptions/MarkupSession. The Maven Java consumer now exercises ids, revisions, sessions, deltas, and footnote queries.
• [P2][Kotlin/JVM] Enforce the advertised Java 17 API floor, not only classfile version #56 — JDK 17 floor: JVM target compiles with -Xjdk-release=17 (post-17 API references now fail compilation); the CI consumers job runs the Maven consumer on Temurin 17 while Gradle/AGP stay on 26.
• [P2][Kotlin] Remove the unused coroutines API dependency from published variants #57 — coroutines: removed from commonMain; staged POM/module metadata verified clean; the publication audit now rejects any dependency outside com.nouprax + kotlin-stdlib.
• [P2][Kotlin/Android] Make the published AAR usable in downstream local and Robolectric tests #58 — Android host loader: property → classpath-resource fallback (desktop layout) → actionable IllegalStateException naming both remedies; README documents the Robolectric/local-test setup. (A dedicated downstream Robolectric consumer harness is left as follow-up.)
• [P3][Kotlin] Publish real generated API documentation in javadoc artifacts #59 — javadoc: Dokka generates the HTML API reference into the javadoc classifier (spec/README ride along); publication audit now requires index + Document/MarkupSession/MarkupWalker pages, not mere classifier presence. Dokka's supply chain is pinned in the dependency-verification metadata/keyring.
• [P2][Gradle] Use one exhaustive host triple model and fail fast on unsupported hosts #60 — host model: one closed HostTriple (macOS arm64, Linux x64) drives resource paths, native test targets, managed-device ABI, and publish-local; unsupported hosts fail configuration with an actionable message. Packaging verification now parses ELF/Mach-O headers and checks the machine architecture of the desktop payload and all four Android ABIs.
• [P2][Kotlin/JVM] Hide internal native and wire implementation types from the Java ABI #55 — JVM ABI (partial): a verifyJvmAbi snapshot gate (wired into kotlinTest) freezes the Java-visible surface in jvm-abi.txt, so accidental growth fails the build. Full class-level hiding is not achievable under Kotlin's compilation model — details on the issue, left open.

Release workflow

• [P1][Release] Bind Central deployment IDs to the validated source run #42: the Central deployment id is no longer an operator input. The tag run records {deployment-id, tag, version} as a run artifact (uploaded even when the VALIDATED wait fails); resume downloads it from the validated source run and cross-checks tag and version.
• [P1][Release] Serialize tag publication and manual resume for the same release #43: the concurrency group derives from the effective release tag for both trigger types, and resume rejects a source run that has not completed. Both invariants (plus the binding) are enforced by audit:ci.

Not fixed, commented on the issue

• [P2][Kotlin/JVM] Hide internal native and wire implementation types from the Java ABI #55: partial (see above).
• [P3][Dependencies] Update brace-expansion to address GHSA-mh99-v99m-4gvg #62: the advisory is real, but the patched brace-expansion@5.0.8 is not published to the npm registry yet (latest is 5.0.7), so the requested update cannot be applied. Dev-tooling only; no published artifact carries it.

Noted during verification (pre-existing, out of scope)

Scope-table materialization is O(depth²) in every binding: markdown_core_node_scope resolves sealed-relative lines by walking the parent chain per node, so the first scope request on a deep document (e.g. Document.parse at 4096-deep quotes ≈ 113 ms in ES) dominates deep-document cost. The fix (an accumulator-based scope walk like the dump's) touches the C API and all three bindings — worth its own issue.

Verification

pnpm verify green (format, lint, contracts, gradle model, release version, repository/CI/test/surface/package audits); C correctness + conformance suites; ES node tests (18) + conformance (15) + packed-artifact consumer; Swift tests (17) + conformance + strict lint; Kotlin JVM/Android-host/macosArm64 tests + all three conformance suites + full consumer matrix (KMP, jvm-gradle, Android, Maven-on-JDK-17) + packaging/ABI gates.

Closes #40. Closes #41. Closes #42. Closes #43. Closes #44. Closes #45. Closes #46. Closes #47. Closes #48. Closes #49. Closes #50. Closes #51. Closes #52. Closes #53. Closes #54. Closes #56. Closes #57. Closes #58. Closes #59. Closes #60. Closes #61. Closes #63.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 2dfcd8b5e7

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[github-actions]

PR performance and binary-size diff

Benchmark execution is required; hosted-runner timing, memory, and size deltas are informational only.

Baseline: exact PR base 384e8a744487 (successful main CI).

Performance

Runtime	Workload	Median	Perf diff	Memory	Memory diff
c	representative_large	7.155 ms	⚠️ +37.1%	8,636 KiB	✅ -0.2%
es	deep_nesting	0.269 ms	✅ -7.2%	148,392 KiB	✅ -0.9%
es	large_document	27.919 ms	✅ -16.2%	148,008 KiB	✅ -1.2%
kotlin	deep_nesting	0.276 ms	⚠️ +12.7%	108,368 KiB	✅ +4.8%
kotlin	large_document	22.852 ms	✅ -31.1%	107,960 KiB	⚠️ +5.9%
swift	deep_nesting	0.072 ms	✅ -10.6%	26,192 KiB	✅ +0.7%
swift	large_document	18.284 ms	✅ -17.2%	26,128 KiB	✅ +0.6%

Binary size

Artifact	Bytes	KiB	Size diff
c-shared-library	501,952	490.2	✅ +64 B (+0.0%)
es-wasm	288,818	282.0	✅ +245 B (+0.1%)
kotlin-jvm-jar	318,255	310.8	✅ +5,283 B (+1.7%)

Head CI run

Size deltas are deterministic for identical build inputs. Performance deltas compare separate hosted runners and should be treated as directional evidence, not a pass/fail threshold.