oficina / docs Public

core: fix-round-1 — contain traps instead of widening them

Review found the ABI's headline claim ("garbage input returns an error
code, never a trap") false, and worse: a trap in apply_slice could take
down the whole module instance, not just the offending document.

Root cause (finding 1, critical): apply_slice/text_string held the DOCS
RefCell borrow across calls into yrs. A wasm trap does not unwind (this
crate ships panic = "abort", which compiles every panic to a bare
unreachable instruction — no destructors run), so the borrow guard never
got dropped, leaving DOCS permanently "borrowed" and poisoning every
later doc_new/doc_free — including documents the bad update never
touched. Fixed by cloning the Doc out (get_doc; yrs::Doc is a cheap Arc
clone) and releasing the borrow before calling into yrs.

Also fixed:
- docs_core_alloc/free panicked for len >= 0x8000_0000 (Layout rejects
  sizes past isize::MAX); now returns 0 / no-ops instead.
- A stale handle was indistinguishable from a real empty document;
  docs_core_text_len/text_read now return ERR_NO_DOC for the former
  (text_len's signature changes u32 -> i32 to carry the error code).
- docs_core_apply didn't bound len; ptr/len pairs are now checked
  in-bounds against the module's actual linear memory before any slice
  is constructed, on all three raw-pointer entry points.
- doc_new's handle counter could wrap through 0, the failure sentinel;
  it now skips 0 on wraparound.

core/tests/wasm_trap_containment.rs runs the actual compiled wasm32
artifact under wasmi (not native catch_unwind — verified empirically
that native execution isn't sandboxed the way wasm linear memory is,
and can SIGABRT the whole test process on real UB) to prove: a trap on
one document never corrupts another, and the instance stays usable
afterward. 1500-trial mutation fuzz over the real fixtures, fixed seed,
plus the named c3a9->00a9 repro. Along the way this found a third,
unprompted failure mode — a corrupted 36-byte update that ran for 163
real seconds before returning Ok — now bounded via wasmi fuel metering
so the fuzz treats "ran out of fuel" the same as a contained trap.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011F5CivVm4CmL9ByfSSAaXA