Fix findings from a full source review (core 0.3.1, actioncable 0.2.4, client 0.4.3) - #39

…, client 0.4.3)

Core (Rust):
- update_ready? is now EXACT. It only checked the per-client clock lower
  bound, but yrs's integration gate also requires origin/right-origin/parent
  blocks (routinely other clients') and post-Skip blocks sit above the lower
  bound. A cross-client-origin delta on a server missing that client's content
  passed ready?, then update_advances? misread the parked result as an
  already-applied retry (pending doesn't move a state vector): the channel
  ACKED AND DROPPED real content. Reproduced empirically. ready? now
  trial-integrates on a probe seeded with the doc's integrated state (clock
  check kept as a cheap pre-filter); advances? gained defense in depth (a
  parked update reports as advancing, never a duplicate).
- read_text deadlock: it opened a second read txn while a chained temporary
  still held the first; yrs's write-preferring lock made a concurrent writer
  deadlock the process inside nogvl (uninterruptible). Single txn now.
- TOCTOU in integrated_update: pending check and encode ran in separate
  txns, so a concurrent gappy apply between them could serve pending anyway.
  One txn now.
- update_advances? pre-filter: blocks beyond the doc's SV trivially advance;
  the common (novel-update) case skips the full O(doc) probe.
- read_xml: Lexical linebreak/tab nodes emit \n/\t instead of vanishing.

ActionCable concern (Ruby):
- A lost-ack retry re-broadcasts before acking :applied. Record-then-crash
  (or a failed broadcast) previously left live subscribers permanently stale:
  the retry skipped distribution, and nothing else could reach them.
- A missing document key fails closed (Y::Error) instead of silently
  recording under nil, broadcasting to a dead stream, and still acking
  (the AnyCable fresh-instance + forgotten-key case).
- Floor raised to yrby >= 0.3.1 (the ack-and-drop fix lives in core).

Client (TypeScript):
- rejected() handler: an auth-rejected subscription surfaces via onError and
  tears down instead of hanging at "connecting" forever, queueing edits.
- Awareness frames are content-validated (dry-run entries) before apply:
  a partially-malformed payload previously mutated awareness state entry by
  entry with no event fired. Trailing bytes inside the blob also rejected.
- bfcache restore: presence is stashed on pagehide and restored on
  pageshow(persisted) - a restored page no longer rejoins as a ghost.
- Transport sends are guarded: sync throws and promise rejections
  (@anycable/web) surface via onError instead of unwinding/unhandled.
- CJS TypeScript consumers get real CJS-flavored declarations (dist/cjs
  d.ts + per-condition types exports); fixes TS1479 under node16 resolution.

Packaging:
- yrby no longer ships the yrby-decoder gem's files (the frozen duplicate
  could shadow a newer standalone release across the load path).
- Cargo.lock ships in the source gem: source builds compile the exact crate
  graph CI tested.
- Demo: the unauthenticated audit-control endpoint (history wipe + per-write
  delay injection) is no longer mounted in production.

New real-Y.js fixture (CrossClientOrigin) + regression tests across all
layers, including a read_text-vs-writers thread hammer.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Closing the last review-verification caveat surfaced the real bug: driving a
live Lexxy editor (agent-browser: type "foo", Shift+Enter, type "barbaz") and
running read_xml on the captured durable state returned "foobarbaz" — the
hand-built regression test had modeled the structure wrong. A Lexical
LineBreakNode is NOT an XmlText child with __type=linebreak; it is an embedded
**Y.Map with { __type: "linebreak" }**, the same shape as the per-text-node
metadata maps the walker deliberately skips — so the newline was being
swallowed by the metadata arm.

Fix: Out::YMap embeds now consult their __type — "linebreak" emits '\n',
"tab" emits '\t', anything else (the "text" metadata maps) stays silent, in
both walk_lexical_block and inline_lexical_text. The XmlText-child handling
stays as a defensive path.

Tests:
- fixtures/lexical_linebreak.bin: ground-truth bytes captured from the live
  editor via the lexxy-realtime test server (GET /content/:room); the new
  test asserts they extract as "foo\nbarbaz".
- The hand-built test now builds the REAL structure (Y.Map embeds, including
  a silent metadata map) instead of the imagined one.

Verified end-to-end: Doc#read_xml on the captured bytes returns "foo\nbarbaz".

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Each comment now states the invariant and why it matters, without the
incident narrative (that lives in the CHANGELOG and PR).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>