Importing a Text insert past the end of the text panics (richtext_state.rs:1653) #1160

Summary

Importing a Text insert whose position is past the end of the text panics at crates/loro-internal/src/container/richtext/richtext_state.rs:1653 instead of returning Err. The panic happens while the doc locks are held, so the doc is poisoned (in WASM the instance traps). List and MovableList inserts past the end are rejected by validate_diff; Text has no such check.

Found in the round-2 adversarial review of #1125. Pre-existing on main, not fixed there (#1125 only rejects positions ≥ 2^30 at decode).

Minimal repro (main 6e294c87)

use loro::LoroDoc;
use serde_json::json;

let doc = LoroDoc::new();
doc.set_peer_id(1).unwrap();
doc.get_text("t").insert(0, "ab").unwrap();
doc.commit();
let json = json!({"schema_version": 1, "start_version": {}, "peers": ["1"],
    "changes": [{"id": "2@0", "timestamp": 0, "deps": ["1@0"], "lamport": 2, "msg": null,
        "ops": [{"container": "cid:root-t:Text",
                 "content": {"type": "insert", "pos": 3, "text": "x"}, "counter": 2}]}]});
// panics at richtext_state.rs:1653 instead of returning Err
doc.import_json_updates(json.to_string());

Expected

Err, with the doc unchanged and usable, like the List/MovableList bounds checks (ListState::validate_diff, MovableListState::validate_diff).

🤖 Generated with Claude Code