fix: reject imported Text ops past the end of the text

[zxch3n]

Summary

Importing a Text insert, delete or mark whose position is past the end of the text panicked at richtext_state.rs:1653 with the doc locks held (the doc was poisoned; in WASM the instance trapped with RuntimeError: unreachable). Such imports now return Err(DecodeError) and leave the document unchanged and usable, the same way out-of-bounds List/MovableList ops are handled (#1125).

Fixes #1160

Changes

• RichtextState::validate_diff: bounds-checks the text diff in entity-index space (style anchors count), mirroring ListState::validate_diff / MovableListState::validate_diff. It runs in DocState::validate_diff_batch before any container state is mutated.
• oplog::state_apply_can_reject (new, shared by OpLog::preflight_import_changes and PendingChanges::has_state_apply_rollback_ops): Text ops now open the import rollback scope, like List/MovableList/Tree. Without the scope, a validate_diff error hits panic!("state apply returned Err for import without rollback guard").
• Docs: context/movable-list-op-validation.md (Text check, rollback-scope list, cost), pointer in crates/loro-internal/src/state/AGENTS.md.
• Changeset for loro-crdt (patch).

Rationale

Out-of-range positions are invalid external input, so they are rejected with Err, not a panic. The check runs on the diff that is about to be applied to state, so it covers the linear fast path and the tracker (concurrent/checkout) path the same way. Wrong positions are shifted by concurrent inserts but still overrun, e.g. retains 5 items but state only has 4. The rollback scope undoes the op log, including pending changes unlocked by the import and whole import_batch batches (BatchImportGuard::finish).

Validation

• New crates/loro/tests/text_invalid_ops.rs (6 tests): the exact Importing a Text insert past the end of the text panics (richtext_state.rs:1653) #1160 repro; insert/delete (forward and reversed)/mark past the end, including an op that is only out of bounds after an earlier op of the same change; on a plain doc and on one with a concurrent edit; through import_json_updates, binary import and import_batch (stays attached); a forged op depending on a map-only change in the same import; a parked forged op unlocked by a later map-only import (a mutation check showed this fails without the pending-scan change); in-bounds controls still import. On main, the first test aborts the test binary with the Importing a Text insert past the end of the text panics (richtext_state.rs:1653) #1160 panic.
• New crates/loro-wasm/tests/text_invalid_ops.test.ts: fails on main with RuntimeError: unreachable, passes here.
• cargo test -p loro -p loro-internal: 1328 passed, 0 failed.
• pnpm check (clippy -Dwarnings): clean.
• WASM vitest (dev build): all suites pass except base64.test.ts, which needs the base64 target that a dev build does not produce.

Performance

Opening the rollback scope costs a few small clones and journal entries per import. Release build, ad-hoc bench (not committed), machine load avg 4–15, alternating main/PR runs, min of 7 rounds:

workload	main	this PR
20k single-insert Text updates, imported one by one	44.0 / 45.1 ms	49.8 / 49.8 ms
one 200k-op Text update into a non-empty doc	314.3 / 314.2 ms	313.3 / 313.2 ms

That is about +0.3 µs per tiny import (≈ +12% on this microbench). Large imports are not measurably slower. List/MovableList/Tree imports already pay this cost.

Follow-ups (not fixed here)

• Malformed marks: a mark with start >= end (e.g. start: 2, end: 2) hits debug_assert!(start < end) in diff_calc.rs (text linear diff). It is a different class from out-of-bounds positions. A mark without its mark_end (or the reverse) was not examined.
• Rollback-scope cost: AppDag::begin_import_rollback clones frontiers, vv and shallow fields eagerly. Making this lazy would cut the per-import overhead above for every sequence/tree container type.
• Known gap, unchanged: an explicitly detached doc that imports an out-of-bounds op still panics on attach()/checkout_to_latest, because they expect the checkout. This already applied to List/MovableList (see context/movable-list-op-validation.md, "Known gaps").

🤖 Generated with Claude Code

[github-actions]

WASM Size Report

• Original size: 3278.20 KB
• Gzipped size: 1089.60 KB
• Brotli size: 762.92 KB