fix: keep shallow re-export and parent lookups working on inconsistent stored data

[zxch3n]

Summary

Two follow-ups from reviewing the 1.16.4 release PR (#1121). Both turn a hard failure on bad stored data into a recoverable one.

1. Export an unprunable shallow root verbatim (1febed11)

Re-exporting a shallow doc at its own root (#1123) filters the cached root state. When the state was inconsistent (a container's header parent does not match the container that references it), the export returned an error. The error was not cached, so every export({ mode: "snapshot" }) redid the walk and failed again, and only fork() still worked. Documents already hit by the #1161 family can hold such a root.

Now the error is logged and the root is exported verbatim, as before #1123. Nothing referenced is dropped, and the fallback is memoized like a successful check.

2. Report an unparsable change block instead of panicking (85e8dabb, fc2a196e)

ChangeStore::creator_resolver (#1159) panicked when a lazily loaded block could not be parsed. It runs under the state lock from is_deleted / has_container / get_path, which return bool / Option, so there is no Err to return from them.

• Every reader of the change store records a block it cannot decode or parse (ChangeStore::parse_failures), not only the resolver. The resolver answers CreatorOp::Corrupt, treated like Absent for that lookup.
• checkout, diff, revert_to, import and export (so also fork_at and merge) return DecodeError("cannot parse change block ...") once a block is recorded. export checks again when it is done, so it cannot return bytes that silently miss the block.
• The check is not in _checkout_without_emitting or the exporters: undo, checkout_to_latest and a detached fork call those and unwrap. The first version of this PR had it there and moved the panic to those three; fc2a196e fixes that (review feedback).

Snapshot import already validates KV checksums, so only a forged or truncated-and-rechecksummed block reaches this path.

Known limits (documented in context/arena-parent-links.md)

• undo, checkout_to_latest and fork behave as before this PR on such a doc. They can still panic when they need the broken block itself: AppDag::ensure_lazy_load_node panics with "unparsed vv don't match with change store".
• An import or checkout that is the first to read the block finishes on the partial history; only export re-checks at the end.
• Local edits made after a block was recorded cannot be exported from that document. The current state (get_deep_value) is what can be salvaged.

Behavior change to review

• The forged-header test used to assert that all 48 exports fail; it now asserts that all succeed and keep the content.
• LoroDoc::merge returns the export error instead of unwrapping it.

Validation

• pnpm test: 1744 passed, 37 skipped; doctests pass. pnpm test-loom: 9 passed. pnpm check: clean.
• New tests in change_store.rs: the resolver answer, every reader recording, a doc with a truncated block (using a container that a healthy history does find), an export that is the first to read the block, and a_recorded_parse_failure_does_not_panic_where_no_error_can_be_returned. The last one fails with the panic from the review when the check is put back into the internal checkout.

🤖 Generated with Claude Code

[github-actions]

WASM Size Report

• Original size: 3319.12 KB
• Gzipped size: 1104.80 KB
• Brotli size: 773.78 KB