Pass editor fuzz, fault-injection, soak, and recovery gates

[zoeyrose]

Outcome

Prove the authoring application remains bounded and non-destructive under hostile projects, long sessions, external changes, device failures, and storage faults.

Scope and invariants

• Fuzz project manifests, authored documents, catalog/index inputs, clipboard/automation schemas, scene adapters, and recovery metadata through toolkit bounds.
• Fault-inject reads/writes/rename/fsync/permissions/disk full, external concurrent edits, symlink/path attacks, resource corruption, process crash, and recovery.
• Soak large projects/many tabs, file watching, repeated previews, undo histories, catalog changes, GPU device loss, resize/DPI/multi-window, and isolated playtests.
• Measure memory, CPU/frame, GPU, index/watch queues, undo/recovery/disk, startup/open/save, and shutdown budgets.
• Validate semantic/golden visual fixtures across supported backends.

Acceptance criteria

• Authored files are always wholly old or wholly validated new after every injected failure/crash.
• Malformed/untrusted content cannot escape project/write allowlists, execute code, panic, or allocate unbounded memory.
• Recovery is deterministic, user-visible, revision-checked, and never silently overwrites newer work.
• Extended soak shows bounded resources and clean process/playtest teardown.
• Open exceptions have owners/risk/expiry and block production cutover where needed.

Dependencies and parallelization

Harness grows from M2/M4; final gate requires representative whole-corpus projects and packaged builds.

Licensing

Editor code/tests are MIT. Verified original past work by an approved MIT provenance grantor may be copied, migrated, or translated under the audited file/component grant; other legacy implementation remains behavior/specification input only. Authored content/assets retain exact licenses.