fix(data-integrity): reject invalid runtime document snapshot modes

[seonghobae]

Buyer-visible snapshot data-integrity boundary

Draft PR #218 is the sole writer for src/components/editorDocumentSnapshot.ts. The public createEditorDocumentSnapshot(editor, mode) surface is statically typed with EditorMode = 'markdown' | 'html', but the implementation does not validate the runtime mode. A JavaScript/untyped/deserialized caller can therefore pass mode='md': with no editor Inkspan returns a frozen snapshot that advertises the invalid mode, and with a live editor it silently falls through to HTML for value while retaining the invalid token in snapshot.mode.

This diverges from the explicit fail-closed runtime editor-mode contract already established for the serialization helpers and can make local snapshot evidence internally inconsistent.

Test-first acceptance

1. Continue only on existing Draft PR fix(reliability): bound cyclic document snapshot traversal #218 / branch fix/document-snapshot-cycle-217; do not create a competing writer for src/components/editorDocumentSnapshot.ts. Freeze if that exact branch/path moves independently.
2. RED through public createEditorDocumentSnapshot(): prove an invalid runtime mode is accepted both before editor creation and with a live editor; for the live-editor case, instrument getHTML() / getJSON() and require rejection before editor state is read.
3. GREEN at the public snapshot boundary: accept exactly markdown and html; reject every other runtime value with the stable payload-redacted RangeError('Editor mode must be markdown or html.') before the null-editor branch or editor inspection.
4. Preserve exact empty-snapshot behavior for valid modes, Markdown/HTML/plain-text projections, detached/deep-frozen JSON semantics, cycle/property/container/value defenses, shared acyclic references, SSR/package behavior, and 100% owned-production statement/branch/function/line coverage.
5. Do not coerce, normalize, alias, stringify, or reflect rejected mode values. Add no network, persistence, transport, authorization, tenancy, credential, model/provider, migration, retention, deployment, or durable-audit authority.
6. Reacquire exact-head CI, Security Scan, SAST, packed-package, browser and Office evidence after RED and GREEN.

Integration boundary

Keep #218 Draft/unmerged while #118 owns the unchanged protected v0.6.0 source identity. Any #218 head/live-base movement invalidates predecessor evidence.

[seonghobae]

Resolved on the existing sole snapshot writer PR #218, not on protected main. Exact runtime-mode RED 7bdded7ce5ab6825ffb0e98b96e1aa7e937c670d / CI 31855624275 proved invalid mode='md' was accepted both before editor creation and with a live editor. Current GREEN head 8ba5cbe9edca324e5ac49a8969a8d68aee4e500a validates exactly markdown or html at the public snapshot boundary before the null-editor branch or live editor inspection, preserving the stable payload-redacted RangeError('Editor mode must be markdown or html.'). Fresh exact-head repository CI 31855724588, Security 31855724593, SAST 31855724578, and Strix 31855722928 are completed/success; formal reviews and unresolved review threads are both zero. #218 remains Draft/unmerged because #118 freezes protected main for v0.6.0 publication, so this closure records active-PR completion rather than shipped protected-main truth.