preserve(perf): route Score byte-loop hypothesis to canonical #1190

[seonghobae]

Preservation / single-writer status

This generated PR found a plausible callback-overhead hypothesis in renderer-side Score/PDF byte admission, but it is not a second Score bridge source owner.

• Protected product truth: develop@314ddeae7b775a4957594b599358c8255617eb2e
• Initial generated head: 382901e55e3a7f8c7faa83c6f7561e29258c63e4
• First preservation head: 64286bd3ff5f7cff12217aab6495c127a229fc2f
• Repeated generated continuation: 2bb11bc6df5e83424b886002a644080d4ed49dc4
• Exact current head: 698d706a2513a3f0f45e538a26ab0c253a0110ba
• Current protected-base diff: 0 files
• Canonical Score bridge admission/performance owner: fix(score): enforce renderer score bridge admission #1190 exact ff0f0c2f84a048685f74b580bcb4663fd759a278
• Canonical Ruff formatter owner: repair(ci): format consolidated supply-chain policy test #1176 exact 8fe6b6d99c009527ef0bcba419e6f6debdb23c23
• Native Score Storage owner remains fix(score): bound native PDF reads before allocation #865

Finding disposition

The generated change replaced response.every(...) with a for loop, but it still accepted any JavaScript number. That admits NaN, infinities, negatives, fractions and values above 255 before Uint8Array.from(...) coercion. It also supplied no representative Electron/Chromium benchmark, heap/GC evidence or buyer-visible latency measurement for the claim that callback overhead materially blocks the main thread.

Canonical #1190 already contains the stronger form of the useful idea: one indexed pass validates every element as an integer in 0..255 while copying into the destination Uint8Array, after zero-byte and 25 MiB admission checks. It also owns project/song/score identity admission, response metadata validation, hostile-byte/resource regressions, a local near-limit benchmark harness and the corresponding TRACEABILITY boundary. That harness is not promoted to a product speedup claim without representative packaged profiling.

Repeated parallel-writer repair

64286bd3... originally kept the generated finding in ancestry while restoring the exact protected tree. A later generated descendant 2bb11bc6... reintroduced three deltas:

• .jules/bolt.md again asserted severe main-thread blocking and measurable performance gains without packaged profiling;
• scoreStorage.ts again used a manual loop that accepted any JavaScript number, recreating the weaker Score bridge contract;
• test_supply_chain_policy.py again copied repair(ci): format consolidated supply-chain policy test #1176's one-file Ruff formatter delta.

Ordinary descendant 698d706a2513a3f0f45e538a26ab0c253a0110ba uses 2bb11bc6... as its parent and restores the validated zero-delta tree from 64286bd3.... The branch ref advanced with force=false; the intervening generated continuation remains ancestry. This lane therefore owns no current production/test/metadata source and cannot weaken #1190's byte-domain/resource contract or take formatter ownership from #1176.

Every source movement invalidates predecessor checks/reviews. Fresh exact-head evidence only counts; absent/queued/pending is not GREEN.

PR-0 / closure rule

Keep Open / Draft until #1190 or a verified successor preserves every still-valid semantic/test/evidence delta, reconciles its #1176/#865 prerequisites, obtains fresh exact-head repository/security/SAST/SBOM/CodeQL evidence plus qualifying independent non-author approval, demonstrates representative packaged performance if a buyer-visible speedup claim is retained, and reaches protected ancestry. Only then may this zero-delta provenance lane be closed unmerged as fully succeeded.

No self-approval, force-push, destructive rebase, duplicate Score bridge source, unsupported speedup claim, native-storage source copy, copied formatter source, gate weakening, blind rerun, source-neutral wake commit, synthetic status, predecessor-evidence transfer or premature Close.

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Closing as a duplicate of #1190, which addresses the same issue. Thanks!

[google-labs-jules]

Closing as a duplicate of #1190, which addresses the same issue. Thanks!

Understood. Acknowledging that this work is now obsolete and stopping work on this task.