Add document-format crate

[TrueDoctor]

No description provided.

[gemini-code-assist]

Code Review

This pull request introduces the document-format crate, which provides a typed handle (Gdd) for the .gdd document format, decoupling on-disk layout from the editor's in-memory runtime types. It implements codecs, export options, path layouts, and session state persistence. The review feedback highlights several critical issues: a randomized history writing order in append_history_deltas that can cause document load failures, a race condition on WASM/OPFS in open_from_archive due to non-blocking writes, a potential runtime panic on WASM from using block_on in garbage_collect, and redundant loads in stream_entries due to duplicate hashes in hashes_from_store.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[cubic-dev-ai]

5 issues found across 14 files

Confidence score: 2/5

• In document/document-format/src/lib.rs, add_resource_from_path commits AddResource before bytes are copied, so an I/O failure can leave a persisted hash pointing to missing data; merging as-is risks durable document/resource inconsistency — make the operation atomic (copy/verify first, then persist) or add rollback before merging.
• In document/document-format/src/codec.rs, read_single can convert a trailing decode Err into ExpectedSingle, which hides the real parse failure and can send callers down the wrong recovery path — propagate the second-item decode error before returning the multi-value error.
• In document/document-format/src/export.rs, using two independent booleans means an invalid “all excluded” configuration is representable until runtime validate(), so bad states can slip through call sites and fail late — replace this with a type that makes invalid combinations unrepresentable (or enforce construction-time validation) before merge.
• In document/document-format/src/io.rs, write_single returns ReadError with unreachable variants like NotFound, which can mislead downstream error handling and obscure real write failure semantics — split read/write error types (or rename/refine) to match actual write behavior.

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="document/document-format/src/export.rs">

<violation number="1" location="document/document-format/src/export.rs:22">
P2: Invalid states are representable — two independent bools with runtime validate() instead of a type that makes all-excluded impossible at compile time</violation>
</file>

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[cubic-dev-ai]

P2: Invalid states are representable — two independent bools with runtime validate() instead of a type that makes all-excluded impossible at compile time

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At document/document-format/src/export.rs, line 22:

<comment>Invalid states are representable — two independent bools with runtime validate() instead of a type that makes all-excluded impossible at compile time</comment>

<file context>
@@ -0,0 +1,49 @@
+	/// for VCS workflows where the diffable `history.jsonl` is the interesting payload and the
+	/// registry would rewrite whole-file on every retirement. Consumers replay history from an
+	/// empty registry.
+	pub include_registry: bool,
+	/// Whether to include `history.jsonl`. `false` produces a flat snapshot (registry only),
+	/// useful for sharing without revealing edit history and for cutting file size.
</file context>