Malformed stamp counters break deterministic LWW ordering

[christian-byrne]

At reviewed SHA 811d6a267b34f1eba2ed0969dd24ccdda565371b, malformed Lamport counters are accepted and make same-op-set projection depend on arrival order.

• stamp[0] is coerced with Number(...), so a string such as "not-a-number" becomes NaN.
• the comparator then reports both compare(NaN, 2) and compare(2, NaN) as newer (1), breaking antisymmetry.
• an independent two-order reproduction ended with different widget values while every op reported applied.

Evidence and reproduction

Reviewed SHA: 811d6a267b34f1eba2ed0969dd24ccdda565371b.

Exact source locations:

• envelope validation stops after kind and op_id; it does not validate stamp, base_version, or actor: src/applier.ts:385-401
• stampKey accepts any array of length at least two and coerces the first member: src/stamps.ts:54-59
• compareStampKeys assumes the numeric member is orderable: src/stamps.ts:42-46
• set_widget uses this result as its LWW gate: src/applier.ts:895-903

Independent verification seeded two documents from one Yjs snapshot and applied the same malformed and valid set_widget ops in opposite orders:

• malformed then valid: final value V, stored stamp counter 2
• valid then malformed: final value M, stored malformed counter serialized as null

Both operations returned applied in both replicas. This violates deterministic convergence and the total-order premise of the LWW gate. Open issue #15 concerns stamp authority but does not cover malformed numeric coercion, NaN, comparator antisymmetry, or this arrival-order divergence.

Suggested root fix: validate the stamp tuple at the wire envelope before digesting or entering a transaction. Require a finite valid Lamport counter plus the contractually valid actor and reject malformed input without mutation. Add a two-arrival-order regression that asserts identical projection and rejection.

Draft-head check: open drafts #123 (38e6ec6fb02a68d676855dd64d271bea96edc3cd) and #138 (ca2a3ec25bcc0d6243a8346d1f8ed53f606cd243) do not address this path.

[christian-byrne]

Fixed and covered by permanent regression tests, both merged to main:

• Fix: Reject malformed operation stamps at the wire boundary #155 at 5914c8d4e74d9bfaa51ae27dba520a24cd2c9d1e — validateEnvelope now rejects a stamp that isn't [finite_number, non_empty_string] before the op reaches digest or mutation.
• Regression suite: test: R-92 malformed-stamp rejection regression (both arrival orders) #169 at bfb0d759396573028ef4673be2d9f0fc132b8f97 — test/stamp-validation.test.ts, 7 tests covering non-numeric/NaN/Infinity counters and non-string actors (byte-identity + __applied-absence on rejection), opposite-order convergence on valid stamps with a duplicate-apply idempotency check, and malformed-first/malformed-last ordering.

Leaving this open for a maintainer to close (also tracked in Linear BE-11139).