Hardening candidates: v2.29.0

[jeiel85]

Candidates surfaced by the v2.29.0 work (#219, #226, #222 follow-ups). Filed at the tag, not worked on in it. Nothing here blocks the release.

• Property-based round-trip test for SyncFrontmatter. The parser is hand-rolled and now carries unknown entries through verbatim; only one realistic Obsidian file pins decode → encode → decode stability. Random-input invariants would cover the classes of input a fixed example cannot. Affects: user files in the sync folder.
• No automated coverage that a preview toggle reaches the mirror file. Tapping a checkbox in Preview should toggle it #219 is covered by unit and Compose tests up to the callback and the string edit; that the flip actually lands in the note and in the synced file was verified by hand on an emulator. Affects: regressions in the Tapping a checkbox in Preview should toggle it #219 write path.
• PreviewLine.sourceLine is only set by the commonmark adapter, not parseHandRolled. If the legacy fallback parser were ever used, checkboxes would silently stop responding rather than fail loudly. Affects: the retained fallback path.
• IncludeSourceSpans.BLOCKS cost is unmeasured. Every preview parse now accumulates block spans; fine for ordinary notes, unquantified for very long ones. Affects: preview latency and memory on large notes.
• Rapid taps inside the one-second save debounce are unverified. The toggle reads editorState.text at tap time and bumps saveTrigger; several taps in quick succession were not exercised. Affects: a check that appears to take and then reverts.
• The local Roborazzi baseline is 20 images off on Windows. Visual regressions cannot be judged off-CI without comparing failure sets before and after, which is what this release had to do. A documented baseline, or a supported way to render the Linux goldens locally, would make the gate usable during development. Affects: developer feedback loop, not shipped behaviour.

Already filed separately, linked so it is not lost: #234 — an indented --- inside a block scalar closes the frontmatter early because the delimiter search uses trim().

[jeiel85]

Audited against the tree at 9969025 (v2.31.0) as part of a sweep over every open hardening tracker.

The linked bug is closed: #234 (indented --- closing frontmatter early) was fixed 2026-07-23. Nothing else in this list has moved.

• Property-based round-trip for SyncFrontmatter — SyncFrontmatterTest still holds only fixed examples; no randomised input.
• Preview toggle reaching the mirror file — MarkdownTaskToggleClickTest covers the click through to the callback; nothing asserts the synced file.
• PreviewLine.sourceLine in parseHandRolled — still set only by CommonMarkPreviewAdapter; the retained fallback in SimpleMarkdownPreview leaves it null.
• IncludeSourceSpans.BLOCKS cost — still unmeasured; the benchmark module has only StartupBenchmark and ScrollBenchmark.
• Rapid taps inside the save debounce — unchanged.
• Roborazzi local baseline (partial) — AGENTS.md documents re-recording goldens on the Linux runner via the record_roborazzi dispatch, which is a supported way to regenerate them. What the item asked for is still missing: nothing records what the Windows-local failure set is expected to be, so a developer still cannot tell a real regression from the platform delta without diffing failure sets by hand.