Bound what a document expands into, not only what it weighs

[rasuvaeff]

Fixes #120

Found by the first full-cycle review (docs/reviews/review-openapi-contract-2026-09-06-full-cycle.md, findings A-1 and A-2).

A-1. A YAML document of 772 bytes exhausted memory and died with a fatal error — not an InvalidContract, so a caller could not catch it.

file=676 bytes, 9^7 nodes   accepted in  93.5 ms, peak  54 MiB
file=724 bytes, 9^8 nodes   accepted in 774.7 ms, peak 390 MiB
file=772 bytes, 9^9 nodes   Fatal error: Allowed memory size exhausted

The mechanism sits between two earlier waves, which is why no single-axis pass could see it: the third wave correctly stopped the reference resolver from descending into data (enum, example, default, const), which also removed the node budget from those keywords; the first wave added assertEncodable(), which json_encodes a schema whole to detect NAN/INF. The bomb lives in an enum, so nothing counted it, and the encodability check turned 387 million nodes into an ~800 MB string.

Documents are now measured by what they expand into — Limits::$documentNodes, default 5 000 000, counted iteratively (the structure being measured must not exhaust the stack either), applied in fromArray() (which fromJson() delegates to) and per file in a DocumentGraph, sharing one budget across the graph as the byte budget already does. The default sits above what any document within documentBytes can hold, so it refuses amplification without refusing size. After the fix every level of the bomb is refused as InvalidContract in ~100 ms at a 10 MiB peak.

A-2. MessageReading appeared in no #[Covers], so Infection generated no mutants for it at all — the body reading loop, including the byte-budget comparison, was outside the gate. The package's own AGENTS.md calls that the symptom and claims the trait was fixed in the first wave; it never was. Adding it raised the mutant count 2297 → 2373, of which 66 were already killed. The ten that escape are the chunking arithmetic and the media-type helpers, classified in AGENTS.md with the reasoning rather than left as noise.

Verification: composer build, composer rector, bin/package-audit green; mutation 2206 killed / 158 escaped, MSI 93% against a gate of 92; probes in docs/reviews/probe-openapi-contract-2026-09-06-full/.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Team

Run ID: f6028502-1a5e-4dce-9c68-841c9790a2dd

Warning

Your free Security trial is over. An organization admin can upgrade to Advanced for continuous pull request security review or dismiss this notice.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}