Answer stability round 2: refuse a node or mark holding a key it does not own

src/adf/document.ts

@@ -43,7 +43,7 @@ export function adfDocumentFault(value: unknown): ConvertFault | undefined {
   const held: unknown = value['content']
   if (!Array.isArray(held)) return notADocument(`an ADF document's content is an array: found ${describe(held)}`)
   const content: readonly unknown[] = held
-  if (holdsItself(content)) return notADocument('an ADF document is a tree: a node or an attribute value holds itself')
+  if (holdsItself(content)) return notADocument('an ADF document is a tree: an object in it holds itself')
   if (!isNodeArray(content)) return notADocument("an ADF document's content holds ADF nodes: one of them is not")
   return nestingFault(content)
 }
@@ -106,7 +106,7 @@ export function isAdfNode(value: unknown): value is AdfNode {
 }
 
 export function isAdfMark(value: unknown): value is AdfMark {
-  if (!isRecord(value) || !holdsOnly(value, markKeys)) return false
+  if (!isRecord(value) || !holdsOnly(value, markKeys) || !ownsWhatItHolds(value, markKeys)) return false
   if (typeof value['type'] !== 'string') return false
   return !('attrs' in value) || isAttributes(value['attrs'])
 }
@@ -123,15 +123,15 @@ export function nodeMarks(node: { marks?: AdfMark[] }): readonly AdfMark[] {
   return node.marks ?? []
 }
 
-// Ancestors alone: a tree may share an object, but an object holding itself walks the guards forever.
+// Tracks ancestors alone: a tree may share an object, but an object holding itself walks the guards forever.
 function holdsItself(root: object): boolean {
   const pending = [{ depth: 0, item: root }]
   const ancestors: object[] = []
-  const onPath = new Set<object>()
+  const onPath = new Set<unknown>()
   while (pending.length > 0) {
     const entry = pending.pop()
     if (entry === undefined) continue
-    for (const left of ancestors.splice(entry.depth)) onPath.delete(left)
+    while (ancestors.length > entry.depth) onPath.delete(ancestors.pop())
     if (onPath.has(entry.item)) return true
     ancestors.push(entry.item)
     onPath.add(entry.item)
@@ -144,7 +144,7 @@ function isNodeArray(value: readonly unknown[]): value is readonly AdfNode[] {
   const pending: unknown[] = [...value]
   while (pending.length > 0) {
     const node = pending.pop()
-    if (!isRecord(node) || !holdsOnly(node, nodeKeys)) return false
+    if (!isRecord(node) || !holdsOnly(node, nodeKeys) || !ownsWhatItHolds(node, nodeKeys)) return false
     if (typeof node['type'] !== 'string') return false
     if ('attrs' in node && !isAttributes(node['attrs'])) return false
     if ('marks' in node && !isArrayOf(node['marks'], isAdfMark)) return false
@@ -219,6 +219,11 @@ function extraKey(value: Record<string, unknown>, keys: readonly string[]): stri
   return Object.keys(value).find((key) => !keys.includes(key))
 }
 
+// holdsItself walks own enumerable keys alone, so a guard reading an inherited one could walk a cycle forever.
+function ownsWhatItHolds(value: Record<string, unknown>, keys: readonly string[]): boolean {
+  return keys.every((key) => !(key in value) || Object.prototype.propertyIsEnumerable.call(value, key))
+}
+
 function holdsOnly(value: Record<string, unknown>, keys: readonly string[]): boolean {
   return extraKey(value, keys) === undefined
 }