fix(data-integrity): keep controlled value sync atomic

[seonghobae]

Closes #200.
Closes #252.
Closes #263.
Closes #267.
Closes #271.

Consolidated standalone-editor integrity lane

This Draft is the active single-writer lane for src/components/CwlEditor.tsx: controlled-value transaction atomicity plus finite runtime contracts for editable, hideToolbar, value, defaultValue, and formResetValue.

Protected shipped truth and the frozen v0.6.0 source candidate are independently resolved main@3b38ead2d00f44eb578d0689087b9293b3dabe1e. Current exact Draft head is 43d4f00c7cae657c54f8fd9c97d41a315bfbb350 on fix/atomic-controlled-sync-200.

Fresh exact comparison resolves protected main as the merge base, reports 15 ahead / 0 behind, and limits the current delta to six standalone-editor source/test files:

• src/components/CwlEditor.runtimeEditable.test.tsx;
• src/components/CwlEditor.runtimeToolbarVisibility.test.tsx;
• src/components/CwlEditor.tsx;
• src/components/CwlEditorControlledValuePolicy.test.tsx;
• src/components/editorControlledValueSync.ts;
• src/components/editorDocumentValue.runtime.test.tsx.

Test-first lineage

Controlled-value document atomicity

• RED 9bb0f03112e5d616a08cad81b80aaf953ac7ccc3: CI 31482959890 failed at the intended append-transaction transformation regression while Security 31482959919 and SAST 31482959928 passed.
• Production parses the requested complete replacement once, preflights it through current ProseMirror transaction policy, refuses rejected/transformed previews, and restores captured local state on live divergence or dispatch failure.

Runtime edit authority — #252

• RED a28bde93b230af732cb5759c64ffbc97b67bc3e8: CI 31555746505 proved runtime editable="false" was accepted; Security 31555746518 and SAST 31555746504 passed.
• Production now accepts only omitted/default or exact booleans before editor/accessibility/frame construction; invalid runtime values fail closed with stable payload-redacted diagnostics.

Runtime toolbar visibility — #263

• RED 9e0244268a5e8abfca2c0786d00279447215e598: CI 31581761290 failed at the public SSR product boundary while Security 31581761226 and SAST 31581761227 passed.
• Production requires an exact boolean before editor/frame construction.

Runtime source documents

• Test-only RED 58531c02178227fa4c2a20a21b9c1010d4f0ab35, CI 31589049763, reached the intended public SSR boundary after normal install/typecheck. Exactly the new invalid value / defaultValue assertions failed while valid-string behavior remained green.
• Production now accepts exactly undefined or a string for each source-document prop and rejects every other runtime value before serialization, hooks, editor construction, or native-form propagation. Diagnostics are stable and payload-redacted.

Runtime native-form reset document

• Test-only RED 2fe2ce9ba0071953b879f562c4cffed08e5ff1de, CI 31590376623, passed typecheck/browser/Office and existing valid tests; the new non-string formResetValue assertion failed.
• Production now accepts exactly undefined or a string and rejects every other runtime reset document before hooks, editor construction, hidden-field wiring, or reset-listener registration.

Exact-current-head evidence

For unchanged exact head 43d4f00c7cae657c54f8fd9c97d41a315bfbb350 at the latest refetch:

• CI 32004738252: completed / success;
• Security Scan 32004738493: completed / success;
• SAST Semgrep 32004738264: completed / success;
• formal submitted review state: one predecessor-head Cursor COMMENTED review on 9fd9a281073da390409ed368fcc9311c8d501411, explicitly non-approving;
• qualifying approving reviews: 0;
• unresolved inline review threads: 0;
• GitHub reports the Draft mergeable.

The previous PR body named predecessor head 9fd9a281... and stale protected-main state as current. That snapshot is superseded by the exact state above. Repository exact-head success is technical evidence only and does not establish any separately applicable central required workflow or qualifying independent latest-push approval. Predecessor, absent, queued, skipped, cancelled, status-only, or model-only evidence remains non-passing.

Ownership boundary

These changes are Inkspan-local document/configuration validation only. They add no transport, authentication, authorization, tenancy, durable persistence, credentials, migration, retention, deployment, durable audit, model/provider, Yjs authority, network, or durable PDF/print authority.

Governance and integration boundary

Keep this PR Draft and unmerged while #118 owns exact protected v0.6.0 tag/publication/provenance/digest operational acceptance and while qualifying independent latest-push approval plus every then-applicable governance/workflow gate remain incomplete. Current supported connector evidence does not independently establish organization-level ruleset details, so historical prose about a named ruleset is not merge authority. Before any lifecycle transition, refetch the unchanged head, protected main, ancestry/mergeability, live rules/permissions when available, formal reviews/threads, and every applicable repository/central workflow. Do not transfer predecessor evidence, self-approve, weaken gates, move protected main, or fabricate tag/release identity.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 236b6b3a-ffcb-4bd7-a13c-4618cb621642

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@coderabbitai review

Please review exact current head 9fd9a281073da390409ed368fcc9311c8d501411, including the new fail-closed runtime contracts for value, defaultValue, and formResetValue on the standalone editor. This remains Draft only because protected main is frozen for issue #118's 0.6.0 registry operational-acceptance boundary.

[coderabbitai]

Rate Limit Exceeded

@seonghobae have exceeded the limit for the number of chat messages per hour. Please wait 0 minutes and 22 seconds before sending another message.

[cursor]

Review (head 9fd9a28)

No blocking product defect in the standalone-editor integrity slice. This lane already implements the residual gap called out on #228:

• editable / hideToolbar accept only omitted defaults or exact booleans; "false" throws the payload-redacted RangeErrors before TipTap/accessibility/frame setup.
• value / defaultValue / formResetValue accept only undefined or string.
• Controlled replacement is parsed once, previewed through current transaction policy, and rolled back on live divergence.

Integration

Base is still historical 50ac98c. Live protected main is e8109ec / the #118 v0.6.0 candidate. Predecessor CI on this head is not current-head evidence. After #118, reconverge non-destructively with the then-live tip and regenerate exact-head gates before any readiness decision.

Keep Draft. This comment is not a qualifying independent approval. Do not open a competing CwlEditor.tsx writer; continue #252/#263 here.

  

_{Sent by Cursor Automation: Fix Issues}