fix(reliability): bound collaborative field metadata

[seonghobae]

Closes #227.
Closes #264.

Scope and ownership

This Draft is the canonical single-writer lane for src/collaboration/CollaborativeCwlEditor.tsx. It owns bounded/type-safe Yjs XML fragment field metadata, exact runtime validation for inherited editable / hideToolbar booleans, and component-local containment of host-owned awareness getter/listener failures used only for accessible presence presentation. Provider transport, room/document authorization, tenancy, durable persistence, credentials, network lifecycle, model policy, retention, deployment, durable audit, and Yjs document authority remain host-owned.

TDD lineage

• Field RED 94261deacae25983b76a409c990e2a8a8a0cb692: hosted CI 31521818066 / build-test 93880430700 reached the dedicated public regressions.
• Runtime-state RED cf39f9e5b5c2e1b0c6b9c91d49b5d841ccdff674: hosted CI 31583307152 / build-test 94071206726 failed exactly because invalid runtime editable / hideToolbar values were accepted.
• Provider-awareness RED 0970e5cd70dd15ed8a9fde5e03cdf70ea75d3579: a provider whose first awareness read passes configuration and whose second read throws a private sentinel is accepted by configuration but the production predecessor directly rereads provider.awareness for presence counting, so the new SSR regression deterministically fails before the repair. The immediate source repair superseded hosted RED generation; no hosted RED is claimed.
• Provider-awareness GREEN fbe4d3ae34e1c5e0d080ef9076a4f0ebd539faa7: presentation-only awareness reads are isolated through a local fail-closed helper, yielding the existing zero-presence fallback instead of leaking the host getter failure.
• Listener RED 5b7a67e64cd837008d85a6375685c239205c0dca: realistic browser regressions require host-owned awareness.on('change', ...) and cleanup off(...) failures not to escape the component. The production predecessor invokes both directly, so the assertions deterministically fail; the immediate repair superseded hosted RED generation and no hosted RED is claimed.
• Current GREEN 8834f15bfc5006c041afeea2fb696498ffdd1106: contains listener registration and cleanup failures without weakening valid provider behavior, presence counting, Yjs document authority, or host lifecycle ownership.

Current exact boundary

Protected shipped truth and frozen v0.6.0 source candidate are independently resolved as main@3b38ead2d00f44eb578d0689087b9293b3dabe1e. Current exact Draft head is 8834f15bfc5006c041afeea2fb696498ffdd1106 on fix/collaboration-field-runtime-boundary-227.

Fresh exact comparison resolves protected main as the merge base, reports 10 ahead / 0 behind, and limits the delta to five branch-owned paths:

• src/collaboration/CollaborativeCwlEditor.fieldBoundary.test.tsx;
• src/collaboration/CollaborativeCwlEditor.providerAwarenessFailure.test.tsx;
• src/collaboration/CollaborativeCwlEditor.providerListenerFailure.test.tsx;
• src/collaboration/CollaborativeCwlEditor.runtimeState.test.tsx;
• src/collaboration/CollaborativeCwlEditor.tsx.

Current behavior

• field must be a string no longer than 1,024 UTF-16 code units before trimming and remains nonblank after normalization;
• editable and hideToolbar accept only exact runtime booleans;
• presentation-only provider awareness rereads fail closed to zero presence if a host getter fails after structural validation;
• host change listener registration or cleanup failures are contained at the component boundary rather than leaking private provider values through render/unmount; and
• omitted/default values, valid providers/listeners, Yjs sole-source-of-truth semantics, collaboration presence/status behavior, callbacks, SSR/package behavior, native-form behavior, and standalone no-service operation remain unchanged.

These provider-failure changes do not replace the broader awareness-module hardening owned separately by Draft #167. They repair only this PR's component-owned direct host interactions and should compose with #167 after the protected release boundary permits source-owner-aware reconciliation.

Exact-current-head evidence

For unchanged exact head 8834f15bfc5006c041afeea2fb696498ffdd1106 at the latest fresh refetch:

• CI 32220059531: completed / success;
• Security Scan 32220059565: completed / success;
• SAST Semgrep 32220059557: completed / success;
• formal review state: one predecessor-head Cursor COMMENTED review only, therefore 0 qualifying approvals;
• unresolved inline review threads: 0;
• GitHub reports the Draft mechanically mergeable.

No predecessor check or review evidence transfers to a moved head. Automated checks/model/status evidence is not approval.

Governance and integration boundary

Keep this PR Draft/unmerged while #118 owns exact protected v0.6.0 tag/publication/provenance/digest operational acceptance and while qualifying independent latest-push approval plus every then-applicable governance/workflow gate remain incomplete. Before any lifecycle transition, refetch the unchanged head, protected main, ancestry/mergeability, live rules/permissions when available, formal reviews/threads, and every applicable repository/central workflow. Do not transfer predecessor evidence, weaken gates, self-approve, move protected main, or fabricate tag/release identity.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 94151c5f-0d5c-4cc8-abe6-f93582d37bfd

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[cursor]

Review (head 5fb2f5b)

No blocking fail-closed or contract defect on this exact three-file collaborative-boundary repair. The implementation order matches the claimed contracts:

1. editable / hideToolbar accept only omitted defaults or exact runtime booleans; truthy strings such as "false" throw the stated payload-redacted RangeErrors before they can change edit authority or toolbar visibility.
2. field is type-checked and length-bounded at 1,024 UTF-16 code units before trim(); rejected contents are not reflected in diagnostics.
3. The new tests prove the hostile cases. Existing collaboration tests still cover omitted field → default, whitespace-only emptiness, and real boolean read-only / hidden-toolbar behavior.

Keep this Draft unmerged while #118 owns the exact v0.6.0 source identity at main@e8109ec. This comment is not a qualifying independent approval and does not transfer predecessor CI or review evidence.

Residual risks (out of this PR)

• Standalone CwlEditor still forwards runtime editable / hideToolbar without the same boolean gate. A deserialized "false" on the non-collaborative surface can still enable editing. That is a separate buyer-visible integrity gap, not a defect of this collaborative-only lane.
• Public field docs still describe the fragment name only. Hosts learn the 1,024-unit ceiling at runtime.

Next action: leave #228 Draft until current-head required checks and an independent last-push approval land after #118; do not expand this PR to the standalone editor surface.

  

_{Sent by Cursor Automation: Fix Issues}