fix(accessibility): harden editor metadata runtime contracts

[seonghobae]

Closes #202.
Closes #206.
Closes #229.
Closes #233.

Consolidated single-writer boundary

Protected shipped truth and the frozen v0.6.0 source candidate remain main@3b38ead2d00f44eb578d0689087b9293b3dabe1e. This Draft remains the sole active writer for src/components/editorAccessibility.ts and its focused metadata/runtime tests. It consolidates the superseded direction lane #203 and stacked ARIA lane #207 with accessibility metadata/resource hardening and the BCP 47 validation correction. Host transport, persistence, tenancy, authorization, credentials, durable audit, remote-provider authority, and model policy remain out of scope.

The standalone CwlEditor runtime editable contract is owned by canonical Draft #201, not this helper lane. This branch must not duplicate #201's public-component validation.

TDD lineage

Representative immutable RED generations include accessibility-resource 8b3d7d9959d0c01c63aa2da1cad5a7756ea31985, runtime direction 173c1c8b6165ccffd4d46abdf005e6aa7fe64cf9, runtime ARIA 83d230735aa38c1013b6032dbde4178b1db9a219, BCP 47 preservation 64e46d780cd25bbcc9b821470b641f48820b7e63, invalid extlang position 0551ae31809dc37e146f1bba60bf5d13daf04b60, required-fallback-label resource/type coverage f6aa305d62f9f6715a4730eb77f4ab8c07418248, and finite-state getter TOCTOU coverage d950d610cd2a81ae0d414b247b27323bd3ca83fe.

f6aa305... and d950d61... are immutable test-only RED generations whose hosted repository workflows were still queued/in-progress when their immediate narrow source repairs superseded them, so no terminal hosted RED result is claimed or transferred. The tests are causal contracts against their predecessor implementations: required fallback labels previously bypassed the local type/resource boundary, and finite runtime state getters were previously re-read after validation so a later hostile value could reach emitted attributes. Historical GREEN evidence belongs only to its exact predecessor heads and is not transferred to the current generation.

Current repair contract

• Bound all host-supplied accessibility strings handled by this helper, including required defaultLabel, to 65,536 UTF-16 code units and reject non-string runtime values through one stable payload-redacted RangeError.
• Preserve existing defaultLabel spelling while preserving blank omission and surrounding-whitespace trimming for optional metadata.
• Validate editor language metadata against RFC 5646 rules that are locally decidable without adding an IANA-registry or network dependency, including private-use-only, grandfathered, the permanently valid extlang position, script/region/variant/extension/private-use forms, duplicate variants, and duplicate extension singletons.
• Do not infer, alias-normalize, case-normalize, or registry-canonicalize accepted language tags.
• Snapshot textDirection, ariaInvalid, and ariaRequired exactly once before finite-contract validation and emit only those validated snapshots, closing the getter/Proxy validation-to-use gap without touching fix(data-integrity): keep controlled value sync atomic #201-owned editable behavior.
• Preserve accessible-name precedence, placeholder mirroring, readonly semantics, package behavior, and standalone no-network/no-database/no-credential/no-model authority.

Current generation

The ownership-clean semantic generation was 2cc4b5f3774c5b9c8dcadb81eac77427cbf3f8f8. Required-label RED f6aa305d62f9f6715a4730eb77f4ab8c07418248 was followed by bounded-label implementation a9fc72cb18f2ef3fc1a1daf238f119a8b1c9a8df. Finite-state TOCTOU RED d950d610cd2a81ae0d414b247b27323bd3ca83fe was then followed by the smallest causal implementation at current exact head 59d82f8b65cfad5230fa9e11afb97867293a43f5.

The intended protected-base diff remains exactly:

• src/components/editorAccessibility.resourceBoundary.test.ts;
• src/components/editorAccessibility.ts;
• src/components/editorAccessibilityRuntime.test.ts.

No force-push or destructive rewrite was used. Any workflow result from predecessor heads is historical only and does not transfer to 59d82f8b65cfad5230fa9e11afb97867293a43f5.

Exact-current-head evidence

For unchanged exact head 59d82f8b65cfad5230fa9e11afb97867293a43f5, fresh commit-bound refetch now proves all repository workflows are terminal success:

• CI 32322070195: completed / success;
• Security Scan 32322070146: completed / success;
• SAST Semgrep 32322070224: completed / success;
• formal submitted reviews: 0;
• unresolved inline review threads: 0;
• GitHub reports the Draft mechanically mergeable.

The earlier pending/queued snapshot is superseded. Repository exact-head technical success does not substitute for qualifying independent approval, separately applicable central workflows, or live governance. No predecessor, status-only, comment-only, model-only, queued, pending, skipped, cancelled, or absent evidence is treated as acceptance.

Integration boundary

Keep Draft/unmerged while #118 freezes protected main for v0.6.0 operational acceptance and while qualifying independent approval plus every applicable exact-head gate remain incomplete. Before any lifecycle transition, refetch unchanged head, protected main, ancestry/mergeability, formal reviews/threads, live rules and every applicable repository/central workflow. Do not move protected main, weaken gates, self-approve, transfer predecessor evidence, or fabricate tag/release identity.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 09a84686-6e3f-491b-88b9-f5672842fe95

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}