fix(data-integrity): fail closed on invalid collaborative editor state flags

[seonghobae]

Current authoritative state

This defect remains repaired on the canonical single-writer Draft PR #228 / fix/collaboration-field-runtime-boundary-227. Protected shipped truth and frozen v0.6.0 source candidate remain exact main@3b38ead2d00f44eb578d0689087b9293b3dabe1e; current exact Draft head is 8834f15bfc5006c041afeea2fb696498ffdd1106. Fresh ancestry resolves protected main as the merge base, 10 commits ahead / 0 behind, with exactly five branch-owned CollaborativeCwlEditor source/test paths changed.

The active implementation validates inherited editable and hideToolbar before editor/accessibility/frame construction: only omitted/default or exact runtime booleans are accepted; every other value fails closed through stable payload-redacted RangeError diagnostics. Valid editable/read-only and visible/hidden-toolbar behavior, Yjs sole-source-of-truth semantics, collaboration field validation, presence/status behavior, callbacks, SSR/package and native-form behavior remain preserved.

The same component-owned lane also contains host-awareness presentation failures found after the original state-flag repair: a provider whose awareness getter fails after structural validation degrades to zero remote presence instead of leaking the host exception, and host-owned change listener registration/cleanup failures are contained at mount/unmount. Draft #167 separately owns the broader awareness-module adapter and remains a complementary source owner.

Provider transport, authorization, tenancy, durable persistence, credentials, network lifecycle, durable audit, Yjs authority and model policy remain host-owned.

Test-first lineage and exact-head proof

• State-flag RED cf39f9e5b5c2e1b0c6b9c91d49b5d841ccdff674 proved invalid runtime editable / hideToolbar values were accepted.
• Provider-awareness RED 0970e5cd70dd15ed8a9fde5e03cdf70ea75d3579 and immediate GREEN fbe4d3ae34e1c5e0d080ef9076a4f0ebd539faa7 establish the later host getter containment boundary; the immediately superseded test-only head has no hosted RED claim.
• Listener RED 5b7a67e64cd837008d85a6375685c239205c0dca and current GREEN 8834f15bfc5006c041afeea2fb696498ffdd1106 establish host listener registration/cleanup containment; no hosted RED is claimed for the immediately superseded test-only head.

For unchanged exact current head 8834f15bfc5006c041afeea2fb696498ffdd1106:

• CI 32220059531: completed / success;
• Security Scan 32220059565: completed / success;
• SAST Semgrep 32220059557: completed / success;
• formal review state: one predecessor-head Cursor COMMENTED review, not approval;
• qualifying approving reviews: 0;
• unresolved inline review threads: 0;
• GitHub reports the Draft mechanically mergeable.

Repository exact-head technical success is not qualifying independent approval. Predecessor, pending, queued, in-progress, skipped, cancelled, absent, stale, status-only or model-only evidence is non-passing.

Integration boundary

The defect is repaired on active Draft #228 but is not protected-main shipped behavior. Keep #228 Draft/unmerged while #118 owns exact protected v0.6.0 publication/provenance/digest acceptance and while qualifying independent latest-push approval plus every applicable live workflow/governance gate remain incomplete. Any head/base/ruleset movement requires fresh exact evidence; do not create a competing collaboration writer, self-approve, weaken gates, transfer predecessor evidence, move protected main, or fabricate release identity.