fix(data-integrity): fail closed on invalid standalone document values

[seonghobae]

Current authoritative state

This standalone source-document runtime-input defect is repaired on the existing canonical single-writer Draft PR #201 / branch fix/atomic-controlled-sync-200. Protected shipped truth and the frozen v0.6.0 source candidate remain exact main@3b38ead2d00f44eb578d0689087b9293b3dabe1e; current exact Draft head is f582e7cfd423cc2f55b2a2adc36a6201186b31ba.

The original statement that the active lane still derived value ?? defaultValue ?? '' without runtime validation is historical RCA, not current active-PR behavior. Current CwlEditor validates source-document props before serialization, hooks, editor construction or native-form propagation: each of value and defaultValue accepts exactly undefined or a string; every other runtime value fails closed through stable payload-redacted Inkspan diagnostics. Controlled precedence (value over defaultValue), empty strings, Unicode Markdown/HTML, mode-aware parsing, controlled-value transaction atomicity, SSR/hydration, native-form initial serialization and callbacks remain preserved.

Prior issue snapshots naming 43d4f00c7cae657c54f8fd9c97d41a315bfbb350 or 343d4132574f4cb20eb561928df034154609bab7 as current are predecessor prose. Live #201 is 19 commits ahead / 0 behind protected main across exactly eight branch-owned standalone-editor paths and additionally carries the same-owner composition transition/deferred-controlled-value corrections consumed by stacked browser-assurance PR #380. A controlled value received during active composition is deferred and only the latest host value is applied after composition ends; this closes a document-integrity boundary without broadening the source-document type contract.

TDD lineage / exact-current-head evidence

Test-only RED 58531c02178227fa4c2a20a21b9c1010d4f0ab35, CI 31589049763, reached the public SSR boundary after normal install/typecheck: exactly the new invalid value / defaultValue assertions failed while valid-string behavior remained green. The subsequent production repair added the exact undefined|string boundary before downstream editor/form work.

For unchanged exact current head f582e7cfd423cc2f55b2a2adc36a6201186b31ba against protected main@3b38ead2d00f44eb578d0689087b9293b3dabe1e:

• CI 32654492013: completed / success; exact-head checkout, 150 test files / 843 tests, 100% aggregate instrumented statement/branch/function/line coverage, package verification, and demo build passed;
• Security Scan 32654492010: aggregate success but non-passing for merge/release acceptance because jobs consumed synthetic PR-merge source 4ffa57cd216d7b1ec7212fad297f86fa863d0909 and Dependency Review was skipped; existing foreign repair owner is .github PR #897;
• SAST Semgrep 32654492044: aggregate success but non-passing for merge/release acceptance because the scan consumed synthetic PR-merge source 4ffa57cd216d7b1ec7212fad297f86fa863d0909; existing foreign exact-source repair owner is .github PR #941;
• formal review state: one predecessor-head Cursor COMMENTED review on 9fd9a281073da390409ed368fcc9311c8d501411, explicitly non-approving;
• qualifying exact-head approving reviews: 0;
• unresolved inline review threads: 0;
• GitHub reports the Draft mechanically mergeable.

Repository CI success is technical evidence only and cannot cure synthetic-source, skipped, absent, predecessor, status-only, or model-only evidence.

Ownership / integration boundary

This is Inkspan-local document validation only. No transport, authentication, authorization, tenancy, durable persistence, credentials, migration, retention, deployment, durable audit, model/provider, Yjs, network or durable PDF authority moved into Inkspan.

The defect is active-PR repaired behavior only and is not protected-main shipped truth. Keep this issue open until #201 integrates under then-live governance. Keep #201 Draft/unmerged while #118 owns exact protected v0.6.0 publication/provenance acceptance and while qualifying independent latest-push approval plus every then-applicable exact-source workflow/governance gate remain incomplete. Any branch-head or live-base movement invalidates predecessor evidence; do not create a competing CwlEditor writer, self-approve, weaken gates, transfer predecessor evidence, move protected main or fabricate release identity.