fix(data-integrity): validate local collaboration user runtime fields

[seonghobae]

Current authoritative state

This local collaboration-user runtime boundary is repaired on canonical single-writer Draft PR #167 / fix/collaboration-awareness-bounds-20260811. Protected shipped truth remains exact main@3b38ead2d00f44eb578d0689087b9293b3dabe1e; current exact Draft head is d8407c5fc65027233c880cae2d1f2d14d5261d91. Fresh exact comparison reports the branch diverged 54 ahead / 29 behind, merge base 50ac98cfa0ad9e8dd75f93ca437a5679fed4d804, across 19 awareness/docs/test paths. This is active-PR truth only.

Current serializeCollaborationUser() reads userId, displayName, and cursorColor through the module-owned failure-containment boundary. A host getter/Proxy failure is normalized without reflecting the unknown thrown value; a successful read must be a string no longer than 1,024 UTF-16 code units before trim, Unicode traversal, label truncation, or color-regex work. In-bound behavior remains unchanged: userId is trimmed, nonblank/descriptive/nonnumeric and at most 80 Unicode code points; displayName is trimmed/bounded to the established 80-code-point cursor label; cursorColor is trimmed, exact six-digit hex and emitted lowercase.

The same source owner now also contains host awareness count/capability failures, disposal failures, and direct listener registration/removal failures. Current head commits listener state only after successful host registration, preserves retryable cleanup state after rejected removal, and normalizes private host callback failures. Those adjacent repairs do not broaden or weaken the local identity contract. Remote awareness remains untrusted presentation data and no transport, room authorization, tenancy, persistence, credential, network, database, model/provider, deployment, retention, migration or durable-audit authority moved into Inkspan.

Test-first lineage

Hosted RED lineage remains the hostile getter test-only head 76df70b303ed2a74ee5f33212a1e71fcd65ba001, whose CI reached the intended failures before its immediate successor. Later listener-operation RED commits be5e0a1a1d87a297160a259d3df24cca90c0ca47 and 3694bfaafc96501c0e164668a43870568ee74ce9 were immediately superseded by the current narrow source repair, so no hosted RED is claimed for those generations.

Exact-current-head evidence

For unchanged exact head d8407c5fc65027233c880cae2d1f2d14d5261d91:

• CI 32221759117: completed / success, including exact 100% root coverage, package consumers, demo build, Office Python 3.11–3.14 and Playwright 1.62.0 cross-engine evidence;
• Security Scan 32221759122: completed / success;
• SAST Semgrep 32221759109: completed / success;
• formal submitted reviews: 0;
• unresolved review threads: 0;
• GitHub reports the Draft mechanically mergeable.

Repository technical success is not qualifying independent approval. Predecessor, pending, queued, in-progress, skipped, cancelled, absent, stale, status-only or model-only evidence remains non-passing.

Integration boundary

The defect is active-PR repaired behavior only and is not protected-main shipped truth. Keep this issue open until #167 integrates under then-live governance. Keep #167 Draft/unmerged while #118 owns protected v0.6.0 publication/provenance/digest acceptance. Before lifecycle action refetch exact head/live base, ancestry, formal reviews/threads, live governance and every applicable workflow. Do not create a competing collaboration writer, self-approve, transfer predecessor evidence, weaken gates, move protected main, destructively reconcile the diverged branch, or fabricate release identity.