fix(data-integrity): keep controlled value sync atomic

[seonghobae]

Closes #200.
Closes #252.
Closes #263.
Closes #267.
Closes #271.

Scope

Draft standalone CwlEditor integrity lane. This remains the active Inkspan source writer for src/components/CwlEditor.tsx; stacked browser assurance remains in Draft #380.

Exact live refs

Fresh decision-time state:

• protected shipped truth: main@128a239f8b71ca16add4b9e15e21752d1ad63ff0;
• exact PR head: fix/atomic-controlled-sync-200@3fd5157b9e9919800983d3bedce769d7a905c4ff;
• protected main -> head: 22 ahead / 0 behind, merge base = exact protected main;
• current head is a non-destructive two-parent synchronization whose first parent is predecessor 580ac1ad7453d5f6c443b1cea52493bef822844e and second parent is protected 128a239f8b71ca16add4b9e15e21752d1ad63ff0;
• effective delta remains exactly eight files:
  • src/components/CwlEditor.controlledValueComposition.test.tsx;
  • src/components/CwlEditor.editabilityComposition.test.tsx;
  • src/components/CwlEditor.runtimeEditable.test.tsx;
  • src/components/CwlEditor.runtimeToolbarVisibility.test.tsx;
  • src/components/CwlEditor.tsx;
  • src/components/CwlEditorControlledValuePolicy.test.tsx;
  • src/components/editorControlledValueSync.ts;
  • src/components/editorDocumentValue.runtime.test.tsx.

The PR is still Draft, open and mechanically mergeable. Release issue #118 remains authoritative; this branch is not merge-, tag-, or publication-authorized.

Behavior contracts

• runtime editable and toolbar visibility inputs fail closed on invalid runtime types;
• controlled/source/reset document inputs accept only the documented string/undefined forms;
• controlled replacement remains transaction-atomic and refuses rejected/transformed previews;
• revoking editability during active composition drains the local composition before read-only transition;
• a controlled value received during composition is deferred and the latest host value is applied after composition ends.

These are standalone editor/document semantics only. This PR adds no transport, authentication, tenancy, durable persistence, credentials, migrations, retention, deployment, durable audit, model/provider, network, durable PDF, or host-owned Yjs authority.

Exact-current-head evidence

For unchanged exact head 3fd5157b9e9919800983d3bedce769d7a905c4ff:

• CI 32921917993: completed / success;
• Security Scan 32921917990: aggregate success but NON-PASSING for merge/release acceptance. Dependency-review job 98037022886 completed success while the immutable Dependency review action step itself was skipped. The established central fail-closed workflow owner is ContextualWisdomLab/.github#810 / PR #897; predecessor/aggregate-green status does not substitute for execution of the required action.
• SAST Semgrep 32921918014: aggregate success but NON-PASSING for exact-source acceptance. Job 98037022934 checked out GitHub synthetic merge e6e8ff738a4e4928cadfe1468bd40d14b03b2227 (refs/pull/201/merge) rather than contributor head 3fd5157b9e9919800983d3bedce769d7a905c4ff. The established central exact-source owner is ContextualWisdomLab/.github#1222 / PR #941.
• formal submitted reviews: one historical Cursor COMMENTED review on predecessor head 9fd9a281073da390409ed368fcc9311c8d501411; qualifying approvals on this exact head: 0;
• unresolved inline review threads: 0.

Pending, queued, skipped-required, cancelled, absent, neutral, failed, stale, predecessor, status-only, synthetic-source, wrong-checkout, model-only, or otherwise vacuous evidence is non-passing.

Current stack

Draft #380 is the browser-only input-assurance child and is synchronized non-destructively onto this exact parent.

• exact child head: test/cjk-input-assurance-376@c994a250bf7b5e628540ddd971f5eae6cd102582;
• exact child base: this PR head 3fd5157b9e9919800983d3bedce769d7a905c4ff;
• parent -> child: 30 ahead / 0 behind, merge base = exact parent;
• effective child delta: exactly seven browser harness/spec/config paths;
• child remains Draft and mechanically mergeable;
• exact-child CI 32946978193: completed / success. Browser job 98109708820 checked out exact child head, passed immediate checkout attestation, and completed 130 / 130 Playwright tests across Chromium, Firefox and WebKit plus consensus evidence. Build-and-test and the full Office matrix also passed on the exact child head;
• child formal reviews remain 0 and unresolved threads remain 0; security/SAST evidence not generated for this stacked Draft remains absent/non-passing for any lifecycle claim that requires it.

The child owns browser harness/spec/config evidence only. It does not re-own this PR's production source. Its broad /\.browser\.spec\.ts$/u discovery contract deliberately subsumes the parent-side focus-spec inclusion while preventing committed browser specs from becoming structurally undiscoverable.

Governance boundary

Do not mark Ready, merge, tag, or publish from this PR until the unchanged exact head has every then-applicable live repository and central gate, exact-source security evidence, and qualifying independent formal approval under current governance. Refetch protected main, exact head/base, ancestry/mergeability, changed refs/active writers, rules/permissions, reviews/threads, and all applicable workflow runs/jobs with checkout SHAs before any lifecycle transition. Do not transfer predecessor evidence, self-approve, weaken gates, create a competing central workflow writer, or fabricate release identity.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@coderabbitai review

Please review exact current head 9fd9a281073da390409ed368fcc9311c8d501411, including the new fail-closed runtime contracts for value, defaultValue, and formResetValue on the standalone editor. This remains Draft only because protected main is frozen for issue #118's 0.6.0 registry operational-acceptance boundary.

[coderabbitai]

Rate Limit Exceeded

@seonghobae have exceeded the limit for the number of chat messages per hour. Please wait 0 minutes and 22 seconds before sending another message.

[cursor]

Review (head 9fd9a28)

No blocking product defect in the standalone-editor integrity slice. This lane already implements the residual gap called out on #228:

• editable / hideToolbar accept only omitted defaults or exact booleans; "false" throws the payload-redacted RangeErrors before TipTap/accessibility/frame setup.
• value / defaultValue / formResetValue accept only undefined or string.
• Controlled replacement is parsed once, previewed through current transaction policy, and rolled back on live divergence.

Integration

Base is still historical 50ac98c. Live protected main is e8109ec / the #118 v0.6.0 candidate. Predecessor CI on this head is not current-head evidence. After #118, reconverge non-destructively with the then-live tip and regenerate exact-head gates before any readiness decision.

Keep Draft. This comment is not a qualifying independent approval. Do not open a competing CwlEditor.tsx writer; continue #252/#263 here.

  

_{Sent by Cursor Automation: Fix Issues}