fix(data-integrity): keep controlled value sync atomic

[seonghobae]

Closes #200.
Closes #252.
Closes #263.
Closes #267.
Closes #271.

Scope

Draft standalone CwlEditor integrity lane. This remains the active Inkspan source writer for src/components/CwlEditor.tsx; stacked browser assurance remains in Draft #380.

Dependency stack

This source-owner PR inherits the shared dependency foundation from #402 through the Markdown owner #176 by ordinary merge history. Its base is the #176 branch fix/public-markdown-resource-options-175; #380 remains its browser-only child. The net delta against #176 remains standalone controlled-editor semantics and their regression tests. The merge preserves the local preview/rollback and composition lifecycle instead of replacing them with a direct document swap. The helper uses TipTap 3's explicit update-suppression options and public core Editor type; existing behavior and packed-declaration checks reproduced both migration regressions before repair.

Behavior contracts

• runtime editable and toolbar visibility inputs fail closed on invalid runtime types;
• controlled/source/reset document inputs accept only the documented string/undefined forms;
• controlled replacement remains transaction-atomic and refuses rejected/transformed previews;
• revoking editability during active composition drains the local composition before read-only transition;
• a controlled value received during composition is deferred and the latest host value is applied after composition ends;
• intermediate composition edits may update the legacy onChange value stream but are excluded from strong onDocumentChange snapshot callbacks until composition is no longer active.

Composition lifecycle tracking is installed synchronously from TipTap onCreate onto the created editor view's DOM before the public onReady callback runs, and is removed during TipTap onDestroy. This keeps lifecycle ownership on TipTap creation/destruction rather than a callback-sensitive React effect while making the immediate-post-ready composition boundary executable.

These are standalone editor/document semantics only. This PR adds no transport, authentication, tenancy, durable persistence, credentials, migrations, retention, deployment, durable audit, model/provider, network, durable PDF, or host-owned Yjs authority.

Verification discipline

The realistic composition regression is src/components/CwlEditor.controlledValueComposition.test.tsx; it exercises a composition that starts immediately after editor readiness, performs an intermediate document change, and requires the strong snapshot callback to remain silent until composition ends. Do not weaken or replace that regression to obtain a green run.

Do not embed mutable PR-head SHAs, protected-main SHAs, workflow run IDs, review counts, mergeability snapshots, or child-stack heads in this body as durable truth. Before any lifecycle action, independently refetch:

• exact protected main and this PR's exact current head/live base;
• ancestry, mergeability, changed paths, and active writers;
• formal reviews and unresolved threads;
• every applicable repository and central workflow/job, including actual checkout/source identity and skipped-required-step state;
• live rulesets/protection and release-acceptance state from release: reconcile Office and npm versions before next stable registry publication #118;
• current test(input): add multilingual browser input baseline #380 parent/child ancestry before any stacked-PR action.

Pending, queued, skipped-required, cancelled, absent, neutral, failed, stale, predecessor, status-only, synthetic-source, wrong-checkout, model-only, or otherwise vacuous evidence is non-passing. Repository CI success is technical evidence only and does not substitute for qualifying independent approval or correct central security/review workflows.

Ownership / governance boundary

Keep this PR Draft until its behavior and exact-current evidence satisfy then-live governance. Draft #380 owns browser harness/spec/config evidence only and must not re-own this PR's production source. Central reusable workflow defects belong to their existing .github owner paths, not to an Inkspan-local workaround.

Do not mark Ready, merge, tag, publish, transfer predecessor evidence, self-approve, weaken gates, create a competing source/workflow writer, force-push/destructively rebase, or fabricate release identity. Protected shipped truth remains whatever exact main resolves to at decision time; #118 remains the canonical stable-release operational-acceptance boundary.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@coderabbitai review

Please review exact current head 9fd9a281073da390409ed368fcc9311c8d501411, including the new fail-closed runtime contracts for value, defaultValue, and formResetValue on the standalone editor. This remains Draft only because protected main is frozen for issue #118's 0.6.0 registry operational-acceptance boundary.

[coderabbitai]

Rate Limit Exceeded

@seonghobae have exceeded the limit for the number of chat messages per hour. Please wait 0 minutes and 22 seconds before sending another message.

[cursor]

Review (head 9fd9a28)

No blocking product defect in the standalone-editor integrity slice. This lane already implements the residual gap called out on #228:

• editable / hideToolbar accept only omitted defaults or exact booleans; "false" throws the payload-redacted RangeErrors before TipTap/accessibility/frame setup.
• value / defaultValue / formResetValue accept only undefined or string.
• Controlled replacement is parsed once, previewed through current transaction policy, and rolled back on live divergence.

Integration

Base is still historical 50ac98c. Live protected main is e8109ec / the #118 v0.6.0 candidate. Predecessor CI on this head is not current-head evidence. After #118, reconverge non-destructively with the then-live tip and regenerate exact-head gates before any readiness decision.

Keep Draft. This comment is not a qualifying independent approval. Do not open a competing CwlEditor.tsx writer; continue #252/#263 here.

  

_{Sent by Cursor Automation: Fix Issues}

[seonghobae]

Restacked onto current protected main and retained the shared atomic controlled-value synchronization boundary.

Validation at 306c18910890539d927286380d4cf0819b3ec310:

• focused controlled-value/composition/runtime tests: 29 passed
• typecheck passed
• full root suite: 162 files / 900 tests, 100% coverage
• production build and packed-package verification passed

Controlled replacement remains policy-previewed and atomic; composition defers only the latest host value, and runtime prop type violations fail closed. Browser-only assurance remains owned by Draft #380. @codex review

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[seonghobae]

Exact-head dependency inheritance verification — 2026-09-05

Candidate source c80e2b3fb6410306f4bf2750bb1ed56d5db9d074 inherits #176 94b5ca815749a7dd6bc071106eb685d2a193e4dd and its #402 prerequisite 637b910d25dabb363e40d535c6d89f4a5beb8c6d through ordinary history. It was pushed without rewriting the existing source-owner branch. Protected main was independently read as 0b88c16f14f51b54a87eb7164f0edfb06dd60902; these candidates remain unmerged.

The merge keeps this lane's controlled-value preview, rollback, composition deferral and editability guards. Two existing checks first failed after inheriting TipTap 3: the composed-snapshot test received two callbacks instead of one, and the packed-declaration verifier rejected the helper's React-internal type import. The shared helper now uses { emitUpdate: false } and imports Editor from the public core package. No assertions, deadlines, coverage thresholds or owner boundaries were relaxed.

At this exact final source head:

• pnpm coverage --maxWorkers 2: 176 files / 1,021 tests passed; 100% statements, branches, functions and lines; no unhandled errors.
• pnpm build and pnpm verify:package: passed, including independently staged ESM/CommonJS/SSR and strict TypeScript consumers.
• Full current repository browser suite: 70 passed across Chromium, Firefox and WebKit plus consensus; zero unexpected, skipped or flaky tests. The receipt explicitly binds this source head. This is source-harness evidence, not an installed-tarball browser claim and not test(input): add multilingual browser input baseline #380's additional input journeys.
• Project-local macOS CPython 3.14.6 Office run: 173 tests passed, 100% statement/branch/docstring coverage. This development environment uses the declared local package dependencies; it is not a claim that the hash-locked Ubuntu CI matrix ran. An initial attempt to use the explicitly Linux-only wheel lock on macOS failed closed and was retained; no CI hashes or requirements were changed.
• A separately retained 0.7.0 pnpm pack archive has SHA-256 b666296e207d6636e2610e03d0fe52768650464842b32851035f1356ffc63600. It is a local candidate, not a protected published artifact.

The net delta against #176 is eight controlled-editor source/test files; no shared workflow, Markdown or dependency delta is re-owned here. #380 remains the browser-only child and must inherit and verify this new parent independently. Keep Draft. Hosted skipped jobs, absent security/review evidence and predecessor checks remain non-passing; no Ready, formal approval, merge, release or bypass is claimed.

[seonghobae]

Deterministic teardown regression — 2026-09-06

Exact candidate f9a7879b66ea7c9590caa0d0465c84050791aa6c remains a Draft child of #176 94b5ca815749a7dd6bc071106eb685d2a193e4dd. It preserves all prior source-owner changes. The new commit changes only the existing composition teardown test; production source is byte-identical to the preceding c80e2b3f candidate.

The #151 whole-suite run exposed a timing-dependent test-oracle failure: the old assertion queried document text after the editor had been destroyed. Explicitly waiting for destruction reproduced the null-schema error. The test now records the last live document using the existing public destruction callback and then waits for completed teardown; it still requires no late document callback and the original composed text. No runtime lifetime or public callback contract changes.

This is not a weakened oracle: temporarily removing only the existing inactive-component guard made the repaired test fail with Host replacement instead of Original composing. The production guard was restored byte-for-byte, and all six composition tests passed.

Fresh final-head verification:

• 176 production test files / 1,021 tests passed; statements, branches, functions and lines remain 100%, without unhandled errors.
• Build and complete packed-package consumer verification passed.
• All 70 source-browser cases passed across the three engines and consensus, with zero unexpected, skipped or flaky cases and no global errors. The receipt binds this head and run dcb99fc5-1f6a-4e12-9ee4-0a10a173eed5.
• Project-local macOS Office verification passed 173 tests with 100% statements, branches and docstrings. As before, declared local development dependencies are not the Linux-only CI wheel lock and do not replace hosted Ubuntu evidence.
• The retained package SHA-256 is still b666296e207d6636e2610e03d0fe52768650464842b32851035f1356ffc63600, consistent with a test-only change.

The initial browser command was corrected to the existing browser-test package. An initial successful run without head metadata was retained separately and is not substituted for the final head-bound receipt. RED/negative-control logs and final receipts are preserved; no forced reset or test weakening was used.

#380 and #151 must inherit this source-owner regression through ordinary parent-first merges and rerun their own final-head checks. This is not a protected merge, published package, installed-tarball browser result, physical-device/OS-IME proof or central approval. Keep Draft and apply all live governance before integration.