fix(data-integrity): keep controlled value sync atomic

[seonghobae]

Closes #200.
Closes #252.
Closes #263.
Closes #267.
Closes #271.

Scope

Draft standalone CwlEditor integrity lane. This remains the active Inkspan source writer for src/components/CwlEditor.tsx; stacked browser assurance remains in Draft #380.

Behavior contracts

• runtime editable and toolbar visibility inputs fail closed on invalid runtime types;
• controlled/source/reset document inputs accept only the documented string/undefined forms;
• controlled replacement remains transaction-atomic and refuses rejected/transformed previews;
• revoking editability during active composition drains the local composition before read-only transition;
• a controlled value received during composition is deferred and the latest host value is applied after composition ends;
• intermediate composition edits may update the legacy onChange value stream but are excluded from strong onDocumentChange snapshot callbacks until composition is no longer active.

Composition lifecycle tracking is installed synchronously from TipTap onCreate onto the created editor view's DOM before the public onReady callback runs, and is removed during TipTap onDestroy. This keeps lifecycle ownership on TipTap creation/destruction rather than a callback-sensitive React effect while making the immediate-post-ready composition boundary executable.

These are standalone editor/document semantics only. This PR adds no transport, authentication, tenancy, durable persistence, credentials, migrations, retention, deployment, durable audit, model/provider, network, durable PDF, or host-owned Yjs authority.

Verification discipline

The realistic composition regression is src/components/CwlEditor.controlledValueComposition.test.tsx; it exercises a composition that starts immediately after editor readiness, performs an intermediate document change, and requires the strong snapshot callback to remain silent until composition ends. Do not weaken or replace that regression to obtain a green run.

Do not embed mutable PR-head SHAs, protected-main SHAs, workflow run IDs, review counts, mergeability snapshots, or child-stack heads in this body as durable truth. Before any lifecycle action, independently refetch:

• exact protected main and this PR's exact current head/live base;
• ancestry, mergeability, changed paths, and active writers;
• formal reviews and unresolved threads;
• every applicable repository and central workflow/job, including actual checkout/source identity and skipped-required-step state;
• live rulesets/protection and release-acceptance state from release: reconcile Office and npm versions before next stable registry publication #118;
• current test(input): add multilingual browser input baseline #380 parent/child ancestry before any stacked-PR action.

Pending, queued, skipped-required, cancelled, absent, neutral, failed, stale, predecessor, status-only, synthetic-source, wrong-checkout, model-only, or otherwise vacuous evidence is non-passing. Repository CI success is technical evidence only and does not substitute for qualifying independent approval or correct central security/review workflows.

Ownership / governance boundary

Keep this PR Draft until its behavior and exact-current evidence satisfy then-live governance. Draft #380 owns browser harness/spec/config evidence only and must not re-own this PR's production source. Central reusable workflow defects belong to their existing .github owner paths, not to an Inkspan-local workaround.

Do not mark Ready, merge, tag, publish, transfer predecessor evidence, self-approve, weaken gates, create a competing source/workflow writer, force-push/destructively rebase, or fabricate release identity. Protected shipped truth remains whatever exact main resolves to at decision time; #118 remains the canonical stable-release operational-acceptance boundary.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@coderabbitai review

Please review exact current head 9fd9a281073da390409ed368fcc9311c8d501411, including the new fail-closed runtime contracts for value, defaultValue, and formResetValue on the standalone editor. This remains Draft only because protected main is frozen for issue #118's 0.6.0 registry operational-acceptance boundary.

[coderabbitai]

Rate Limit Exceeded

@seonghobae have exceeded the limit for the number of chat messages per hour. Please wait 0 minutes and 22 seconds before sending another message.

[cursor]

Review (head 9fd9a28)

No blocking product defect in the standalone-editor integrity slice. This lane already implements the residual gap called out on #228:

• editable / hideToolbar accept only omitted defaults or exact booleans; "false" throws the payload-redacted RangeErrors before TipTap/accessibility/frame setup.
• value / defaultValue / formResetValue accept only undefined or string.
• Controlled replacement is parsed once, previewed through current transaction policy, and rolled back on live divergence.

Integration

Base is still historical 50ac98c. Live protected main is e8109ec / the #118 v0.6.0 candidate. Predecessor CI on this head is not current-head evidence. After #118, reconverge non-destructively with the then-live tip and regenerate exact-head gates before any readiness decision.

Keep Draft. This comment is not a qualifying independent approval. Do not open a competing CwlEditor.tsx writer; continue #252/#263 here.

  

_{Sent by Cursor Automation: Fix Issues}