fix: preserve numeric zero values through work-item normalization

[seonghobae]

Closes #609.

Repair contract

• preserves numeric 0 only for the zero-valid planning fields budget, actualCost, and storyPoints;
• keeps unrelated text-field falsy semantics unchanged (owner: 0 and owner: false normalize to empty);
• covers persisted state, external wbs.json, edit → save → reopen, connected JSON sync, and CSV export through realistic browser paths;
• keeps JSON-sync initialization fail-closed until hydration completes, serves that bootstrap guard from the cloud static allowlist, and covers the route and runtime guard behavior;
• retains planning metadata (predecessors, sprint, budget, actualCost, storyPoints) in connected JSON sync without broadening zero preservation to unrelated fields.

TDD / root-cause evidence

Protected develop@2c328875e00e86537df3e965170be80532571cad used truthiness fallbacks that dropped numeric zero. The regression lane first demonstrated the missing-zero behavior; current-head review then exposed over-broad falsy preservation, load/export races, omitted JSON-sync planning fields, a hydration-time empty-file overwrite path, a missing cloud static route, and a route regression that was not part of the explicit API suite. Those defects were repaired on the existing branch with realistic browser/API coverage.

This run also found an evidence defect adjacent to the product repair: the new production module json-sync-bootstrap-guard.js was outside the branch's canonical Istanbul coverage surface. A RED coverage-contract change first proved the omission, tests/unit/json-sync-bootstrap-guard.test.mjs now exercises the real bootstrap behavior, and package.json now instruments the production guard under c8 and executes that behavior test in test:coverage:cases.

A temporary assertion requiring the repository Server Tests workflow itself to run coverage correctly failed against the live workflow. That assertion was removed from this product lane after confirming ScopeWeave PR #523 is the existing causal owner of exact-contributor checkout plus owned coverage execution. This branch does not duplicate or weaken #523's control-plane repair.

All currently posted review threads are resolved on the exact current head.

Security dependency convergence

This branch aligns both package.json and package-lock.json to Hono 4.13.5, avoiding the Hono <4.13.5 advisories published on 2026-08-26 (GHSA-crvj-82cr-hjcx, GHSA-gqvv-2mrq-wpjv, GHSA-g6gw-c38x-mqfc).

Exact identity

• protected live base: develop@2c328875e00e86537df3e965170be80532571cad
• exact contributor head: 5c1f7eced40cef872b28f59e3d434ebc3cd6c17a
• exact contributor tree: 29d2edf1b49681159be0095a097cc70612827bf4
• branch: fix/preserve-zero-normalization-609
• Ready/non-Draft and mechanically mergeable at the latest fresh refetch
• no qualifying independent current-head approval is present

Any protected-base or contributor-head movement invalidates revision-sensitive evidence until freshly reconciled.

Current verification boundary

For exact contributor head 5c1f7eced40cef872b28f59e3d434ebc3cd6c17a, the currently associated repository workflow runs are terminal GitHub-success:

• OSV Scanner 33248939823;
• Fuzz 33248939524;
• Dependency Review 33248939658;
• Server Tests 33248939552;
• Security Scan 33248939536; and
• SAST Semgrep 33248939514.

These conclusions are not all promoted to merge-authorizing exact-contributor evidence. The current repository Server Tests workflow still materializes the PR synthetic merge rather than proving execution at the immutable contributor SHA and still lacks the integrated exact-head owned-coverage control. PR #523 owns that repository-native repair. Therefore current Server Tests success is useful behavior evidence only, not exact-head merge authority. Any centrally inherited exact-head/security/review prerequisites must likewise be regenerated after their owning control repairs integrate.

No current formal review is a qualifying independent current-head APPROVED review.

Merge acceptance

Do not merge or enable auto-merge until the unchanged exact contributor head remains reconciled to freshly resolved protected develop, #523's exact-head Server Tests/coverage control is protected-shipped and regenerated for this head, every applicable repository and inherited browser/owned statement-branch-function-line coverage/docstring/CodeQL/SAST/security/dependency/supply-chain/package/provenance gate is substantively terminal-passing, valid unresolved findings are zero, and live branch protection/rulesets have a qualifying independent current-head approval.

Pending, queued, skipped-required, cancelled, absent, neutral-required, failed, stale, predecessor, synthetic-only, status-only, author-only, model-only, rate-limited, or infrastructure-only evidence is non-passing.

[coderabbitai]

📝 Walkthrough

Walkthrough

budget, actualCost, storyPoints의 숫자 0 보존 로직을 수정했습니다. JSON 및 CSV 내보내기를 갱신하고, 편집·저장·재개방·외부 데이터·자동저장 동기화를 검증하는 Playwright E2E 테스트를 추가했습니다.

Changes

숫자 0 값 보존

Layer / File(s)	Summary
숫자 0 정규화 app.js	입력 필드, 초안, 외부 레코드 정규화에서 budget, actualCost, storyPoints의 숫자 0을 보존합니다. 다른 falsy 값은 기존 규칙에 따라 처리합니다.
내보내기 및 동기화 데이터 app.js	CSV와 JSON 내보내기에서 숫자형 필드의 숫자 0을 보존합니다. JSON 출력에 predecessors, budget, actualCost, sprint, storyPoints를 포함합니다.
숫자 0 왕복 E2E 검증 tests/e2e/numeric-zero-roundtrip.spec.js, package.json, index.html	숫자 0의 편집, 저장, 재개방, localStorage 영속화, 외부 wbs.json 로드, 자동저장 동기화 및 CSV 출력을 검증합니다. Cloud E2E 명령에 테스트를 추가하고 모듈 사전 로드를 선언했습니다. 의존성 버전도 갱신했습니다.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Merge Risk: 🔵 Low · up to bd538

The numeric normalization change is localized and preserves zero values for the intended planning fields, but the synchronization regression path can start before persisted work items render and may falsely validate an empty file. The PR is mergeable with owner awareness and a deterministic wait in the test setup.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 8 functions across 2 files. (2 skipped: 2 …	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목은 work-item 정규화 과정에서 숫자형 0 값을 보존하는 핵심 변경을 정확하고 간결하게 설명합니다.

Full details: Docstring Coverage

Explanation

Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 8 functions across 2 files. (2 skipped: 2 unsupported.)

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 2

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/preserve-zero-normalization-609

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@jules Continue this existing repair branch; do not create a competing PR or touch unrelated lanes.

Fresh serialization point: exact current head is 46d3ce870c902325cb77e8cce521a87589194d4b, protected live base is develop@2c328875e00e86537df3e965170be80532571cad. Current-head RED is tests/e2e/numeric-zero-roundtrip.spec.js; Devin independently confirms at this exact head that persisted numeric 0 renders empty and the E2E regression remains red until the production fix lands. Hosted Actions are presently queued, so queue state is not completion evidence.

Please make the smallest root-cause fix on THIS branch and preserve the RED regression:

1. renderEditorField: preserve zero with nullish fallback (input.value = value ?? '').
2. sanitizeDraft: use String(draft?.[field] ?? '') so numeric zero survives editor save.
3. createNormalizedExternalRecord: for zero-valid numeric fields budget, actualCost, storyPoints, replace truthiness fallbacks with nullish fallback while retaining existing defaults semantics.
4. exportCsv: for those same three zero-valid fields, preserve numeric zero with nullish fallback.
5. Audit only semantically identical zero-valid coercion boundaries. Do NOT blanket-convert unrelated || behavior, alter 🎨 Palette: [접근성] 빈 상태의 버튼 비활성화 시 네이티브 disabled 속성 적용 #608 accessibility behavior, weaken tests, or change gates.

Acceptance evidence: the existing edit → save → reopen Playwright regression must pass for each field independently and all three together; run the focused regression and then the project’s applicable full deterministic tests if available. Report exact changed paths and exact test commands/results on the PR. Keep the change bounded to #609.

[seonghobae]

@coderabbitai autofix

[coderabbitai]

Fixes Applied Successfully

Fixed 1 file(s) based on 1 unresolved review comment.

Files modified:

• app.js

Commit: 4646c41f90878215d4ef596d0056c90fcabf4a42

The changes have been pushed to the fix/preserve-zero-normalization-609 branch.

Time taken: 1m 59s

[seonghobae]

@opencode-agent review

Review-only request for exact head f60715267a742e299468c34051a1720be11ad26b against protected develop@2c328875e00e86537df3e965170be80532571cad. Bind any verdict to this exact head and live base. Re-verify field-scoped numeric-zero preservation for budget, actualCost, and storyPoints, unchanged falsy semantics for unrelated text fields, persisted/editor/external-record/CSV round trips, and the resolved external-load race. Do not transfer predecessor-head, model-only, or status-only evidence into current approval.

[seonghobae]

@opencode-agent review

Review-only request for exact current contributor head 0ead5e6c5f53dc74c6cb2666e36d35153ce2fd91 against protected develop@2c328875e00e86537df3e965170be80532571cad. Re-verify the field-scoped numeric-zero contract, JSON-sync planning metadata preservation, and the newly converged Hono 4.13.5 manifest/lock state. Upstream advisories GHSA-crvj-82cr-hjcx, GHSA-gqvv-2mrq-wpjv, and GHSA-g6gw-c38x-mqfc all affect Hono <4.13.5, so treat any regression to 4.13.4 as security-relevant. All currently posted inline threads are resolved. Bind any verdict strictly to this exact head/base pair; predecessor-head, synthetic-merge, neutral, status-only, author-only, or model-only evidence is non-authorizing.

[seonghobae]

@opencode-agent review

Please review exact current head 4c965cb04a9ae5d970b7d61afcbb8caf32197d06 against protected develop@2c328875e00e86537df3e965170be80532571cad. All currently enumerated inline threads are resolved, and the exact-head coverage-evidence job is terminal success. The required OpenCode job is intentionally fail-closed only because no authenticated APPROVED/CHANGES_REQUESTED verdict exists for this SHA; do not reuse predecessor-head verdicts. Verify the numeric-zero field boundary, connected JSON-sync round trip, static bootstrap route regression, and any current-source findings before issuing a SHA-bound verdict.

[seonghobae]

@opencode-agent review

Review-only request for exact current head 4c965cb04a9ae5d970b7d61afcbb8caf32197d06 against protected develop@2c328875e00e86537df3e965170be80571cad. Re-verify the field-scoped numeric-zero contract for budget, actualCost, and storyPoints across renderEditorField, sanitizeDraft, createNormalizedExternalRecord, local persistence, connected wbs.json, and CSV; verify unrelated falsy fields remain normalized as before, and verify the resolved JSON-sync hydration/static-route regressions. Submit a formal current-head verdict only. Do not mutate the branch, rebase, force-push, merge, weaken gates, or infer approval from status-only/model-only evidence.

[seonghobae]

Correction: the protected base SHA is develop@2c328875e00e86537df3e965170be80532571cad (the previous request omitted 325). Bind the current-head review strictly to head 4c965cb04a9ae5d970b7d61afcbb8caf32197d06 and this corrected base.

[seonghobae]

@opencode-agent review\n\nAuthoritative correction: review only exact head 4c965cb against protected develop@2c328875e00e86537df3e965170be80532571cad. Verify numeric-zero preservation for budget, actualCost, and storyPoints across editor, draft/external normalization, local persistence, connected wbs.json, and CSV, while unrelated falsy fields keep prior semantics. Verify the resolved hydration/static-route tests. Submit only a formal current-head verdict; do not mutate, rebase, force-push, merge, weaken gates, or infer approval from status-only evidence.

[seonghobae]

@coderabbitai resume

Resume automatic review for unchanged exact current head 4c965cb04a9ae5d970b7d61afcbb8caf32197d06 against protected develop@2c328875e00e86537df3e965170be80532571cad. All currently enumerated inline threads are resolved and repository-native exact-head workflows are terminal-success; re-review only the current semantic diff and surface any still-valid current-head finding.

[coderabbitai]

@seonghobae Automatic review is resumed for the specified head and protected base. The review will evaluate only the current semantic diff.

✅ Action performed

Reviews resumed.

[seonghobae]

@opencode-agent review

Current-head re-dispatch request for 4c965cb04a9ae5d970b7d61afcbb8caf32197d06 only. Fresh exact-head evidence shows every current review thread resolved; repository-owned Server Tests, Fuzz, Dependency Review, OSV Scanner, Security Scan, and SAST Semgrep are terminal-success, and required-workflow coverage-source-tree / coverage-evidence are terminal-success on this unchanged contributor head. The remaining opencode-review failure is solely the absence of an authenticated APPROVED or CHANGES_REQUESTED verdict from opencode-agent anchored to this SHA. Please review this exact current head and do not transfer predecessor-head verdicts.

[seonghobae]

@opencode-agent review

Review only exact current contributor head 4c965cb04a9ae5d970b7d61afcbb8caf32197d06 against protected develop@2c328875e00e86537df3e965170be80532571cad. Treat every predecessor review/check/body SHA as historical. Fresh current-head evidence shows all posted review threads resolved and repository-owned Server Tests, Fuzz, OSV Scanner, Dependency Review, Security Scan, and SAST Semgrep terminal-success on this exact SHA. The required opencode-review job 99043026152 failed closed solely because no formal APPROVED or CHANGES_REQUESTED Reviews API verdict from opencode-agent exists for this exact head. Re-evaluate the current 8-file semantic diff, including field-scoped zero preservation, JSON-sync bootstrap guarding/static serving, the registered API regression, and the Hono 4.13.5 convergence, then submit a formal review-only verdict anchored to this SHA. Do not mutate the branch, rebase, force-push, merge, weaken gates, or infer approval from status-only/model-only evidence.