fix(data-integrity): keep controlled value synchronization document-atomic #200

Buyer-visible data-integrity boundary

Controlled value synchronization must remain document-atomic under active ProseMirror transaction policy. A requested complete replacement may be accepted unchanged or rejected with the prior local document preserved; it must not leave the editor on an unintended third document, report an unapplied controlled value as ordinary success, or mutate through a policy transformation that was not accepted by the host.

This is Inkspan-local standalone editor/document integrity only. Hosts/plugins may enforce editor-local transaction policy. No transport, persistence, authentication/authorization, tenancy, credentials, model/provider, network, migration, retention, deployment, durable audit, host-owned Yjs authority, or durable PDF authority moves into Inkspan.

Canonical owner

Draft PR #201 / branch fix/atomic-controlled-sync-200 is the sole active writer for src/components/CwlEditor.tsx and this controlled-value boundary. The same lane owns the adjacent finite runtime contracts tracked by #252, #263, #267 and #271. Draft #380 owns stacked browser harness/spec/config evidence only; Draft #199 owns native form-reset policy atomicity. Do not create overlapping production-source writers.

Protected shipped truth is whatever exact protected main resolves to at decision time. This issue intentionally does not persist mutable PR heads, workflow run IDs, review counts, mergeability snapshots or child-stack heads as durable truth.

Required behavior

• Runtime value, defaultValue and formResetValue accept only the documented string/undefined forms; runtime editability/toolbar inputs fail closed on invalid types.
• Controlled replacement parses the requested serialized document once, preflights the complete replacement through current transaction policy, and refuses rejected/transformed previews before live mutation.
• Stateful/live-only divergence after preview triggers best-effort restoration of the captured local editor state and remains payload-redacted.
• A controlled host value received during active composition is deferred; the latest host value is applied only after composition ends.
• Intermediate composition updates may continue through the legacy value callback, but strong document-snapshot callbacks must not publish a composition-in-progress document as a committed snapshot.
• Revoking edit authority during composition must not strand ProseMirror/local composition state.
• Accepted updates preserve Markdown/HTML mode-aware parsing, selection/editor lifecycle, SSR/hydration, native-form behavior and packaged consumers.

Verification contract

The realistic composition regressions and controlled-value policy tests in PR #201 are mandatory evidence. Do not weaken, wait around, delete, or replace a failing regression to manufacture green status. For every repair: retain the exact failing behavior as RED, make the smallest causal production fix, run focused/full exact-head tests, and refetch the live base/head plus downstream stack before any lifecycle action.

Before readiness or merge, independently refetch:

• exact protected main, PR fix(data-integrity): keep controlled value sync atomic #201 head/live base, ancestry, mergeability, changed paths and active writers;
• formal reviews and unresolved threads;
• all applicable repository and central workflow runs/jobs, including actual checkout/source SHA and skipped-required-step state;
• live rulesets/protection and the canonical release-acceptance state in release: reconcile Office and npm versions before next stable registry publication #118;
• current test(input): add multilingual browser input baseline #380 parent/child ancestry and exact child delta.

Pending, queued, skipped-required, cancelled, absent, neutral, failed, stale, predecessor, status-only, synthetic-source, wrong-checkout, model-only or otherwise vacuous evidence is non-passing. Repository CI success is technical evidence only; it cannot substitute for qualifying independent approval or correct central security/review workflows.

Integration boundary

Keep this issue open until #201 integrates under then-live governance. Do not self-approve, transfer predecessor evidence, weaken gates, force-push/destructively rebase, create a competing CwlEditor.tsx writer, move protected main outside governance, or fabricate release identity. #118 remains the canonical stable-release operational-acceptance boundary.