[hvab]

Problem and behavior

Theme JSON, shared URLs and saved sessions previously accepted values based on
JavaScript types alone. Unsupported parent themes, non-finite numbers and CSS
values outside the editor contract could reach theme generation. This change
validates known theme fields before applying imported state and rejects invalid
models atomically. ZIP generation also checks the same invariant for direct API
callers, in addition to the separate metadata gate.

The value contract remains the existing R01 policy:

• basedOn is plain; colors are six-digit HEX (either case).
• Text size is decimal 14..24px, content width 36..64rem, margins 1..4rem;
  title scale is finite 1.2..2 and text line height finite 1.3..1.9.
• Decimal precision is independent of slider steps. Shared constraints drive both
  controls and boundary validation.
• Existing font normalization/fallback, version 2 and known-field copying remain.
  Unsupported custom font syntax is rejected at external boundaries.
• Empty display names and invalid folder names remain importable and editable;
  ZIP stays unavailable until metadata is repaired. Invalid storage falls back
  through the existing startup path.

CSS injection into the exported CSS is the relevant boundary risk; the audit did
not demonstrate JS/PHP execution or XSS.

Current-main integration

Merged main b9452c172071ac0b85d48ce5aaf24f4dc8c351f4 without rewriting the
existing fix branch. The only textual conflict was progress history; both sides
are retained. Production code merged cleanly and preserves R03 preferred/effective
panel sizing, hvab-blocks 0.3, and R05 snapshot-based idle-tab/lifecycle persistence.
Successful mounted URL imports still save synchronously before returning.

Validation

• Clean npm ci --cache <temporary-cache> succeeded on Node 24.22.0 / npm 11.19.1
  with the unchanged main lockfile, without configuration changes or copied
  dependencies. The temporary cache avoids the sandbox-protected default cache.
• npm test: 128/128; ESLint, stylelint, Prettier, production build and
  git diff --check pass. Build retains the two inherited VueUse PURE warnings.
• Temporary integration harness: 26/26 cases pass against the real App setup,
  covering invalid File/URL/storage inputs, atomic rejection, direct ZIP guards,
  editable metadata and repair, supported decimal endpoints, ordinary saves,
  Reset, immediate exit, idle tabs, storage-write retry and default/non-default
  URL-import persistence. No new repository tests were added in this refresh.
• Independent review reported no findings. The coordinator accepted the production
  diff and independently repeated all 26 integration cases successfully.
• Published code commit 76850e2
  passed Node 22/Linux CI.
  This result covers the code commit, not a later documentation update. GitHub
  reports PR fix: validate supported theme values at import and ZIP boundaries #2 mergeable against main b9452c1.

Live Aegea installation, real browser file-picker/download flow, Safari/BFCache,
Windows/forced-colors and screen-reader coverage remain unverified. V01–V04 remain
deferred. This PR does not deploy or change the Aegea preview contract.

PR #1 is closed as a duplicate; R02 is already in main. Next step: owner decision
whether to merge PR #2. No merge or deployment was performed.