Story 2275: the one-line change that wasn't — bold/italic on the Matter Brief

🛰️ Satellite: a preset is a serializer, not a stylesheet

The naive fix is one line: preset="light" on four call sites. Detonate it.

A preset does not decide which buttons appear. It decides what bytes get written to the database:

Flip the preset and the moment counsel bolds a phrase, defective pipes stops being stored as defective pipes and starts being stored as **defective pipes**. Every consumer that prints those bytes literally now leaks raw asterisks at a user. This is a data-contract change wearing a UI toggle's clothes.

✈️ Airplane: who actually reads those bytes

The original framing named three consumers. Two of them do not exist, one exists somewhere nobody expected, and the one that does break was never named at all.

🔬 Microscope: the layer, and the two things it refuses to do

BriefContent(value, format, target)

  target=ui      -> React nodes: <strong> / <em> / text     (view mode, proposal strip)
  target=export  -> [{ text, bold, italic }]                (a future PDF/DOCX emitter)
  target=agent   -> the Markdown string, unchanged          (LLM consumers)

  format=plain   -> PASSTHROUGH on every target. Never parsed.

WHY it refuses to build an HTML string

The obvious build is Markdown → HTML → sanitizer whitelist → dangerouslySetInnerHTML. We emit React elements instead. A text node holding <script>alert(1)</script> renders as those literal characters — React escapes it — so injection is impossible by construction rather than by a filter that has to be correct. The repo has no sanitizer dependency, and now needs none. The whitelist is enforced by what the file can emit: <strong>, <em>, text. Nothing else has a code path.

WHY it refuses to use a regex

Legal prose is full of literal asterisks. A regex cannot tell a delimiter from a character that merely looks like one, because that distinction is contextual. This is not theoretical:

The regex pairs two unrelated footnote markers into a phantom emphasis span and deletes both, silently eating the text between them. Nothing reports it. The parser refuses to open emphasis on a * followed by whitespace (not left-flanking), so both survive.

Both repos parse with the same CommonMark implementation — markdown-it here, markdown-it-py in pramaan-functions — so the screen and the search index cannot disagree about which asterisk is a delimiter.

The component tree

MatterBriefPage
 |
 |-- save(field) ------------------- declares contentFormat: {field: "markdown"}
 |                                   for the four prose fields  [the WRITE path]
 |
 |-- BriefHeader
 |    `-- FrameSummaryHistory  preset="light"        <-- frame_summary
 |         `-- EditableFieldWithHistory
 |              |-- EditableSurface     (edit)  --.
 |              `-- SnapshotPreview      (view)  --+-- pre-hydration fallback
 |                                                 |    renders through
 |-- EditableField  preset = isMarkdownCapableBriefField(field)                |
 |    |    <-- core_dispute / theory_of_case / settlement_posture              v
 |    `-- EditableFieldWithHistory ............................. MarkdownContent
 |                                                                    ^
 `-- VegaProposalStrip                                                |
      `-- BriefContent(target=ui) --------------------------------- -'
           [THE LEAK, now fixed]

One predicate drives two things. isMarkdownCapableBriefField(field) picks the editor's preset and decides whether the write path declares contentFormat: "markdown". They cannot drift apart: a field that saves Markdown is exactly a field that says it does.

The flash nobody would have caught

EditableSurface and SnapshotPreview render a raw-text fallback before TipTap mounts (SSR + first paint). On a Markdown preset that fallback dumped **bold** on screen for a frame before the editor swapped it. Both now render through MarkdownContent, which is why the primitive lives in shared/ and the Brief-facing vocabulary wraps it in brief/ — a feature module cannot be imported from shared/ without inverting the layering.

What changed where

Not in this Story

Underline, headings, links, lists, tables. If any is requested later, the store moves to structured TipTap JSON — we do not extend the Markdown-in-field model. And search: that is pramaan-spec#2274, the gate, which merged first.