@aiquants/spreadsheet 0.9.0 → 0.10.0

package/src/clipboard/useClipboard.ts

@@ -18,7 +18,18 @@
  * `pasteSpecial.ts`, tiling in the generic `expandRichPaste`, sizes through `gateResizeEntries`
  * (non-undo geometry). Every v0.8 parameter is a capability declaration — absent ⇒ the v0.7 branch
  * byte-for-byte (TSV-only adapters — the commit seam `commitPaste` is the one required member). rearm stays with the setSelection
- * wrapper (§6.9-1 no-double-actor rule).
+ * wrapper (§6.9-1 no-double-actor rule). v0.10 read-only walls (whole-operation, before any
+ * commit, through the `rejectReadOnly` funnel): G4 refuses ARMING a cut whose source range
+ * contains a read-only cell (preventDefault, zero setData, armed clip unchanged, before the
+ * multi-range advisory); G5 refuses a paste whose shared target rect (`computePasteTargetRect`,
+ * transpose-aware) contains one — only for modes writing a cell aspect (CF-only / columnWidths-only
+ * pass); G6a/G6b re-check the cut-move target block and the CURRENT source adapter state before
+ * EITHER commit (the cross-sheet source has no dataVersion channel — the move-time re-read is its
+ * only wall). Capability absent ⇒ all four compile to the previous path byte-identically.
+ * v0.10 paste feedback (plan §3.1): `onPasteResolved(outcome, channel)` — the menu channel is
+ * the promise's 1:1 mirror at the single `paste` wrap site, the event channel fires once per
+ * `runPaste`-reaching gesture; the drag-freeze and null-`clipboardData` pre-reach branches stay
+ * deliberately silent. Prop absent ⇒ never called.
  *
  * シンク上のクリップボード結線 (§6.5.4、v0.8 §4.2.5 / ADR-14)。copy / cut は 3 フレーバー —
  * `text/plain` (素の TSV)、`text/html` (lossless payload を先頭属性 `data-aqsp-clip` に運ぶ相互運用
@@ -35,7 +46,16 @@
  * `navigator.clipboard.read({ unsanitized: ["text/html"] })`) から、変換は `pasteSpecial.ts`、タイル
  * は generic `expandRichPaste`、寸法は `gateResizeEntries` (非 undo 幾何)。v0.8 のパラメータは全て
  * 能力宣言 — 不在なら v0.7 分岐そのまま (TSV のみのアダプタ — commit シーム `commitPaste` だけが必須メンバー)。rearm は
- * setSelection ラッパーの専有 (§6.9-1)。
+ * setSelection ラッパーの専有 (§6.9-1)。v0.10 の読み取り専用壁 (操作全体・両 commit より前・
+ * `rejectReadOnly` 漏斗経由): G4 は元レンジに読み取り専用セルを含む cut の**武装**を拒否
+ * (preventDefault・setData 0 回・装填クリップ不変・複数レンジ通知の前)、G5 は共有ターゲット矩形
+ * (`computePasteTargetRect` — 転置対応) に含む貼り付けを拒否 (セル側面を書くモードだけ — CF-only /
+ * columnWidths-only は素通し)、G6a/G6b は cut-move の移動先ブロックと元アダプタの**今の**状態を
+ * 両 commit より前に再検査 (跨ぎ元シートは dataVersion チャネルが無く移動時再読が唯一の壁)。
+ * 能力未宣言なら 4 壁とも従来経路とバイト同一。v0.10 貼り付けフィードバック (計画 §3.1):
+ * `onPasteResolved(outcome, channel)` — menu チャネルは単一ラップサイト `paste` での promise
+ * 1:1 鏡、event チャネルは `runPaste` 到達ゲスチャ毎 1 回。ドラッグ凍結と `clipboardData` null
+ * の到達前 2 分岐は意図的無言。prop 未指定なら一度も呼ばれない。
  */
 
 import { type RefObject, useCallback, useEffect, useMemo, useRef } from "react"
@@ -45,7 +65,7 @@ import { isWholeCols, isWholeRows, normalizeAdapterHyperlink, normalizeHyperlink
 import { type CellCoord, type CellRange, countRangeCells, enumerateRangeCells, makeRange, rangeSize, type SpreadsheetOperation } from "../model/cellCoord.ts"
 import type { CellFormat } from "../model/cellFormat.ts"
 import type { ConditionalFormatRule, ConditionalFormatRuleInput } from "../model/conditionalFormat.ts"
-import { type AspectCapabilities, aspectCapabilities, type CellEdit, type EditRejection, type EditSource, resolveEditText, type SpreadsheetDataAdapter } from "../model/dataAdapter.ts"
+import { type AspectCapabilities, aspectCapabilities, type CellEdit, type EditRejection, type EditSource, type ReadOnlyRejection, rectContainsReadOnly, resolveEditText, type SpreadsheetDataAdapter } from "../model/dataAdapter.ts"
 import { toR1C1 } from "../model/formulaRefs.ts"
 import type { SelectionState } from "../selection/selectionState.ts"
 import {
@@ -67,7 +87,7 @@ import {
 } from "./clipPayload.ts"
 import { parseHtmlTable, serializeHtmlTable } from "./htmlInterop.ts"
 import { DEFAULT_PASTE_OPTIONS, MODE_ASPECTS, type PasteAspects, type PasteOptions, patchFromClipCell, stripUndeclaredAspects, translateConditionalFormats, transposePayload } from "./pasteSpecial.ts"
-import { expandRichPaste } from "./tiling.ts"
+import { computePasteTargetRect, expandRichPaste } from "./tiling.ts"
 import { measureTsv, parseTsv, serializeTsv } from "./tsv.ts"
 
 /** The armed clip surface a consumer sees (`onClipChange` / `getClip`): `foreign` = the record belongs to another adapter (sheet switch kept a cut). / consumer が見る装填クリップ (`onClipChange` / `getClip`): `foreign` = 記録が別アダプタのもの (シート切替が cut を保持)。 */
@@ -136,6 +156,32 @@ export type UseClipboardParams = {
     onClipboardUnavailable?: (cause: ClipboardUnavailableCause) => void
     /** Source-side rejection of a cross-sheet cut (the target commit already stands). / 跨ぎ cut の元側拒否 (対象 commit は立っている)。 */
     onEditRejected?: (error: unknown, rejection: EditRejection) => void
+    /**
+     * v0.10 read-only refusal funnel (required seam — the root always wires it; identity-stable,
+     * read through paramsRef): G4 (a refused cut arming, `{op:"cut"}`), G5 (a refused paste over
+     * the shared target rect, `{op:"paste"}`) and G6a/G6b (the cut-move target / source walls,
+     * `{op:"paste"}` / `{op:"cut"}`) fire it once per refused gesture. Capability absent ⇒ never
+     * called (byte identity).
+     * v0.10 読み取り専用拒否漏斗 (必須 seam — root が常に渡す。identity 安定、paramsRef 読み):
+     * G4 (cut 武装拒否 — `{op:"cut"}`)、G5 (共有ターゲット矩形への貼付拒否 — `{op:"paste"}`)、
+     * G6a/G6b (cut-move の移動先 / 元側の両壁 — `{op:"paste"}` / `{op:"cut"}`) が拒否ジェスチャ毎
+     * 1 回発火する。能力未宣言なら一度も呼ばれない (バイト恒等)。
+     */
+    rejectReadOnly: (rejection: ReadOnlyRejection) => void
+    /**
+     * v0.10 paste feedback (plan §3.1): the menu channel mirrors `paste(options)`'s resolve value
+     * 1:1 from the single wrap site (read refusals and the write-time re-gate included); the
+     * event channel fires once per gesture that REACHES `runPaste` — the two pre-reach gate
+     * consumptions (drag-freeze, null `clipboardData`) stay deliberately silent. Cause-specific
+     * callbacks (`onClipboardUnavailable` / `onOperationRejected` / `onReadOnlyRejected`) fire
+     * FIRST; the outcome is the trailing summary. Absent ⇒ never called (byte identity).
+     * v0.10 貼り付けフィードバック (計画 §3.1): menu チャネルは `paste(options)` の resolve 値の
+     * 1:1 鏡 (単一ラップサイト — 読み拒否・書込時再ゲートも含む)、event チャネルは `runPaste` に
+     * **到達した**ゲスチャ毎 1 回 (到達前 2 分岐 — ドラッグ凍結消費と `clipboardData` null — は
+     * 意図的無言)。原因特定系 callback が先、outcome は後追いの要約。未指定なら一度も呼ばれない
+     * (バイト恒等)。
+     */
+    onPasteResolved?: (outcome: PasteOutcome, channel: ClipChannel) => void
 }
 
 /** The clip surface (§6.5.4-4 — copy/cut unified in v0.3.2, widened in v0.8). / クリップ状態の公開面 (v0.3.2 で copy / cut 統一、v0.8 で拡張)。 */
@@ -192,6 +238,18 @@ export const estimateTiledCells = (rows: number, cols: number, target: CellRange
 /** True for the plain Ctrl+V options — the only paste that may move a cut (transforms are copy semantics). / 素の Ctrl+V オプションだけ真 — cut を move できる唯一の貼り付け (変換は copy 意味論)。 */
 const isPlainPaste = (options: PasteOptions): boolean => options.mode === "all" && options.operation === undefined && options.transpose !== true && options.skipBlanks !== true
 
+/**
+ * Whether a paste mode writes any CELL aspect (v0.10 G5 wall condition): text / formula /
+ * format / borders / note / comments / hyperlink / validation. `cf` and `sizes` are the
+ * NON-cell channels — a CF-only or columnWidths-only mode never walks the read-only wall
+ * (sheet-level rules and geometry are not cell content, ADR-28 out-of-scope registration).
+ * 貼り付けモードがセル側面 (text / formula / format / borders / note / comments / hyperlink /
+ * validation のいずれか) を書くか (v0.10 G5 の壁条件)。`cf` と `sizes` は非セルチャネル —
+ * CF だけ / 列幅だけのモードは読み取り専用壁を walk しない (シート水準の規則と幾何はセル内容
+ * ではない — ADR-28 のスコープ外登記)。
+ */
+const hasCellAspect = (aspects: PasteAspects): boolean => aspects.text || aspects.formula || aspects.format || aspects.borders || aspects.note || aspects.comments || aspects.hyperlink || aspects.validation
+
 /**
  * The event channel's flavours: the DataTransfer types and a `getData` memoised per type for the
  * gesture (a paste event's `getData` re-materialises the string on every call — 91 ms for 15.8 MB).
@@ -633,6 +691,14 @@ export const useClipboard = (params: UseClipboardParams): ClipboardController =>
                 p.onOperationRejected?.(op, count, "limit")
                 return null
             }
+            // G4 (v0.10 §3-6): cut の武装壁 — 上限ゲート直後・複数レンジ通知の前 (拒否 cut に advisory を
+            // 出さない)。preventDefault はネイティブ cut がシンクの " " を OS クリップボードへ書くのも防ぎ、
+            // setData 0 回 = OS クリップボードも装填クリップも不変。copy は無条件 ALLOW (§3-9)
+            if (op === "cut" && rectContainsReadOnly(p.adapter, range)) {
+                event.preventDefault()
+                p.rejectReadOnly({ kind: "operation", op: "cut", cellCount: count })
+                return null
+            }
             // 複数レンジ選択は末尾レンジのみ + 通知 (明示逸脱 — Excel の整列連結コピーは非対応 §6.5.4-3)
             if (selection.ranges.length > 1) {
                 p.onCopyMultiRange?.()
@@ -746,6 +812,20 @@ export const useClipboard = (params: UseClipboardParams): ClipboardController =>
                 p.onOperationRejected?.("paste", cellCount, "bounds")
                 return "rejected"
             }
+            // G6a (v0.10 §3-7): 移動先の読み取り専用壁 — staleness bounds 拒否の後・遅延読みの前 (両 commit
+            // より前)。cut はタイルしない: 矩形は共有幾何へ 1×1 ターゲット (= 原点 1 回展開) を渡した装填
+            // ブロックそのもの (ADR-28 rule 5 — bounds 通過済みなので clamp は恒等で null は構造的に不能)
+            const targetRect = computePasteTargetRect({ rows: snapshot.rows, cols: snapshot.cols }, makeRange(origin, origin), origin, adapter.rowCount, adapter.colCount)
+            if (targetRect !== null && rectContainsReadOnly(adapter, targetRect)) {
+                p.rejectReadOnly({ kind: "operation", op: "paste", cellCount: snapshot.rows * snapshot.cols })
+                return "rejected" // クリップは維持 (bounds 拒否と同じ品行)
+            }
+            // G6b (v0.10 §3-8): 元レンジの移動時再検査 — 装填後の flip と跨ぎ元シート (dataVersion チャネルの
+            // 無い唯一の面 — ADR-28 rule 4) に対する壁。offending セルは元 = payload は {op:"cut"} (G4 と同文言)
+            if (rectContainsReadOnly(armed.sourceAdapter, armed.range)) {
+                p.rejectReadOnly({ kind: "operation", op: "cut", cellCount: countRangeCells([armed.range]) })
+                return "rejected"
+            }
             // 遅延読み: Ctrl+X 後の書式 / 注釈 commit を運ぶ (ゲートは snapshot 寸法で済んでいる)
             const payload = armedPayload(armed)
             const caps = aspectCapabilities(adapter)
@@ -925,6 +1005,18 @@ export const useClipboard = (params: UseClipboardParams): ClipboardController =>
             const caps = aspectCapabilities(adapter)
             const shaped = stripUndeclaredAspects(transpose ? transposePayload(payload) : payload, caps)
             const aspects = MODE_ASPECTS[options.mode]
+            // G5 (v0.10 §3-4): 読み取り専用壁 — cut ルーティング / 転置 / 側面剥離の後・実体化
+            // (expandRichPaste) の前。壁はセル側面を書くモードだけ (CF-only / columnWidths-only は
+            // walk なしで ALLOW — §3-5)。矩形はタイラーと同一の共有幾何 (computePasteTargetRect —
+            // ADR-28 rule 5、寸法は転置済み shaped のもの)。null (基点グリッド外) は walk せず従来の
+            // "empty" 経路へ落とす。拒否はクリップ / 選択 / CF / サイズ全チャネル不動 (whole gesture)
+            if (hasCellAspect(aspects)) {
+                const wallRect = computePasteTargetRect({ rows: shaped.rows, cols: shaped.cols }, target, selection.active, adapter.rowCount, adapter.colCount)
+                if (wallRect !== null && rectContainsReadOnly(adapter, wallRect)) {
+                    p.rejectReadOnly({ kind: "operation", op: "paste", cellCount: countRangeCells([wallRect]) })
+                    return "rejected"
+                }
+            }
             const cursor: PasteCursor = {
                 row: 0,
                 col: 0,
@@ -995,7 +1087,7 @@ export const useClipboard = (params: UseClipboardParams): ClipboardController =>
      * `onClipboardUnavailable` を鳴らして `"rejected"` (promise は決して reject しない)。イベント
      * 経路の凍結 / 編集中 / 無効ゲートは書込時点で適用。
      */
-    const paste = useCallback(
+    const pasteInner = useCallback(
         async (options: PasteOptions): Promise<PasteOutcome> => {
             const unavailable = (cause: ClipboardUnavailableCause): PasteOutcome => {
                 paramsRef.current.onClipboardUnavailable?.(cause)
@@ -1051,6 +1143,24 @@ export const useClipboard = (params: UseClipboardParams): ClipboardController =>
         [runPaste],
     )
 
+    /**
+     * The public menu paste: `pasteInner`'s resolve value mirrored 1:1 to `onPasteResolved`
+     * from this SINGLE wrap site (v0.10 plan §3.1) — `handle.paste` and the command dispatch's
+     * `void paste(...)` both route here, so every menu gesture is mirrored exactly once.
+     * 公開メニュー貼り付け: `pasteInner` の resolve 値をこの**単一**ラップサイトから
+     * `onPasteResolved` へ 1:1 で鏡映 (v0.10 計画 §3.1)。`handle.paste` もコマンド発行の
+     * `void paste(...)` もここを通るため、menu ゲスチャ毎ちょうど 1 回。
+     */
+    const paste = useCallback(
+        async (options: PasteOptions): Promise<PasteOutcome> => {
+            const outcome = await pasteInner(options)
+            // 原因特定系 callback (pasteInner 内で発火済み) が先、outcome の要約が後 (§3.1 の登記順)
+            paramsRef.current.onPasteResolved?.(outcome, "menu")
+            return outcome
+        },
+        [pasteInner],
+    )
+
     const { enabled, sinkRef } = params
     useEffect(() => {
         const sink = sinkRef.current
@@ -1121,11 +1231,14 @@ export const useClipboard = (params: UseClipboardParams): ClipboardController =>
                 armedRef.current = null
             }
             const data = clipboardDataOf(event)
-            // clipboardData の無い paste イベントは読むものが無い (v0.7 の空文字 no-op と同じ)
+            // clipboardData の無い paste イベントは読むものが無い (v0.7 の空文字 no-op と同じ —
+            // 到達前分岐は意図的無言、onPasteResolved は鳴らさない)
             if (data === null) {
                 return
             }
-            runPaste(flavoursOf(data), "event", options)
+            // event チャネルの発火点は runPaste 到達ゲスチャ毎にここ 1 箇所 (v0.10 計画 §3.1)
+            const outcome = runPaste(flavoursOf(data), "event", options)
+            p.onPasteResolved?.(outcome, "event")
         }
 
         sink.addEventListener("copy", onCopy)

package/src/commands/useCommands.ts

@@ -39,6 +39,15 @@
  * - Return value: true = committed (or nothing needed writing), false = gate rejection / adapter
  *   rejection / command unavailable / commit-gate refusal. Every callback is identity-stable
  *   (params are read through `paramsRef`).
+ * - v0.10 read-only walls (design ADR-28/30, all through the dataAdapter helpers, refusals via the
+ *   required `rejectReadOnly` funnel): G8 `runFill` two-phase collect → walk → materialise (the
+ *   walk covers the producer's own targets — a read-only SOURCE stays legal), G9 editing
+ *   `fillSelection`, G10 `writeFormat` (walks the invoked target ranges, never the selection),
+ *   G11 `runCalc`, G12 idle insertNow, G13 the four annotate setters (commit-gate-first kept),
+ *   and G15 — ONE shared pre-check for the four popover-open command ids between the availability
+ *   bail and the dispatch-level `requestCommit` (content-present annotate chords fall through and
+ *   open the viewer; content-absent and the list chord consume + refuse without force-committing).
+ *   Capability undeclared = every wall compiles to the previous behaviour byte-identically.
  *
  * コマンド実行器 (v0.8 §4.1.13 — ADR-17)。70 の SpreadsheetCommand 全件の executeCommand、handle の
  * 書込群 (applyFormat / setBorders / setHyperlink / setNote / addComment / setValidation)、能力
@@ -67,7 +76,13 @@
  * トグルは setHighlight。formatCommandAnnouncement (opt-in) は書式コマンド成功後に announce へ
  * (state はトグルの適用後状態、非トグルは null)。戻り値: true = commit 成功 (書くものが無い場合も)、
  * false = ゲート拒否 / アダプタ拒否 / 不可用 / commit ゲート拒否。全コールバックは identity 安定
- * (パラメータは paramsRef 経由で読む)。
+ * (パラメータは paramsRef 経由で読む)。v0.10 の読み取り専用壁 (設計 ADR-28/30、全て dataAdapter
+ * ヘルパ経由、拒否は必須 `rejectReadOnly` 漏斗): G8 runFill の 2 相化 (収集 → walk → 実体化 —
+ * walk はプロデューサ自身の targets、読み取り専用ソースは合法のまま)、G9 編集中 fillSelection、
+ * G10 writeFormat (呼出しパラメータを walk — 選択ではない)、G11 runCalc、G12 idle insertNow、
+ * G13 注釈 setter ×4 (commit-gate-first 維持)、G15 = popover 系 4 コマンド id の単一 pre-check
+ * (availability bail と dispatch 水準 requestCommit の間 — 内容有の注釈チョードはビューア開通、
+ * 内容無と list は force-commit なしの消費拒否)。能力未宣言 = 全壁が従来挙動と byte 恒等。
  */
 
 import { useCallback, useMemo, useRef } from "react"
@@ -80,7 +95,7 @@ import { type CellCommentInput, normalizeAdapterHyperlink, normalizeHyperlink }
 import { type CellCoord, type CellRange, countRangeCells, enumerateRangeCells, makeRange, type SpreadsheetOperation } from "../model/cellCoord.ts"
 import { BORDER_DEFAULT_COLOR, type CellBorder, type CellBorders, type CellFormat, type CellFormatPatch, type CellValueFormat, mergeFormat } from "../model/cellFormat.ts"
 import { normalizeColor } from "../model/cellPaint.ts"
-import type { CellEdit, EditRejection, SpreadsheetDataAdapter } from "../model/dataAdapter.ts"
+import { type CellEdit, type EditRejection, isReadOnlyCell, type ReadOnlyRejection, rangesContainReadOnly, type SpreadsheetDataAdapter } from "../model/dataAdapter.ts"
 import type { DataValidationRule, ValidationVerdict } from "../model/dataValidation.ts"
 import type { PopoverKind, PopoverOverrides } from "../popover/usePopovers.ts"
 import type { SelectionState } from "../selection/selectionState.ts"
@@ -118,6 +133,15 @@ export type UseCommandsParams = {
     refreshEditPaint: () => void
     maxOperationCells: number
     onOperationRejected?: (op: SpreadsheetOperation, cellCount: number, reason: "limit" | "bounds") => void
+    /**
+     * v0.10 read-only refusal funnel (required seam — the root always wires it; identity-stable,
+     * read through paramsRef): the producer walls G8–G13 and the popover-chord pre-check G15
+     * fire it once per refused gesture. Capability absent ⇒ never called (byte identity).
+     * v0.10 読み取り専用拒否漏斗 (必須 seam — root が常に渡す。identity 安定、paramsRef 読み):
+     * プロデューサ壁 G8–G13 と popover チョード pre-check G15 が拒否ジェスチャ毎 1 回発火する。
+     * 能力未宣言なら一度も呼ばれない (バイト恒等)。
+     */
+    rejectReadOnly: (rejection: ReadOnlyRejection) => void
     /** Custom colour slots (5 each) for fillColorCustomN / fontColorCustomN. / fillColorCustomN / fontColorCustomN の色スロット (各 5)。 */
     colors: { fill: readonly string[]; font: readonly string[] }
     /** The formatCurrency currency / rendering locale; undefined ⇒ formatCurrency is unavailable (passes through). / formatCurrency の通貨 / locale。未宣言なら formatCurrency は行不在 (素通し)。 */
@@ -395,6 +419,13 @@ export const useCommands = (params: UseCommandsParams): CommandRunner => {
             if (!gateSelectionWrite("format", ranges, p.maxOperationCells, p.onOperationRejected)) {
                 return false
             }
+            // G10 (v0.10 §6.9): 読み取り専用壁 — walk は**呼出しパラメータ** (targetRanges) であって選択では
+            // ない (編集列トグルはセッションセル 1×1 を渡す — 古い混在選択で拒否しない。設計 rule 3)。
+            // 限度ゲートの後 = O(1) 算術が O(cells) walk を守る既存拒否ランク
+            if (rangesContainReadOnly(p.adapter, ranges)) {
+                p.rejectReadOnly({ kind: "operation", op: "format", cellCount: countRangeCells(ranges) })
+                return false
+            }
             // memo: バケット (パッチの同一性) × base identity — パッチはジェスチャ内で定数なので
             // intern された base 1 つにつき mergeFormat は 1 回 (applyEdits 引数の format identity は 1 つ)
             const memo = new Map<number, Map<CellFormat | undefined, CellFormat | undefined>>()
@@ -478,7 +509,16 @@ export const useCommands = (params: UseCommandsParams): CommandRunner => {
         }
     }, [])
 
-    /** fillDown / fillRight / fillSelection (idle). / fillDown / fillRight / fillSelection (idle)。 */
+    /**
+     * fillDown / fillRight / fillSelection (idle) — two phases since v0.10 (§0.2 R2): phase 1
+     * collects the (source, targets) pairs with coordinate arithmetic only (no reads, no edits),
+     * the G8 read-only walk runs over the collected targets, and only a passing gesture
+     * materialises (readFillSource + fillSourceEdit) and commits.
+     * fillDown / fillRight / fillSelection (idle) — v0.10 から 2 相 (§0.2 R2): 第 1 相は座標算術
+     * だけで (source, targets) 対を収集 (読みも edits 生成もしない)、G8 の読み取り専用 walk を
+     * 収集済み targets に掛け、通過したジェスチャだけが実体化 (readFillSource + fillSourceEdit)
+     * して commit する。
+     */
     const runFill = useCallback(
         (direction: "down" | "right" | "selection"): boolean => {
             const p = paramsRef.current
@@ -486,7 +526,8 @@ export const useCommands = (params: UseCommandsParams): CommandRunner => {
             if (!gateSelectionWrite("fill", selection.ranges, p.maxOperationCells, p.onOperationRejected)) {
                 return false
             }
-            const edits: CellEdit[] = []
+            // 第 1 相: (source, targets) 対の収集のみ — 対の順序は従来の fillEdits 呼出し順と同一 (byte 恒等)
+            const pairs: { source: CellCoord; targets: CellCoord[] }[] = []
             if (direction === "selection") {
                 // active の内容を active 以外の全選択セルへ
                 const active = selection.active
@@ -496,7 +537,7 @@ export const useCommands = (params: UseCommandsParams): CommandRunner => {
                         targets.push(cell)
                     }
                 })
-                fillEdits(active, targets, edits)
+                pairs.push({ source: active, targets })
             } else {
                 for (const range of selection.ranges) {
                     if (direction === "down") {
@@ -511,7 +552,7 @@ export const useCommands = (params: UseCommandsParams): CommandRunner => {
                             for (let row = single ? range.startRow : range.startRow + 1; row <= range.endRow; row += 1) {
                                 targets.push({ row, col })
                             }
-                            fillEdits({ row: sourceRow, col }, targets, edits)
+                            pairs.push({ source: { row: sourceRow, col }, targets })
                         }
                     } else {
                         const single = range.startCol === range.endCol
@@ -525,11 +566,31 @@ export const useCommands = (params: UseCommandsParams): CommandRunner => {
                             for (let col = single ? range.startCol : range.startCol + 1; col <= range.endCol; col += 1) {
                                 targets.push({ row, col })
                             }
-                            fillEdits({ row, col: sourceCol }, targets, edits)
+                            pairs.push({ source: { row, col: sourceCol }, targets })
+                        }
+                    }
+                }
+            }
+            // G8 (v0.10 §6.9): 収集済み対の全 targets を 1 サイトで walk (最初の hit で短絡)。読み取り
+            // 専用**ソース**は walk 外 = 合法のまま (Excel 同等 — RC-G8)。拒否 cellCount = Σ targets.length
+            // (overlap-naive — ONE 語彙)。実体化 (ソース読み) より前に立つ
+            for (const pair of pairs) {
+                for (const target of pair.targets) {
+                    if (isReadOnlyCell(p.adapter, target.row, target.col)) {
+                        let cellCount = 0
+                        for (const counted of pairs) {
+                            cellCount += counted.targets.length
                         }
+                        p.rejectReadOnly({ kind: "operation", op: "fill", cellCount })
+                        return false
                     }
                 }
             }
+            // 第 2 相: 実体化 — ソース毎に 1 回読み、対象へ複製 (従来と同じ呼出し順)
+            const edits: CellEdit[] = []
+            for (const pair of pairs) {
+                fillEdits(pair.source, pair.targets, edits)
+            }
             if (edits.length === 0) {
                 return true
             }
@@ -538,6 +599,60 @@ export const useCommands = (params: UseCommandsParams): CommandRunner => {
         [fillEdits],
     )
 
+    /**
+     * Editing-column Ctrl+Enter (`fillSelection` with an open session): writes the session text
+     * to every selected cell as ONE applyEdits and closes the session. Order: limit gate → the
+     * G9 read-only wall (v0.10 — whole refusal, session kept, `validateCommit` unreached) → the
+     * per-target validation walk (the first strict refusal aborts before the adapter) → commit →
+     * `cancelEdit` (no double write).
+     * 編集列 Ctrl+Enter (セッション中の fillSelection): セッション文字列を全選択セルへ 1 applyEdits
+     * で書き、セッションを閉じる。順序: 限度ゲート → G9 読み取り専用壁 (v0.10 — 全体拒否・
+     * セッション保持・validateCommit 不到達) → 対象セル毎の検証 walk (最初の strict 拒否で adapter
+     * 前に中断) → commit → cancelEdit (二重書込なし)。
+     */
+    const runFillSelectionEditing = useCallback((): boolean => {
+        const p = paramsRef.current
+        // 編集列: セッション文字列を全選択セルへ 1 applyEdits、セッション閉鎖
+        const text = p.getSessionText()
+        if (text === null) {
+            return false
+        }
+        const selection = p.getSelection()
+        if (!gateSelectionWrite("fill", selection.ranges, p.maxOperationCells, p.onOperationRejected)) {
+            return false
+        }
+        // G9 (v0.10 §6.9): 読み取り専用壁 — validateCommit walk より前・セッション保持で
+        // 全体拒否 (書込集合 = 選択そのもの、意図した粗さ — 設計 rule 3)
+        if (rangesContainReadOnly(p.adapter, selection.ranges)) {
+            p.rejectReadOnly({ kind: "operation", op: "fill", cellCount: countRangeCells(selection.ranges) })
+            return false
+        }
+        // 検証ゲート (分冊 08 §4.2) は対象セル毎 — 規則はセル毎に違い得る。最初の strict 拒否で
+        // 走査を打ち切り applyEdits へ届けない (通知と message ポップオーバーは root の validateCommit が担う)
+        const edits: CellEdit[] = []
+        let rejected = false
+        enumerateRangeCells(selection.ranges, (cell) => {
+            if (rejected) {
+                return
+            }
+            if (!p.validateCommit(cell, text).ok) {
+                rejected = true
+                return
+            }
+            edits.push({ row: cell.row, col: cell.col, text })
+        })
+        // 拒否はセッション維持のまま false (Enter の keep 経路と同じ — Escape で取消 / 修正して再試行)
+        if (rejected) {
+            return false
+        }
+        if (p.commitEdits(edits, { source: "fill" }) === null) {
+            return false
+        }
+        // 値は全セルへ書かれた — セッションは破棄で閉じる (二重書込なし)
+        p.cancelEdit()
+        return true
+    }, [])
+
     /** Self-calc over the selection (source "calc"). / 選択の自己計算 (source "calc")。 */
     const runCalc = useCallback((transform: { text: (text: string) => string | null; formula: (formula: string) => string }): boolean => {
         const p = paramsRef.current
@@ -545,6 +660,11 @@ export const useCommands = (params: UseCommandsParams): CommandRunner => {
         if (!gateSelectionWrite("calc", selection.ranges, p.maxOperationCells, p.onOperationRejected)) {
             return false
         }
+        // G11 (v0.10 §6.9): 読み取り専用壁 — 限度ゲート後・列挙 (アダプタ読み) 前の全体拒否
+        if (rangesContainReadOnly(p.adapter, selection.ranges)) {
+            p.rejectReadOnly({ kind: "operation", op: "calc", cellCount: countRangeCells(selection.ranges) })
+            return false
+        }
         const edits: CellEdit[] = []
         const adapter = p.adapter
         enumerateRangeCells(selection.ranges, (cell) => {
@@ -660,6 +780,68 @@ export const useCommands = (params: UseCommandsParams): CommandRunner => {
         [activeHyperlink],
     )
 
+    /**
+     * G15 (v0.10 — design ADR-30): the SINGLE read-only pre-check for the popover-opening
+     * dispatches — the four popover-open command ids (`spec.kind === "popover"`) plus the
+     * `openHyperlink` host-undeclared fallback, whose execute arm opens the SAME link popover
+     * (Ctrl+K equivalent) and therefore walks the link arm of this gate. Returns false when the
+     * chord was consumed AND refused (the dispatcher aborts BEFORE its session `requestCommit` —
+     * doomed-open), true when dispatch may proceed: non-popover-opening commands (including
+     * `openHyperlink` with a declared host — a pure read), editable cells, and the
+     * content-PRESENT annotate chords (the normal open path then serves the viewer — S3 carries
+     * `cellReadOnly`, G14a is the wall; opening is a success, no callback). Content presence
+     * reads ONLY the command's own capability member (availability already guarantees the
+     * declaration); an empty note string / empty comment thread counts as ABSENT (design §8).
+     * `openValidationList` is always refused (the list surface has no view value).
+     * G15 (v0.10 — 設計 ADR-30): popover を開くディスパッチの**単一** pre-check — popover 系
+     * 4 コマンド id (`spec.kind === "popover"`) に加え、execute 腕が**同じ** link ポップオーバーを
+     * 開く `openHyperlink` の host 未宣言 fallback (Ctrl+K 同等) も link 腕を通る。false =
+     * チョード消費 + 拒否 (dispatcher はセッション requestCommit の**前**に中断 — doomed-open)、
+     * true = 続行 (popover を開かないコマンド / host 宣言時の `openHyperlink` (純粋な読み) /
+     * 編集可能セル / 内容**有**の注釈チョード — 通常 open 経路がビューアを開く。S3 が
+     * cellReadOnly を運び G14a が壁。開通は成功で callback なし)。内容有無は当該コマンドの能力
+     * メンバーだけを読む (availability が宣言を保証済み)。空文字ノート / 空スレッドは「無」扱い
+     * (設計 §8)。openValidationList は常に拒否 (list 面に閲覧価値は無い)。
+     */
+    const gateReadOnlyChord = useCallback(
+        (spec: CommandSpec): boolean => {
+            const p = paramsRef.current
+            // 壁の対象 = execute 腕が開く popover 種。openHyperlink の host 未宣言 fallback は
+            // Ctrl+K 同等の link open (宣言時は読み = 対象外。リンク無しの行不在は availability が先に落とす)
+            const popover: PopoverKind | undefined = spec.kind === "popover" ? spec.popover : spec.kind === "openHyperlink" && p.onHyperlinkOpen === undefined ? "link" : undefined
+            if (popover === undefined) {
+                return true
+            }
+            const active = p.getActive()
+            if (!isReadOnlyCell(p.adapter, active.row, active.col)) {
+                return true
+            }
+            if (popover === "list") {
+                // list 面に閲覧価値は無い (対話 = 書込そのもの) — 常に消費拒否
+                p.rejectReadOnly({ kind: "edit", cell: active, editSession: "none" })
+                return false
+            }
+            // 注釈 3 種は内容の有無で分岐 (このパッケージに独立ビューアは無い — WCAG 2.1.1)
+            let present: boolean
+            if (popover === "link") {
+                present = activeHyperlink() !== undefined
+            } else if (popover === "note") {
+                const note = p.adapter.getCellNote === undefined ? undefined : p.adapter.getCellNote(active.row, active.col)
+                present = note !== undefined && note !== ""
+            } else {
+                const thread = p.adapter.getCellComments === undefined ? undefined : p.adapter.getCellComments(active.row, active.col)
+                present = thread !== undefined && thread.length > 0
+            }
+            if (!present) {
+                // 内容無 = 純粋な追加意図 (doomed empty editor) — 消費拒否、requestCommit 不実行
+                p.rejectReadOnly({ kind: "operation", op: "annotate", cellCount: 1 })
+                return false
+            }
+            return true
+        },
+        [activeHyperlink],
+    )
+
     const executeCommand = useCallback(
         (command: SpreadsheetCommand): boolean => {
             const p = paramsRef.current
@@ -667,6 +849,14 @@ export const useCommands = (params: UseCommandsParams): CommandRunner => {
                 return false
             }
             const spec = COMMAND_SPECS[command]
+            // G15 (v0.10 §6.9 / 設計 ADR-30): popover を開くディスパッチ (popover 系 4 コマンド id +
+            // openHyperlink の host 未宣言 fallback) の**単一** pre-check — 座席は availability bail と
+            // dispatch 水準 requestCommit の**間** (doomed-open 原則: 拒否腕は無関係セッションを
+            // force-commit しない)。チョードは keymap が execute 前に消費済み。
+            // imperative 経路 (handle.executeCommand / commandDispatch.execute) も同関数で自動継承
+            if (!gateReadOnlyChord(spec)) {
+                return false
+            }
             const editing = p.isEditing()
             // 編集列に無いコマンドは先にセッションを確定する (拒否なら中断)
             if (editing && !EDITING_COLUMN_COMMANDS.has(command) && !p.requestCommit()) {
@@ -733,39 +923,7 @@ export const useCommands = (params: UseCommandsParams): CommandRunner => {
                     return runCalc({ text: reverseSignText, formula: reverseSignFormula })
                 case "fill": {
                     if (editing && spec.direction === "selection") {
-                        // 編集列: セッション文字列を全選択セルへ 1 applyEdits、セッション閉鎖
-                        const text = p.getSessionText()
-                        if (text === null) {
-                            return false
-                        }
-                        const selection = p.getSelection()
-                        if (!gateSelectionWrite("fill", selection.ranges, p.maxOperationCells, p.onOperationRejected)) {
-                            return false
-                        }
-                        // 検証ゲート (分冊 08 §4.2) は対象セル毎 — 規則はセル毎に違い得る。最初の strict 拒否で
-                        // 走査を打ち切り applyEdits へ届けない (通知と message ポップオーバーは root の validateCommit が担う)
-                        const edits: CellEdit[] = []
-                        let rejected = false
-                        enumerateRangeCells(selection.ranges, (cell) => {
-                            if (rejected) {
-                                return
-                            }
-                            if (!p.validateCommit(cell, text).ok) {
-                                rejected = true
-                                return
-                            }
-                            edits.push({ row: cell.row, col: cell.col, text })
-                        })
-                        // 拒否はセッション維持のまま false (Enter の keep 経路と同じ — Escape で取消 / 修正して再試行)
-                        if (rejected) {
-                            return false
-                        }
-                        if (p.commitEdits(edits, { source: "fill" }) === null) {
-                            return false
-                        }
-                        // 値は全セルへ書かれた — セッションは破棄で閉じる (二重書込なし)
-                        p.cancelEdit()
-                        return true
+                        return runFillSelectionEditing()
                     }
                     return runFill(spec.direction)
                 }
@@ -782,7 +940,8 @@ export const useCommands = (params: UseCommandsParams): CommandRunner => {
                         p.onHyperlinkOpen(url, p.getActive())
                         return true
                     }
-                    // 未宣言: link ポップオーバー (Open ボタンなし)
+                    // 未宣言: link ポップオーバー (Open ボタンなし)。読み取り専用 × リンク無しの
+                    // doomed empty editor は G15 の link 腕が拒否済み (ここに届くのは開通できる open のみ)
                     p.openPopover("link")
                     return true
                 }
@@ -806,6 +965,11 @@ export const useCommands = (params: UseCommandsParams): CommandRunner => {
                     }
                     // idle: active セルだけへ 1 applyEdits (選択全体には書かない)、直接確定 (セッションは無い = discarded)
                     const active = p.getActive()
+                    // G12 (v0.10 §6.9): 読み取り専用壁 — セッションレス "edit" 書込も validateCommit より前で拒否
+                    if (isReadOnlyCell(p.adapter, active.row, active.col)) {
+                        p.rejectReadOnly({ kind: "edit", cell: active, editSession: "none" })
+                        return false
+                    }
                     // Excel の Ctrl+; は編集モード経由で Enter 確定が検証される (strict ⇒ 拒否) — 分冊 08 §4.2 の
                     // fill / 貼り付け非検証免除はここへ及ばないため、strict 拒否は書込前に判定する
                     // (通知と message ポップオーバーは root の validateCommit が担う)
@@ -838,7 +1002,7 @@ export const useCommands = (params: UseCommandsParams): CommandRunner => {
                 }
             }
         },
-        [isCommandAvailable, activeHyperlink, activeBase, writeConstantPatch, announceFormat, setBorders, runCalc, runFill, runHide],
+        [isCommandAvailable, gateReadOnlyChord, activeHyperlink, activeBase, writeConstantPatch, announceFormat, setBorders, runCalc, runFill, runFillSelectionEditing, runHide],
     )
 
     /** Commit gate shared by the annotation setters. / 注釈 setter 共通の commit ゲート。 */
@@ -861,6 +1025,11 @@ export const useCommands = (params: UseCommandsParams): CommandRunner => {
                 return false
             }
             const active = p.getActive()
+            // G13 (v0.10 §6.9): 読み取り専用壁 — commit-gate-first は登記済み品行 (§3 preamble)、壁は commit 前
+            if (isReadOnlyCell(p.adapter, active.row, active.col)) {
+                p.rejectReadOnly({ kind: "operation", op: "annotate", cellCount: 1 })
+                return false
+            }
             return p.commitEdits([{ row: active.row, col: active.col, hyperlink: normalized }], { source: "annotate" }) !== null
         },
         [commitGate],
@@ -876,6 +1045,11 @@ export const useCommands = (params: UseCommandsParams): CommandRunner => {
                 return false
             }
             const active = p.getActive()
+            // G13 (v0.10 §6.9): 読み取り専用壁 — commit 前の単一ターゲット walk
+            if (isReadOnlyCell(p.adapter, active.row, active.col)) {
+                p.rejectReadOnly({ kind: "operation", op: "annotate", cellCount: 1 })
+                return false
+            }
             return p.commitEdits([{ row: active.row, col: active.col, note: text }], { source: "annotate" }) !== null
         },
         [commitGate],
@@ -892,6 +1066,11 @@ export const useCommands = (params: UseCommandsParams): CommandRunner => {
                 return false
             }
             const active = p.getActive()
+            // G13 (v0.10 §6.9): 読み取り専用壁 — 既存スレッド読み (実体化) より前で拒否
+            if (isReadOnlyCell(p.adapter, active.row, active.col)) {
+                p.rejectReadOnly({ kind: "operation", op: "annotate", cellCount: 1 })
+                return false
+            }
             // 既存スレッド (id つき) を verbatim に保ち input を末尾へ — 1 スレッドとして書く
             const existing = read(active.row, active.col)
             const thread: CellCommentInput[] = existing === undefined ? [input] : [...existing, input]
@@ -913,6 +1092,11 @@ export const useCommands = (params: UseCommandsParams): CommandRunner => {
             if (!gateSelectionWrite("annotate", ranges, p.maxOperationCells, p.onOperationRejected)) {
                 return false
             }
+            // G13 (v0.10 §6.9): 読み取り専用壁 — setValidation だけ選択レンジ walk (限度ゲート後・列挙前)
+            if (rangesContainReadOnly(p.adapter, ranges)) {
+                p.rejectReadOnly({ kind: "operation", op: "annotate", cellCount: countRangeCells(ranges) })
+                return false
+            }
             const edits: CellEdit[] = []
             enumerateRangeCells(ranges, (cell) => {
                 edits.push({ row: cell.row, col: cell.col, validation: rule })