Table deletion, Change Case and field unlink bypass revision and content-control checks #1329

Scope and verification

Read-only source audit of upstream main at 159b84f. Audit reference: M2.
Severity: Medium (integrity). Confidence: high in the cited source flow. No runtime reproduction, exploit input, destructive testing, or source changes; resource-exhaustion consequences have not been measured.

Root cause and evidence

crates/engine/src/cmd/table.rs:496–546 physically removes table structures without tracked deletion or control-lock validation. crates/engine/src/cmd/format.rs:414–424 directly changes text; crates/engine/src/cmd/fields.rs:204–228 directly replaces field markers/results. Formatting revision recording is not a general text/structural revision recorder.

Conditions and realistic impact

With tracking enabled or locked controls in the target, these operations can alter protected content or make edits Reject All cannot restore. Ordinary Undo being available does not satisfy tracked-change or control-lock contracts.

Recommended remediation

Use centralized revision/control-aware replacement and deletion. Refuse unsupported structural edits while tracking until they have a structural revision representation.

Suggested regression tests

All table deletion variants against lockDelete controls; Change Case and Unlink inside lockEdit content; all operations on pre-existing tracked content followed by Reject All. Require refusal or faithful restoration.