PPF-2057: Enforce choice-index bounds in schema and runtime validation #2057

Version

Reviewed baseline: PyPDFForm 6.0.0, commit 0b5cc1dc8604b36693864852d76ed7e60f903451.

Issue Description

At the reviewed snapshot, the schema accepted dropdown and radio index -999. Dropdown filling then raised IndexError, while radio filling could succeed without selecting a matching option. Schema and runtime bounds must agree before any state changes.

Work

Align dropdown and radio schemas with the valid index range and enforce the same bounds before updating PDF or middleware state. Handle empty option lists explicitly rather than generating a range that accepts unusable selections.

Acceptance Criteria

• Negative indices, indices equal to the option count, and larger values are rejected by both validation paths; first and last valid indices work. A failed selection leaves existing values and appearance states unchanged.

Basis and Dependencies

R10. Coordinates with E3-03 and E4-01; a small shared bounds check can precede the wider validation refactor.

Source and Validation

Action E1-04, Group 1 — Lowest-hanging fruit, from the October 10, 2026 action plan; supporting review evidence. Related action identifiers refer to that plan.

The behavior above is evidence from the source review, not a new reproduction performed when filing this issue. Reconfirm the relevant baseline or document intervening changes before implementation. Follow the plan's completion and validation rules and the Developer Guide, including meaningful regression assertions for behavior changes.