fix: annotate FormattingAssembler.cs for nullable reference types

[JSv4]

Summary

Closes #649. Removes the last #nullable disable header remaining anywhere under Docxodus/ — FormattingAssembler.cs, 4,232 lines, 434 baseline warnings — fixing all of them down to 0. This is the fifth and final sub-issue of the #645 campaign (#646-#650) that annotated all 21 legacy OpenXmlPowerTools files inherited when this project forked it.

What changed

The recurring pattern in this file is a family of style-merge helpers (MergeStyleElement, LangMerge, IndMerge, TabsMerge, SpacingMerge, FontMerge, ResolveInsideBorder, ToggleMergeRunProps) whose contract is "return null only if both inputs are null." Rather than hand-annotating each of the dozens of call sites, these are marked with [return: NotNullIfNotNull(nameof(param))] for each parameter — the compiler then infers a non-null result at any call site where one side is statically known non-null. This eliminated most of the file's warnings without touching a single call site.

CharStyleStack widens to Stack<XElement?>/IEnumerable<XElement?>. It intentionally pushes null for a style level that has a basedOn chain but no own w:rPr, and its sole consumer already treats a null entry as "no contribution at this level" via Aggregate. This was a real design, not a bug wearing a non-nullable type — the type now says so honestly.

Two behavior fixes fell out of the pass, not sought deliberately:

• AdjustFontAttributes now null-checks rPr before reading w:rFonts. One of its three call sites passes a paragraph's rolled-up run properties, which can genuinely lack an rPr element — that path used to throw a NullReferenceException.
• The list-item marker synthesis in NormalizeListItemsTransform builds a pt:AbstractNumId attribute from a genuinely-nullable int? (ListItemInfo.AbstractNumId, distinct from a same-named non-nullable field on an unrelated nested class). new XAttribute(name, value) throws on a null value, unlike XElement content constructors, which tolerate it — this path is now a graceful omission instead of a crash.

Public surface: ParagraphStyleRollup's defaultParagraphStyleName parameter is now string?. This documents an existing contract rather than changing one — ListItemRetriever.cs was already passing a string? into it (GetDefaultParagraphStyleName returns string?), so the parameter was already silently tolerant of null; the type now says so. MetricsGetter.GetFontFromFontType (private) widens its return to string? to match CharStyleAttributes' now-nullable font fields; its sole caller only counts results via .Count(), never dereferences them.

Two small non-annotation cleanups, made in passing while already touching these exact lines: an unused sXDoc local in CharStyleRollup, and a dead third null-check in FontMerge left over after two simpler exhaustive checks — it was also interfering with the compiler's null-narrowing on the code below it.

A regression caught during self-review

AssembleFormatting's second content-part loop cached pxd.Root into a local before calling NormalizePropsForPart(pxd, settings) — but that method itself can replace pxd.Root outright (via ReplaceWith, when settings.OrderElementsPerStandard is set), leaving the caller's cached reference stale/detached. Calling .ReplaceWith() on it afterward threw InvalidOperationException: The parent is missing.

This slipped past the build (0 warnings, 0 errors both times) because nothing about nullable-reference analysis checks aliasing across a method call. The full test suite caught it: 33 failures, all at the same line. Fixed by re-fetching pxd.Root fresh after the call rather than reusing the pre-call reference, with a comment explaining why. Re-ran the full suite after the fix to confirm.

Validation

• dotnet build Docxodus/Docxodus.csproj --no-incremental: 0 errors, 113 warnings (down from 114 — see the CLAUDE.md update; one file's #nullable disable header removal drops one SA1636 StyleCop warning as a side effect unrelated to nullability).
• dotnet build Docxodus.sln --no-incremental (Debug and -c Release): 0 errors.
• dotnet test Docxodus.Tests/Docxodus.Tests.csproj: 3923 passed, 3 skipped, 0 failed.
• ./scripts/build-wasm.sh: succeeds, wire size 4875 KB (budget 5120 KB).
• The six out-of-solution tool/benchmark projects: all build clean; benchmarks/complex-form-doc fails the same pre-existing, unrelated way as before (issue benchmarks/complex-form-doc fails to build (CS0161: not all code paths return a value) #662).
• npm run build, npm run typecheck: clean.
• npm test (Playwright, full suite): 665 passed, 11 skipped, 6 failed — 5 are the known host-only tabs-visual.spec.ts screenshot tests (missing Times New Roman locally; green in CI), and the 6th (demo-arcade-mobile.spec.ts, an unrelated mobile-viewport arcade test) passed cleanly on its own re-run in isolation, confirming it's a resource-contention flake under full-suite load rather than a regression.

Docs

CLAUDE.md's nullable-reference-types section now reflects that no file under Docxodus/ carries #nullable disable anymore, and the library/test warning baselines move from 114/690 to 113/689. CHANGELOG.md gets entries for the two behavior fixes above.

🤖 Generated with Claude Code

https://claude.ai/code/session_01VSnwkK1Nx6zZb2RnnoxKdx