fix(frameworks): repair sync drift for controls and tasks

[tofikwest]

Summary

• ensure framework sync creates missing org control rows from the target manifest before reconciling requirement maps
• ensure framework sync creates missing org task rows from the target manifest before reconciling control-task links
• add regression coverage for older-account drift where v1/v2 manifests claim rows that the customer DB is missing

Tests

• cd apps/api && bunx jest src/frameworks/framework-versioning/framework-sync-apply.spec.ts --passWithNoTests
• cd apps/api && bunx jest src/frameworks/framework-versioning --passWithNoTests

Fixes CS-334

[linear]

CS-334 Framework version fails to pull in newly linked controls when upgrading in the app

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
comp-framework-editor	Ready	Preview, Comment	Apr 30, 2026 9:08pm

2 Skipped Deployments

Project	Deployment	Actions	Updated (UTC)
app	Skipped		Apr 30, 2026 9:08pm
portal	Skipped		Apr 30, 2026 9:08pm

[cubic-dev-ai]

cubic analysis

No issues found across 2 files

_{Requires human review: This change modifies core synchronization logic by altering how controls and tasks are reconciled during framework updates, which requires human verification of data integrity risks.}

Linked issue analysis

Linked issue: CS-334: Framework version fails to pull in newly linked controls when upgrading in the app

Status	Acceptance criteria	Notes
✅	When upgrading a framework in an existing org, newly linked controls for requirements must be pulled into the org	Creates control rows from target manifest before reconciling maps
✅	When upgrading, newly linked tasks for those controls must be pulled into the org	Creates task rows from target manifest before reconciling links
✅	Fix should be general across frameworks (e.g., SOC2 and ISO27001), not framework-specific	Logic operates on generic manifest arrays, not framework-specific code
⚠️	Upgraded org behavior should match creating a new org with the same latest framework (result parity)	Tests create missing rows but don't assert full parity with new-org result
✅	Ensure framework sync creates missing org control rows from the target manifest before reconciling requirement maps	Replaced diff.added loop with target-manifest creation prior to reconciling
✅	Ensure framework sync creates missing org task rows from the target manifest before reconciling control-task links	Replaced diff.tasks.added loop with target-manifest task creation prior to linking
✅	Add regression coverage for older-account drift where v1/v2 manifests claim rows that the customer DB is missing	Added unit tests that simulate missing control/task rows and assert creation

[claudfuen]

🎉 This PR is included in version 3.40.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀