[Alerting v2] Fix YAML blur handler + splitQuery round-trip tests (#269779)

## Summary

Scoped down from the original PR after #269584 merged. The split-mode
sync and YAML toggle-off dispatch fixes are now redundant — this PR
retains only the changes that #269584 did not address.

### Changes

1. **`YamlRuleForm` blur handler fix:** In the compose-discover flyout
the RHF form uses `ComposeFormValues` (with `query: RuleQuery`), but
`YamlRuleForm`'s blur handler called `reset(FormValues)` directly —
overwriting the form with the wrong shape (`evaluation.query.base`
instead of `RuleQuery`). After #269584 this no longer clears the sandbox
visually (the sandbox now reads from the draft, not RHF), but it
silently corrupts the form state, which could cause malformed API
payloads at submit time. Adds an `onBlurSync` prop so the flyout can
route through `formValuesFromYamlToCompose`, cancelling the pending
debounce and syncing the draft in one shot.

2. **`YamlParseResult` discriminated union:** Changes the type from two
independently-nullable fields to a proper discriminated union (`{
values: FormValues; error: null } | { values: null; error: string }`) so
TypeScript narrows automatically after error checks, eliminating
non-null assertions. (Addresses Jason's [review
feedback](#269779 (review)).)

3. **`splitQuery` round-trip idempotency tests:** Asserts that
`splitQuery(join(split(q))) === split(q)`, which is the invariant the
split-mode sync relies on.

Closes [#269777](#270168)

## How to test

1. Navigate to **Alerting v2 → Rules list** → Create a rule via the
flyout
2. Open the Sandbox, write a query, click **Apply changes**
3. Toggle to **YAML view**
4. Edit the query in YAML (e.g. change a threshold value)
5. Click outside the YAML editor (blur)
6. Toggle back to **Form view** and click **Create rule**
7. **Verify:** The API request payload (`evaluation.query.base`)
contains the edited query value — the YAML edit persisted correctly
through the blur → RHF → submit pipeline

---------

Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
Co-authored-by: Jason Rhodes <jason.rhodes@elastic.co>

Author: 4 people

x-pack/platform/packages/shared/response-ops/alerting-v2-rule-form/flyout/compose_discover/compose_discover_flyout.tsx

@@ -419,6 +419,15 @@ export function ComposeDiscoverFlyout<TWorkflow extends object = object>({
     [runYamlParse]
   );
 
+  const handleBlurSync = useCallback(
+    (values: FormValues) => {
+      cancelYamlParse();
+      methods.reset(formValuesFromYamlToCompose(values));
+      syncSandbox();
+    },
+    [cancelYamlParse, methods, syncSandbox]
+  );
+
   const handleToggleYamlMode = useCallback(
     (enabled: boolean) => {
       if (enabled) {
@@ -480,7 +489,7 @@ export function ComposeDiscoverFlyout<TWorkflow extends object = object>({
     const result = parseYamlToFormValues(yamlText);
     if (result.values) {
       methods.reset(formValuesFromYamlToCompose(result.values));
-      // No syncForm() here: draft is temporarily stale after methods.reset(), but
+      // No syncSandbox() here: sandbox is temporarily stale after methods.reset(), but
       // we're about to submit. On success the flyout closes; on failure the user is still
       // in YAML mode and handleToggleYamlMode(false) will resync draft when they switch back.
     }
@@ -576,6 +585,7 @@ export function ComposeDiscoverFlyout<TWorkflow extends object = object>({
                   services={baseServices}
                   yamlText={yamlText}
                   setYamlText={handleSetYamlText}
+                  onBlurSync={handleBlurSync}
                   isSubmitting={isSaving}
                 />
               </React.Suspense>

x-pack/platform/packages/shared/response-ops/alerting-v2-rule-form/flyout/compose_discover/use_heuristic_split.test.ts

@@ -148,6 +148,34 @@ describe('splitQuery', () => {
     });
   });
 
+  describe('round-trip idempotency (join + re-split)', () => {
+    it('round-trips a STATS + WHERE query through join and re-split', () => {
+      const { base, alertBlock } = splitQuery('FROM logs-* | STATS c = COUNT(*) | WHERE c > 5');
+      const reassembled = [base, alertBlock].filter(Boolean).join('\n');
+      const resplit = splitQuery(reassembled);
+      expect(resplit.base).toBe(base);
+      expect(resplit.alertBlock).toBe(alertBlock);
+    });
+
+    it('round-trips a multi-pipe query', () => {
+      const { base, alertBlock } = splitQuery(
+        'FROM logs-* | EVAL x = 1 | STATS c = COUNT(*) BY host | WHERE c > 10 | SORT c DESC'
+      );
+      const reassembled = [base, alertBlock].filter(Boolean).join('\n');
+      const resplit = splitQuery(reassembled);
+      expect(resplit.base).toBe(base);
+      expect(resplit.alertBlock).toBe(alertBlock);
+    });
+
+    it('round-trips a WHERE-only (no STATS) query', () => {
+      const { base, alertBlock } = splitQuery('FROM logs-* | EVAL x = 1 | WHERE x > 0');
+      const reassembled = [base, alertBlock].filter(Boolean).join('\n');
+      const resplit = splitQuery(reassembled);
+      expect(resplit.base).toBe(base);
+      expect(resplit.alertBlock).toBe(alertBlock);
+    });
+  });
+
   describe('reason field', () => {
     it('reason is no_stats when neither STATS nor WHERE found', () => {
       expect(splitQuery('FROM logs-*').reason).toBe('no_stats');

x-pack/platform/packages/shared/response-ops/alerting-v2-rule-form/form/utils/yaml_form_utils.ts

@@ -13,10 +13,7 @@ import {
   deriveRecoveryDelayModeFromStateTransition,
 } from './rule_request_mappers';
 
-export interface YamlParseResult {
-  values: FormValues | null;
-  error: string | null;
-}
+export type YamlParseResult = { values: FormValues; error: null } | { values: null; error: string };
 
 const parseArtifacts = (artifacts: unknown): FormValues['artifacts'] => {
   if (!Array.isArray(artifacts)) return undefined;

x-pack/platform/packages/shared/response-ops/alerting-v2-rule-form/form/yaml_rule_form.tsx

@@ -36,6 +36,13 @@ export interface YamlRuleFormProps {
   yamlText: string;
   /** Setter for the lifted YAML buffer. */
   setYamlText: (yaml: string) => void;
+  /**
+   * Synchronous commit for blur events. In the compose-discover flyout the RHF
+   * form uses `ComposeFormValues`, so a raw `reset(FormValues)` would corrupt it.
+   * The flyout passes a callback that routes through `formValuesFromYamlToCompose`.
+   * When absent (standalone context), blur falls back to `useFormContext().reset()`.
+   */
+  onBlurSync?: (values: FormValues) => void;
 }
 
 /**
@@ -60,6 +67,7 @@ export const YamlRuleForm = ({
   isSubmitting = false,
   yamlText,
   setYamlText,
+  onBlurSync,
 }: YamlRuleFormProps) => {
   const [error, setError] = useState<string | null>(null);
   const { reset } = useFormContext<FormValues>();
@@ -70,40 +78,33 @@ export const YamlRuleForm = ({
     search: services.data.search.search,
   });
 
-  const applyYamlValuesToForm = useCallback(
-    (values: FormValues) => {
-      reset(values);
-    },
-    [reset]
-  );
-
   const handleSubmit = useCallback(
     (e: React.FormEvent) => {
       e.preventDefault();
       const result = parseYamlToFormValues(yamlText);
-      if (result.error) {
+      if (result.error !== null) {
         setError(result.error);
         return;
       }
-      if (result.values) {
-        setError(null);
-        onSubmit?.(result.values);
-      }
+      setError(null);
+      onSubmit?.(result.values);
     },
     [yamlText, onSubmit]
   );
 
   const handleBlur = useCallback(() => {
     const result = parseYamlToFormValues(yamlText);
-    if (result.error) {
+    if (result.error !== null) {
       setError(result.error);
       return;
     }
-    if (result.values) {
-      setError(null);
-      applyYamlValuesToForm(result.values);
+    setError(null);
+    if (onBlurSync) {
+      onBlurSync(result.values);
+    } else {
+      reset(result.values);
     }
-  }, [yamlText, applyYamlValuesToForm]);
+  }, [yamlText, onBlurSync, reset]);
 
   const handleYamlChange = useCallback(
     (newYaml: string) => {