@hadden-industries/markdown-quality 1.0.2 → 1.0.3

package/assets/.editorconfig

@@ -0,0 +1,4 @@
+root = true
+
+[document.md]
+max_line_length = off

package/docs/consumer-guide.md

@@ -4,14 +4,15 @@ Install an exact coordinated public release after registry availability is verif
 Acquisition needs no npm account or token; disable lifecycle scripts.
 
 ```sh
-npm install --save-dev --save-exact --ignore-scripts @hadden-industries/markdown-quality@1.0.0
+npm install --save-dev --save-exact --ignore-scripts @hadden-industries/markdown-quality@1.0.3
 npm ci --ignore-scripts
 ```
 
-The source candidate is `1.0.0`; confirm its registry availability and exact tuple qualification before using the command above.
-Publication under `pilot` and promotion to `latest` are separate steps.
+The source candidate is `1.0.3`; confirm its registry availability and exact tuple qualification before using the command above.
+General pilot availability and stable `latest` designation are separate decisions.
+The owner explicitly authorized 1.0.3 to be published as `latest`, subject to its complete archive, registry/provenance and immutable-release verification.
 The previously qualified alpha.4 tuple remains immutable historical evidence.
-Both consumer pilots must accept the exact stable tuple before promotion.
+That release decision does not accept or change either consumer's separately paused migration; both still require their exact scope and trusted-run acceptance before cutover.
 Keep the consumer lockfile.
 An isolated `tooling/markdown` npm project supports consumers that do not use Node for their application.
 Its commands must pass the actual repository root.
@@ -77,11 +78,30 @@ Lint messages describe the violated rule without quoting document content.
 These are conservative operational limits; benchmark and platform acceptance remains part of candidate qualification.
 
 Formatting compares maintained parsed structure and literals before replacement and verifies convergence.
+The owner-approved stricter whitespace policy updates `authored-gfm@1` directly; no second preset is provided.
+This change is currently unreleased; existing published npm archives retain their original behavior.
+Trailing spaces and tabs are errors everywhere except inside fenced and indented code blocks.
+This includes blank lines, headings, lists, tables, and opening or closing fence lines.
+Space-based hard breaks are forbidden; formatting replaces actual parsed hard breaks with an explicit backslash followed by a newline, preserving the break.
+The whitespace policy cannot be disabled through lint overrides or editor settings.
 Fenced and indented code retain literal whitespace, including whitespace-only lines and trailing spaces; embedded code formatting remains disabled.
 Inline code compares [CommonMark code-span semantics](https://spec.commonmark.org/0.31.2/#code-spans): each line ending means one space, while interior spaces, tabs and other literal characters remain significant.
 Delimiter padding is already handled by the maintained parser; the comparison does not collapse or trim additional whitespace.
 The parsed comparison is an additional backstop, not a universal rendered-equivalence guarantee.
 It conservatively refuses unsupported semantic or literal changes.
+Inline code and raw HTML have no blanket trailing-whitespace exemption.
+When trimming would change their interpreted content, or otherwise change parsed meaning, the operation reports the whitespace findings for manual correction and leaves the whole batch untouched.
+Both checking and formatting validate the selected documents; checking never changes checkout files, and formatting writes only after every candidate passes validation.
+Native checks may group exact document snapshots and complete list-item continuations in a private temporary directory outside the checkout.
+Groups have at most 32 independent files and 4 MiB of input, with the existing native deadline and output cap.
+The package supplies its own immutable native configuration and EditorConfig boundary; consumer settings do not control these checks.
+If private staging cannot be established, checking uses the original standard-input path.
+Payloads are removed after each native invocation, and the owned directory is removed after the analysis worker stops, before any formatting replacement.
+Changed staging identities or incomplete cleanup cause an operational failure and block formatting writes.
+Abrupt process or host termination can leave private temporary files for operating-system or owner cleanup; deletion does not promise secure erasure.
+No persistent syntax, formatting or filesystem-validity cache is created.
+Use explicit selection exclusions for signed, byte-sensitive, or verbatim upstream documents that must remain unchanged.
+Git whitespace checks can supplement this policy but do not replace full-document checking.
 Ordinary file permission bits are preserved; ownership changes, alternate streams, ACL inheritance, arbitrary metadata, and adversarial filesystem races are not promised as preserved.
 Use a clean baseline or retained preimages when original uncommitted bytes must be recoverable.
 

package/docs/support-and-release.md

@@ -20,13 +20,13 @@ Only a processing 404 is retried; mismatched integrity and other failures stop d
 Publication is never repeated by this availability check.
 The three bounded waits fit within the publisher's thirty-minute job limit.
 
-The current source prepares version 1.0.2 under the pilot tag; stable promotion remains gated.
-Stable promotion requires the same qualified tuple on both platforms, public registry readback and unauthenticated installation, both pilot acceptances, and a timed restoration exercise.
+Version 1.0.2 is published under the pilot tag and passed complete Windows/Linux registry qualification in run `37417063198`; stable promotion remains gated.
+General stable promotion requires the same qualified tuple on both platforms, public registry readback and unauthenticated installation, both pilot acceptances, and a timed restoration exercise; the explicit 1.0.3 exception below preserves qualification while separating the paused consumer migrations.
 The 1.0.1 corrective candidate restores checking and formatting of literal code lines containing trailing or whitespace-only spaces.
 The original 1.0.1 tuple is published under `pilot` and passed both-platform complete registry qualification in recovery run `37413673170`, without republishing any package.
 The 1.0.2 correction compares inline-code line endings as spaces under CommonMark, retaining meaningful interior whitespace and the strict fenced/indented-code guard.
 This repair changes shipped JavaScript and therefore requires a new coordinated patch version; the unchanged 1.0.0 tuple completed registry qualification separately in recovery run `37409484508`.
-Keep latest promotion blocked until the literal-preservation repair and exact candidate satisfy the same platform, registry and pilot gates.
+The earlier literal-preservation releases retained their exact platform, registry and pilot gates; their qualification does not establish delivery or consumer adoption of a later version.
 Changed/referrer mode and later fleet adoptions remain deferred.
 
 Prepare assets explicitly from their frozen manifest.
@@ -49,10 +49,10 @@ An upstream Cargo lock is a superset of features and development inputs and does
 The original upstream license and per-asset repack identity are retained.
 
 The owner selected public distribution after npm rejected the private publication with E402.
-All three packages declare public access and share the source candidate version 1.0.2.
-The tuple retains alpha.4's qualified native executable/source/notice bytes and avoids duplicate formatting of byte-identical documents while retaining independent prose checks and preservation/convergence checks.
+All three packages declare public access and share the source candidate version 1.0.3.
+The tuple retains alpha.4's qualified native executable/source/notice bytes and adds bounded request-local reuse, native checking batches and exact-input check-first formatting while retaining independent prose checks and preservation/convergence checks.
 The first alpha.3 hosted OWLAPI shadow checks passed correctness but exceeded the accepted 30-second budget on both platforms.
-Alpha.3 and alpha.4 remain immutable historical evidence; every new tuple requires fresh transported-archive, registry, and exact-version pilot qualification before promotion.
+Alpha.3 and alpha.4 remain immutable historical evidence; every new tuple requires fresh transported-archive and registry qualification, with exact-version pilot qualification governed by the applicable owner release decision.
 The public alpha.2 archives remain immutable historical delivery evidence and are unqualified for Linux execution.
 The packer normalizes the Linux npm member's executable mode with Python tarfile, verifies all member bytes are unchanged, and recomputes the final archive integrity.
 Qualify the exact transported release archives on both platforms, rather than each platform's independently generated package.
@@ -65,24 +65,28 @@ Recovery preserves the original candidate's source and archives separately from
 An admission job without OIDC binds a complete three-package origin map before effects; both platform jobs qualify previously attempted packages before the publisher may run.
 Only a prior planned effect with an explicitly skipped publication step is eligible for first publication; an attempted or unknown outcome must be verified in the registry and cannot become eligible through a 404.
 Each downstream job rehashes its downloaded archives against the admitted manifest.
-The publisher rechecks current main, all three local archive hashes and version absence immediately before each single eligible publication, verifies both native archives before core, and uses only pilot.
+The publisher rechecks current main, all three local archive hashes and version absence immediately before each single eligible publication and verifies both native archives before core.
+Its explicit `distribution-tag` dispatch choice accepts only `pilot` or `latest` and defaults to `pilot`; select `latest` only for an owner-authorized stable release.
+Publication step names retain their historical "under pilot" wording because their exact identifiers are required to reconcile earlier interrupted runs; the selected input controls the actual npm label.
 Only the publication job has OIDC issuance permission; no long-lived npm token is supplied.
 Both registry jobs use native npm signature/attestation verification and bind each installed package to its admitted source, workflow, exact publication run and attempt.
 Their explicit non-cancellation and successful-publication condition prevents a skipped recovery ancestor from suppressing final qualification after ordinary publication.
 Successful publication alone does not establish complete registry qualification; retain both actual terminal platform reports.
 Each platform installs and cryptographically verifies its supported native package and core; opposite-platform native archives receive anonymous raw-byte verification, with the combined platform records covering the complete tuple.
 Structural provenance fixtures do not establish cryptographic acceptance.
-The workflow does not promote latest; both pilots and recovery must accept the exact tuple first.
+The workflow does not move labels on existing packages or grant npm tag-management permission.
+The owner's explicit 1.0.3 stable/latest decision in [plan revision 8](https://github.com/Hadden-Industries/markdown-quality/blob/v1.0.3/docs/plans/implementation-plan.md#1-status-authority-and-purpose) supersedes the pilot-promotion hold for that release only; consumer adoption remains separate.
 GitHub artifacts expire after 30 days, so export the complete frozen source, manifest, archives and verification bundles to the retained evidence store before expiry, for the security policy's maintained-lifetime-plus-three-years floor.
 Public installation needs no registry token, subscription, or OIDC authority.
 Public npm provenance is eligible only through a qualified supported publisher; do not claim it for the local bootstrap.
 Retain attributable source/build/repack evidence and qualify attestations separately.
 
-Publish native packages first under a pilot tag and publish the core only when the tuple is coherent.
+Publish native packages first under the explicitly accepted availability label and publish the core only when the tuple is coherent.
 Read back hashes, public visibility, and fresh unauthenticated archive acquisition for every package.
 Qualify root and isolated consumers on both supported platforms from the registry, without credentials.
 Do not perform registry publication while rights, publisher authentication, independent assurance, or platform evidence remains missing.
-A partial publication stays unpromoted and receives a new corrective version if bytes change.
+A partial publication is not a completed coordinated release, even when individual package labels are visible; preserve its exact outcomes and use the unchanged-version recovery procedure below.
+Changed bytes require a new corrective version.
 
 For unchanged-version recovery, manually dispatch `publish.yml` with the original `candidate-run` and `manifest-sha256`, plus the terminal prior `recovery-run` and exact `recovery-attempt`.
 The original legacy publication can omit `recovery-origins-sha256` only when its source is the original artifact source and its retained manifest matches exactly.
@@ -99,7 +103,7 @@ For recovery, retain the exact consumer base revision, old manifest and lock, wo
 Restore only migration-owned changes.
 Verify byte identities and required checks, then record elapsed restoration time.
 Downgrading a package cannot restore formatted document bytes.
-One pilot rehearsal is required before stable promotion.
+The general pilot-promotion path requires one pilot rehearsal; the owner's exact 1.0.3 release decision leaves those consumer restoration exercises with their separately gated migrations.
 
 Security reports use GitHub's private vulnerability reporting route when enabled; otherwise contact the repository owner through the project's existing private channel.
 No unattended observation service is assumed.
@@ -120,7 +124,7 @@ These budgets do not impose OS runtime limits or raise existing package limits.
 Require zero unexpected errors or adjudicated false positives in the window and accepted fixture/probe corpus, retaining expected negative probes separately.
 Rehearse one task-owned pilot restoration within 60 minutes through byte/sentinel readback and incumbent local checks; hosted required-status recovery remains separate acceptance evidence.
 The alpha.4 pilot cutovers passed both hosted platform windows and scoped restoration; those records do not establish acceptance of a later exact tuple.
-Version 1.0.1 requires fresh per-consumer scope, hosted platform windows, restoration and exact trusted-run acceptance before promotion.
+Version 1.0.2 requires fresh per-consumer scope, hosted platform windows, restoration and exact trusted-run acceptance before promotion.
 
 Provide AGPL corresponding source and build materials alongside object-code delivery to actual recipients.
 Preserve third-party license texts and attribution.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hadden-industries/markdown-quality",
-  "version": "1.0.2",
+  "version": "1.0.3",
   "description": "Shared, bounded Markdown formatting, GFM linting, and local-link checking",
   "type": "module",
   "license": "AGPL-3.0-only",
@@ -46,7 +46,7 @@
     "prettier": "3.9.9"
   },
   "optionalDependencies": {
-    "@hadden-industries/markdown-quality-win32-x64": "1.0.2",
-    "@hadden-industries/markdown-quality-linux-x64": "1.0.2"
+    "@hadden-industries/markdown-quality-win32-x64": "1.0.3",
+    "@hadden-industries/markdown-quality-linux-x64": "1.0.3"
   }
 }

package/src/analysis.js

@@ -61,7 +61,7 @@ export async function lintDocument(linter, text, file) {
     severity: d.severity === 2 ? "error" : "warning",
   }));
 }
-export function checkLinks(context, text, file) {
+export function checkLinks(context, text, file, memo) {
   if (!context.config.links.localFiles) return [];
   const diagnostics = [];
   function walk(node) {
@@ -114,6 +114,6 @@ export function checkLinks(context, text, file) {
     }
     for (const child of node.children ?? []) walk(child);
   }
-  walk(parse(text));
+  walk(memo ? memo.parse(text) : parse(text));
   return diagnostics;
 }

package/src/document-analysis.js

@@ -25,11 +25,37 @@ export function createDocumentAnalyzer(context, tool) {
     );
     return (termination ??= worker.terminate());
   }
-  worker.on("message", (value) =>
+  function deadline(milliseconds) {
+    clearTimeout(pending.timer);
+    pending.timer = setTimeout(() => {
+      settle(
+        new OperationError(
+          "ANALYSIS_TIMEOUT",
+          "Document analysis exceeded 30 seconds.",
+        ),
+      );
+      void close();
+    }, milliseconds);
+  }
+  worker.on("message", (value) => {
+    if (value.progress) {
+      if (!pending) return;
+      if (
+        !Number.isFinite(value.remainingMs) ||
+        value.remainingMs <= 0 ||
+        value.remainingMs > 30_000
+      ) {
+        settle(
+          new OperationError("ANALYSIS_FAILURE", "Invalid analysis deadline."),
+        );
+        void close();
+      } else deadline(value.remainingMs);
+      return;
+    }
     value.error
       ? settle(new OperationError(value.error.code, value.error.message))
-      : settle(null, value),
-  );
+      : settle(null, value);
+  });
   worker.on("error", () => {
     closed = true;
     settle(
@@ -48,31 +74,43 @@ export function createDocumentAnalyzer(context, tool) {
       ),
     );
   });
+  function request(data, milliseconds = 30_000) {
+    if (closed || pending)
+      return Promise.reject(
+        new OperationError(
+          "ANALYSIS_FAILURE",
+          "Document analysis is unavailable.",
+        ),
+      );
+    return new Promise((resolve, reject) => {
+      pending = {
+        resolve,
+        reject,
+      };
+      deadline(milliseconds);
+      worker.postMessage(data);
+    });
+  }
   return {
-    analyze(data) {
-      if (closed || pending)
+    prepare(data, milliseconds = 30_000) {
+      if (
+        !Number.isFinite(milliseconds) ||
+        milliseconds <= 0 ||
+        milliseconds > 30_000
+      )
         return Promise.reject(
           new OperationError(
-            "ANALYSIS_FAILURE",
-            "Document analysis is unavailable.",
+            "ANALYSIS_TIMEOUT",
+            "Document analysis exceeded 30 seconds.",
           ),
         );
-      return new Promise((resolve, reject) => {
-        pending = {
-          resolve,
-          reject,
-          timer: setTimeout(() => {
-            settle(
-              new OperationError(
-                "ANALYSIS_TIMEOUT",
-                "Document analysis exceeded 30 seconds.",
-              ),
-            );
-            void close();
-          }, 30_000),
-        };
-        worker.postMessage(data);
-      });
+      return request({ ...data, action: "prepare" }, milliseconds);
+    },
+    precheck(documents, staging) {
+      return request({ documents, staging, action: "precheck" });
+    },
+    verify(documents, staging) {
+      return request({ documents, staging, action: "verify" });
     },
     close,
   };

package/src/document-memo.js

@@ -0,0 +1,97 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+import { parse } from "./analysis.js";
+import { fail, limits } from "./contracts.js";
+
+/** Reuse pure owned results for one document; never retain filesystem validity. */
+export function createDocumentMemo() {
+  const trees = new Map();
+  const layouts = new Map();
+  let retainedBytes = 0,
+    disposed = false,
+    layoutEntries = 0;
+  const counts = { parses: 0, parseHits: 0, layouts: 0, layoutHits: 0 };
+  function active() {
+    if (disposed) fail("ANALYSIS_FAILURE", "Document analysis is unavailable.");
+  }
+  function reserve(bytes, entries) {
+    if (entries >= 4 || retainedBytes + bytes > limits.fileBytes) return false;
+    retainedBytes += bytes;
+    return true;
+  }
+  return {
+    parse(text) {
+      active();
+      if (trees.has(text)) {
+        counts.parseHits++;
+        return trees.get(text);
+      }
+      counts.parses++;
+      const tree = parse(text);
+      if (reserve(Buffer.byteLength(text), trees.size)) trees.set(text, tree);
+      return tree;
+    },
+    async layout(text, options, compute) {
+      active();
+      const identity = layoutIdentity(options);
+      const variants = layouts.get(text);
+      if (identity !== null && variants?.has(identity)) {
+        counts.layoutHits++;
+        return variants.get(identity);
+      }
+      counts.layouts++;
+      const result = await compute();
+      // Retain only completed values: failed or pending work is never admission.
+      if (
+        identity !== null &&
+        reserve(
+          Buffer.byteLength(text) + Buffer.byteLength(result),
+          layoutEntries,
+        )
+      ) {
+        const entries = variants ?? new Map();
+        entries.set(identity, result);
+        layouts.set(text, entries);
+        layoutEntries++;
+      }
+      return result;
+    },
+    get statistics() {
+      return { ...counts, retainedBytes, disposed };
+    },
+    dispose() {
+      trees.clear();
+      layouts.clear();
+      retainedBytes = 0;
+      layoutEntries = 0;
+      disposed = true;
+    },
+  };
+}
+
+// Capture every own option, including explicit undefined/null and plugin order.
+// Opaque or executable plugin/options bypass reuse rather than assert purity.
+function layoutIdentity(options) {
+  if (
+    options === null ||
+    typeof options !== "object" ||
+    ![Object.prototype, null].includes(Object.getPrototypeOf(options))
+  )
+    return null;
+  const keys = Reflect.ownKeys(options);
+  if (keys.some((key) => typeof key !== "string")) return null;
+  const identity = [];
+  for (const key of keys.sort()) {
+    const descriptor = Object.getOwnPropertyDescriptor(options, key);
+    if (!Object.hasOwn(descriptor, "value")) return null;
+    const value = descriptor.value;
+    if (key === "plugins" && Array.isArray(value) && value.length === 0)
+      identity.push([key, "empty-plugins"]);
+    else if (value === null) identity.push([key, "null"]);
+    else if (["string", "boolean", "undefined"].includes(typeof value))
+      identity.push([key, typeof value, value]);
+    else if (typeof value === "number" && Number.isFinite(value))
+      identity.push([key, "number", Object.is(value, -0) ? "-0" : value]);
+    else return null;
+  }
+  return JSON.stringify(identity);
+}

package/src/document-worker.js

@@ -1,30 +1,157 @@
 // SPDX-License-Identifier: AGPL-3.0-only
 import { parentPort, workerData } from "node:worker_threads";
-import { formatDocument } from "./formatting.js";
+import { prepareFormattedDocument } from "./formatting.js";
 import { createLinter, lintDocument, checkLinks } from "./analysis.js";
 import { diagnosticBudget, OperationError } from "./contracts.js";
+import { checkTrailingWhitespace } from "./whitespace.js";
+import { createDocumentMemo } from "./document-memo.js";
+import { checkProseGroup } from "./prose-diagnostics.js";
+import {
+  runNativeChecks,
+  bindNativeCheck,
+  matchesNativeCheck,
+  nativeFileCheckEligible,
+} from "./native-checks.js";
 const { context, tool } = workerData;
 const linter = createLinter(context);
-parentPort.on("message", async ({ text, file, mode }) => {
-  try {
-    const formatted = await formatDocument(text, context, tool);
-    const proposed = mode === "format" ? formatted.output : text;
-    const diagnostics = [
-      ...formatted.diagnostics,
-      ...(await lintDocument(linter, proposed, file)),
-      ...checkLinks(context, proposed, file),
-    ];
-    diagnosticBudget(diagnostics);
-    parentPort.postMessage({ output: formatted.output, diagnostics });
-  } catch (error) {
-    parentPort.postMessage({
-      error: {
-        code: error instanceof OperationError ? error.code : "ANALYSIS_FAILURE",
-        message:
-          error instanceof OperationError
-            ? error.message
-            : "Document analysis failed.",
-      },
-    });
-  }
-});
+function reported(error) {
+  return {
+    code: error instanceof OperationError ? error.code : "ANALYSIS_FAILURE",
+    message:
+      error instanceof OperationError
+        ? error.message
+        : "Document analysis failed.",
+  };
+}
+function budgetObserver(elapsed) {
+  return {
+    start(indices) {
+      const remainingMs = Math.min(
+        ...indices.map((index) => 30_000 - elapsed[index]),
+      );
+      if (remainingMs <= 0)
+        throw new OperationError(
+          "ANALYSIS_TIMEOUT",
+          "Document analysis exceeded 30 seconds.",
+        );
+      parentPort.postMessage({ progress: true, remainingMs });
+    },
+    finish(indices, milliseconds) {
+      for (const index of indices) elapsed[index] += milliseconds;
+      this.start(indices);
+    },
+  };
+}
+parentPort.on(
+  "message",
+  async ({ text, file, mode, action, documents, staging, precheck }) => {
+    let memo;
+    try {
+      if (action === "precheck") {
+        const elapsedMs = documents.map(() => 0),
+          observer = budgetObserver(elapsedMs);
+        const started = performance.now();
+        let nativeMs = 0;
+        const eligible = documents
+          .map((text, index) => ({ text, index }))
+          .filter(({ text }) => nativeFileCheckEligible(text, staging));
+        const reports = runNativeChecks(
+          tool,
+          eligible.map(({ text }) => text),
+          staging,
+          {
+            start: (indices) =>
+              observer.start(indices.map((index) => eligible[index].index)),
+            finish: (indices, milliseconds) => {
+              nativeMs += milliseconds;
+              observer.finish(
+                indices.map((index) => eligible[index].index),
+                milliseconds,
+              );
+            },
+          },
+        );
+        const workerMs = performance.now() - started;
+        observer.finish(
+          documents.map((_, index) => index),
+          Math.max(0, workerMs - nativeMs),
+        );
+        const checks = new Array(documents.length);
+        for (const [index, report] of reports.entries())
+          checks[eligible[index].index] = bindNativeCheck(
+            tool,
+            eligible[index].text,
+            report,
+          );
+        parentPort.postMessage({
+          checks,
+          elapsedMs,
+          workerMs,
+        });
+        return;
+      }
+      if (action === "verify") {
+        const elapsed = documents.map((document) => document.elapsedMs);
+        if (
+          elapsed.some(
+            (milliseconds) =>
+              !Number.isFinite(milliseconds) || milliseconds < 0,
+          )
+        )
+          throw new OperationError(
+            "ANALYSIS_FAILURE",
+            "Invalid analysis deadline.",
+          );
+        const observer = budgetObserver(elapsed);
+        const diagnostics = checkProseGroup(
+          tool,
+          documents.map((document) => document.output),
+          staging,
+          observer,
+          documents.map((document) =>
+            matchesNativeCheck(tool, document.output, document.precheck)
+              ? document.precheck.report
+              : undefined,
+          ),
+        );
+        parentPort.postMessage({ diagnostics });
+        return;
+      }
+      memo = createDocumentMemo();
+      const formatted = await prepareFormattedDocument(
+        text,
+        context,
+        tool,
+        memo,
+        precheck,
+      );
+      const proposed = mode === "format" ? formatted.output : text;
+      try {
+        const whitespace = checkTrailingWhitespace(proposed, memo);
+        const diagnostics = [
+          ...whitespace,
+          ...(await lintDocument(linter, proposed, file)),
+          ...checkLinks(context, proposed, file, memo),
+        ];
+        diagnosticBudget(diagnostics);
+        parentPort.postMessage({
+          output: formatted.output,
+          diagnostics,
+          whitespaceCount: whitespace.length,
+          prechecked: formatted.prechecked,
+        });
+      } catch (error) {
+        // Preserve prose-before-lint failure order; no provisional result is admitted.
+        parentPort.postMessage({
+          output: formatted.output,
+          deferredError: reported(error),
+          prechecked: formatted.prechecked,
+        });
+      }
+    } catch (error) {
+      parentPort.postMessage({ error: reported(error) });
+    } finally {
+      memo?.dispose();
+    }
+  },
+);

package/src/formatting.js

@@ -3,7 +3,9 @@ import { formatLayout } from "./literal-layout.js";
 import { parse } from "./analysis.js";
 import { runNative } from "./native-tool.js";
 import { checkProse } from "./prose-diagnostics.js";
+import { normalizeTrailingWhitespace } from "./whitespace.js";
 import { fail } from "./contracts.js";
+import { matchesNativeCheck } from "./native-checks.js";
 function semantic(node) {
   const value = {};
   for (const [key, item] of Object.entries(node)) {
@@ -19,7 +21,25 @@ function semantic(node) {
   }
   return value;
 }
-export async function formatDocument(text, context, tool) {
+/** Prepare guarded candidate bytes; callers must independently verify prose before admission. */
+export async function prepareFormattedDocument(
+  text,
+  context,
+  tool,
+  memo,
+  precheck,
+) {
+  const tree = (source) => (memo ? memo.parse(source) : parse(source));
+  const normalized = normalizeTrailingWhitespace(text, memo);
+  // A lint violation is not authority to erase literal content (inline code or
+  // raw HTML) or accidentally create a hard break by trimming beside a slash.
+  // Return the original for reporting; batch validation will prevent all writes.
+  if (
+    normalized !== text &&
+    JSON.stringify(semantic(tree(text))) !==
+      JSON.stringify(semantic(tree(normalized)))
+  )
+    return { output: text };
   const endOfLine =
     context.config.layout.endOfLine === "preserve"
       ? text.includes("\r\n")
@@ -34,19 +54,40 @@ export async function formatDocument(text, context, tool) {
     tabWidth: context.config.layout.tabWidth,
     plugins: [],
   };
-  const layout = await formatLayout(text, options);
-  const result = await formatLayout(runNative(tool, layout), options);
+  const layout = await formatLayout(normalized, options, memo);
+  if (
+    layout === text &&
+    matchesNativeCheck(tool, text, precheck) &&
+    precheck.report.wouldReformat === false
+  )
+    // Layout byte identity and the admitted native identity prove a composed
+    // fixed point. The exact check still supplies prose findings and rechecks.
+    return { output: text, prechecked: true };
+  const result = await formatLayout(
+    normalizeTrailingWhitespace(runNative(tool, layout), memo),
+    options,
+    memo,
+  );
   // Byte identity proves preservation and an observed fixed point of the entire
   // deterministic formatter pipeline. The independent prose check still runs.
-  if (result === text)
-    return { output: result, diagnostics: checkProse(tool, result) };
+  if (result === text) return { output: result };
   if (
-    JSON.stringify(semantic(parse(text))) !==
-    JSON.stringify(semantic(parse(result)))
+    JSON.stringify(semantic(tree(text))) !==
+    JSON.stringify(semantic(tree(result)))
   )
     fail("PRESERVATION", "Formatting changed parsed meaning or a literal.");
-  const second = await formatLayout(runNative(tool, result), options);
+  const second = await formatLayout(
+    normalizeTrailingWhitespace(runNative(tool, result), memo),
+    options,
+    memo,
+  );
   if (result !== second)
     fail("CONVERGENCE", "Formatter pipeline did not converge.");
-  return { output: result, diagnostics: checkProse(tool, result) };
+  return { output: result };
+}
+
+/** Format one document with its independent prose check, for ungrouped callers. */
+export async function formatDocument(text, context, tool, memo) {
+  const formatted = await prepareFormattedDocument(text, context, tool, memo);
+  return { ...formatted, diagnostics: checkProse(tool, formatted.output) };
 }