@helping-ai-workflow/md2doc 3.12.1 → 3.13.1

package/lib/editor/client.js

@@ -650,6 +650,12 @@
   // v3.4.0 batch3 Task 7 fix 2 (MUST-FIX 1) — may a wave session's own commits
   // simply be popped off the document stack?
   //
+  // Since wave redesign Task 11 its one caller is the net-zero unwind
+  // (unwindWaveOps(), when a session's drawing is back at its opening bytes):
+  // closing the editor never pops anything any more. The MEASURED sequences
+  // below that end in an Escape were taken on the retired Escape discard,
+  // which asked these same two questions.
+  //
   // Two questions, asked separately, each answered by the stack itself rather
   // than by arithmetic over a quantity that can be wrong:
   //
@@ -707,8 +713,36 @@
     return stack.savedDepth === null || stack.savedDepth <= seam.baseDepth;
   }
 
+  // Wave redesign Task 11 — does a whole-session undo (or its Ctrl+Y) offer
+  // still describe the document? `now` is `{ lines, depth, burstOpen }`. The
+  // offer holds only while `lines` is the very array it was made over (every
+  // edit, undo, redo and reload replaces it — equal bytes in a new array still
+  // mean something happened), the stack is at the same depth, and no burst
+  // holds typing `lines` has not seen yet. Pure, so test/editor-client.test.js
+  // drives it; waveUndoOfferValid() / waveRedoOfferValid() feed it the live
+  // state.
+  function waveOfferHolds(offer, now) {
+    return offer !== null && offer !== undefined && now.lines === offer.lines &&
+      now.depth === offer.depth && now.burstOpen !== true;
+  }
+
+  // Task 11 fix round 1 (Ruling R24) — may Ctrl+Y re-apply a whole-session undo
+  // as one step? `ro` is `{ baseDepth, ops }`, `ops` the entries the undo
+  // popped, in pop order; `now` is `{ depth, tail, burstOpen }`, `tail` the
+  // stack's redo branch (redoTail(), top last). It holds while the stack is at
+  // the session's opening depth with exactly those op OBJECTS on top of the
+  // redo branch — what an ordinary undo and redo of something else leaves
+  // standing, and what any new edit (which clears the branch) does not.
+  function waveRedoHolds(ro, now) {
+    if (ro === null || ro === undefined || now.burstOpen === true || now.depth !== ro.baseDepth) return false;
+    const n = ro.ops.length;
+    if (n === 0 || now.tail.length < n) return false;
+    const top = now.tail.slice(now.tail.length - n);
+    return top.every((op, i) => op === ro.ops[i]);
+  }
+
   if (typeof module === 'object' && module.exports) {
-    module.exports = { pasteIsAllListLines, LIST_LINE_RE, extractBlockSource, commitEdit, commitRangeEdit, commitRangeRemoval, commitListBlockRemoval, commitBlockInsertion, planBlockMove, commitBlockMove, reorderSpanRange, spanMoveRange, spanIndentsAreAnchored, blockMoveSeamRefusal, rollbackFailedRender, headingDepthOf, withHeadingDepth, resolveDrawioLanding, shiftBlocksAfterBodyEdit, waveDiscardIsSafe };
+    module.exports = { pasteIsAllListLines, LIST_LINE_RE, extractBlockSource, commitEdit, commitRangeEdit, commitRangeRemoval, commitListBlockRemoval, commitBlockInsertion, planBlockMove, commitBlockMove, reorderSpanRange, spanMoveRange, spanIndentsAreAnchored, blockMoveSeamRefusal, rollbackFailedRender, headingDepthOf, withHeadingDepth, resolveDrawioLanding, shiftBlocksAfterBodyEdit, waveDiscardIsSafe, waveOfferHolds, waveRedoHolds };
     return; // node: pure core only
   }
 
@@ -888,44 +922,51 @@
     discardedRawEdit = null;
   }
 
-  // v3.4.0 batch3 Task 7 — the wave-editor member of the same family as the
-  // two stashes above. Escape out of the wave overlay still DISCARDS, and this
-  // is what makes the discard recoverable by exactly one document-level
-  // Ctrl+Z, the same one-shot contract `discardedBurst` spells out.
-  //
-  // Which of discardedBurst's rules are reused here, and which cannot be:
-  //
-  //   REUSED — the one-shot window (the only Ctrl+Z it answers is the one
-  //   right after the Escape that created it), the drop-on-any-render rule
-  //   (rerenderAll() clears all three at its top), mutual exclusivity with the
-  //   other two, and a staleness guard that refuses rather than applying a
-  //   restore over a document that moved underneath it.
-  //
-  //   NOT APPLICABLE — parking a live `history` object keyed on the burst's
-  //   own DOM node. discardedBurst can do that because the burst's
-  //   contenteditable survives its own Escape; the wave overlay is mounted on
-  //   `document.body` and `close()` REMOVES it (and every document listener it
-  //   installed) before onClose ever runs, so there is no node and no live
-  //   store left to park. Nor is `editEl`/`burstBaselineHtml()` meaningful:
-  //   nothing the wave editor produces was ever HTML in `.content`.
-  //
-  //   NOT APPLICABLE — "the burst never committed, so `lines` never saw it".
-  //   The wave editor writes back PER GESTURE, so by the time Escape is
-  //   pressed `lines` has seen every one of them and the document stack is
-  //   carrying them. That inverts what Escape has to do: it is the one stash
-  //   in this file whose creation REMOVES ops from the stack (see
-  //   finishWaveSession()) rather than never having put any there.
-  //
-  // So this parks a plain VALUE pair — the block body as it stood before the
-  // session (`source`, which is what `lines` holds again once the Escape has
-  // run) and as it stood at the moment of the Escape (`painted`) — plus enough
-  // addressing to prove nothing else moved. Ctrl+Z's job is to put `painted`
-  // back through an ordinary commit and RE-OPEN the editor over it.
-  let discardedWaveEdit = null; // { blockId, blockStartLine, blockEndLine, startLine, endLine, source, painted } | null
-
-  function dropDiscardedWaveEdit() {
-    discardedWaveEdit = null;
-  }
+  // Wave redesign Task 11 (spec section 4.8) — the first Ctrl+Z after the
+  // wave editor closes takes that whole session back as ONE user step.
+  //
+  // Closing always keeps (✕, 完成 and Esc are all only "close"): every gesture
+  // was written into `lines` as it was drawn, so there is nothing to throw
+  // away. What the user may want instead is to take the whole drawing back,
+  // and one Ctrl+Z per gesture is the wrong size for that. So the close leaves
+  // an offer, made by finishWaveSession() once its render is done:
+  //
+  //   { blockId, startLine, endLine, baseSource, baseDepth, lines, depth, count }
+  //
+  //   blockId    the block, found again by id in the CURRENT `blocks` when the
+  //              offer is used — never by the line numbers it had at the close
+  //   startLine, endLine  the body range at the close (a record, not used to
+  //              address anything)
+  //   baseSource the block body when the editor OPENED: the seam's own copy,
+  //              never the store's source, which rebases on every write-back
+  //              (Rulings R16/R17)
+  //   lines      the `lines` ARRAY at the close, by reference, and
+  //   depth      `stack.depth` at the close. Together they are the whole
+  //              validity contract (waveUndoOfferValid()): every edit, undo,
+  //              redo and reload replaces `lines`, so an offer whose array is
+  //              no longer the live one belongs to a document that has moved
+  //              on, even when the bytes happen to be equal again
+  //   baseDepth  the stack depth when the editor opened (seam.baseDepth); the
+  //              offer is only made when the close finds the stack exactly
+  //              `baseDepth + count` deep, i.e. the session's own entries on top
+  //   count      how many gestures the session wrote (seam.ops): the toast's N,
+  //              and how many entries the revert pops (Ruling R24)
+  //
+  // It is spent by the Ctrl+Z that asks it, whether or not it still held. The
+  // step itself (undoWaveSession(), Ruling R24) pops the session's `count`
+  // entries off the stack and renders once. It is not the old Escape discard's
+  // unwind: that one ran before any render, never rendered, and threw the
+  // entries away (discardTop); this keeps them on the redo branch.
+  //
+  // `waveRedoOffer` is the other half (spec: 可再被 Ctrl+Y 取消): made when
+  // the revert lands, `{ baseDepth, ops, offer }` (`ops` the popped entries),
+  // and Ctrl+Y while the stack still stands there (waveRedoOfferValid())
+  // re-applies them as one step and re-makes the undo offer.
+  //
+  // Declared up here, beside the stashes, for the same temporal-dead-zone
+  // reason as `waveUnwrittenEdit` below.
+  let waveUndoOffer = null;
+  let waveRedoOffer = null;
 
   // v3.4.0 batch3 Task 7 — a wave gesture whose patch was REFUSED, i.e. work
   // the user can see in the overlay that `lines` does not hold and cannot be
@@ -942,6 +983,14 @@
   // definition nothing reached `lines`.
   let waveUnwrittenEdit = false;
 
+  // wave redesign Task 6b: the open wave editor's `setSaveStatus`, or null.
+  // The editor's title bar shows the FILE's save state (spec section 4.8),
+  // so setDirty() pushes every change to it. Kept up here rather than read
+  // off `waveEditor` for the same reason as `waveUnwrittenEdit` above:
+  // setDirty() is reachable before the wave wiring's own `let`s far below
+  // have left their temporal dead zone.
+  let waveSaveStatusSink = null;
+
   // §10-gap fix (review): the block insertBlockBelow() most recently
   // inserted, tracked from the moment its edit surface is first focused
   // until its FIRST resolution (blur, Escape, explicit commit, or Ctrl+Z) —
@@ -1061,7 +1110,9 @@
   let switching = null;
   function switchAwayFrom() {
     if (switching) return switching;
-    switching = resolveOpenSession().finally(() => { switching = null; });
+    // v3.13.1 T1: a held-key replay that waited on this resolution resumes
+    // once it is over (scheduleFlightFlush() is a no-op with nothing held).
+    switching = resolveOpenSession().finally(() => { switching = null; scheduleFlightFlush(); });
     return switching;
   }
 
@@ -1147,6 +1198,7 @@
   function setDirty() {
     document.title = (documentIsDirty() ? '● ' : '') + baseTitle;
     paintSaveStatus(documentIsDirty() ? 'dirty' : 'clean');
+    if (waveSaveStatusSink !== null) waveSaveStatusSink(documentIsDirty());
   }
 
   // setDirty() is push-driven: something has to call it. MEASURED by keeping
@@ -1323,6 +1375,33 @@
   }
   function showError(message, actionLabel, onAction) { return showBanner(message, actionLabel, onAction, 'error'); }
   function showNotice(message) { return showBanner(message, null, null, 'notice'); }
+  // Wave redesign Task 6b fix round 1 (spec E2): the wave editor's notices
+  // must never take the place of a red card that is still up — a write-back
+  // refusal, a failed save, the disk-conflict card with 重新載入. With one
+  // banner on the page, showBanner() would replace it, and that card is the
+  // only record of the problem. The notice is dropped instead (the editor
+  // still keeps it in its own data-wave-status). Scoped to the wave editor's
+  // messages rather than changed inside showNotice() for every caller: the
+  // global change could only be verified by the long editor-journey suite,
+  // which this phase of the redesign does not run.
+  //
+  // Task 11: while the editor is open the toast sits just above its hint bar
+  // (spec section 4.8: 編輯器內底部置中) rather than at the viewport's
+  // `bottom: 28px`. MEASURED at 1366x768 before this: the toast spanned
+  // y 696-740 and the hint bar 697-729, so the toast covered the middle of
+  // the bar the user reads for the next step. Measured off the bar itself, so
+  // any panel size or bar height lands it right.
+  function showWaveNotice(message, actionLabel, onAction) {
+    if (activeBanner !== null && document.contains(activeBanner) &&
+        activeBanner.getAttribute('data-level') === 'error') return null;
+    const el = showBanner(message, actionLabel, onAction, 'notice');
+    const hintBar = waveEditorIsModal() ? document.querySelector('.ed-wave-overlay .ed-wave-hint') : null;
+    if (el !== null && hintBar !== null) {
+      const top = hintBar.getBoundingClientRect().top;
+      el.style.bottom = Math.max(8, Math.round(window.innerHeight - top + 8)) + 'px';
+    }
+    return el;
+  }
 
   // Task 9 review I3: MEASURED AT THE TIME — `.ed-conflict` was
   // `position:fixed; top:0; z-index:999` against `.ed-toolbar`'s
@@ -1554,9 +1633,6 @@
     // twin — this render is about to replace `lines`' rendering of whatever
     // discardedRawEdit's stashed `source` names.
     dropDiscardedRawEdit();
-    // v3.4.0 batch3 Task 7: and the wave twin — its staleness guard compares
-    // `lines` at a span, which this render is about to repaint from.
-    dropDiscardedWaveEdit();
     const scrollY = window.scrollY;
     // S3 Task 5 (§4.4 step 2): the line range this render's operation declared
     // for the rebuilt selection. Consumed HERE, before the first failure exit,
@@ -1611,6 +1687,11 @@
     // through explicitly. Passed positionally here and through
     // applyRenderResult() rather than folded into `j` (which is the
     // server's response payload, not render-context the CALLER derived).
+    // v3.13.1 R11: the selection right before the DOM is replaced — a click,
+    // drag or double-click into another block during this request has
+    // already put it there. The focusin re-resolve and the flight replay
+    // restore it, anchor and focus both.
+    lastRenderSel = selectionSnapshotIn(activeFlightSurface());
     return applyRenderResult(j, editRange, scrollY, declaredRange);
   }
 
@@ -2590,14 +2671,457 @@
   // refusal, and commitListStructure()'s no-range exit) pass nothing, which
   // falls back to a full re-render by contract — patch can only compare
   // renderer output, never DOM the user has already touched.
+  //
+  // v3.13.1 T1: every render is also a "commit in flight" for the input guard
+  // below — see `commitFlight`. A render that lands re-points every held
+  // entry's tag at the surface that now holds the same source.
   async function safeRerenderAll(editRange) {
+    const blocksBefore = blocks;
+    const lineMap = pendingFlightLineMap;
+    pendingFlightLineMap = null;
+    beginCommitFlight();
+    let ok = false;
     try {
-      return await rerenderAll(editRange);
+      ok = await rerenderAll(editRange);
+      return ok;
     } catch (e) {
       showError('這次修改沒有套用：發生未預期的錯誤（' + describeFailure(e) +
         '）。文件維持修改前的樣子。', null, null);
       return false;
+    } finally {
+      if (ok) reanchorFlightBuffer(blocksBefore, editRange, lineMap);
+      // A failed render: nothing places focus afterwards (commitListStructure()
+      // skips its focusBlockAtLine(), and a failed blur-commit refocuses the
+      // block it could not commit), so the opening run replays where it was
+      // typed. Measured before round 3: edit A, click B@5, `ZZ`, render 500 —
+      // `ZZ` went to the start of A.
+      else pinFirstFlightRun(null);
+      endCommitFlight();
+    }
+  }
+
+  // ── v3.13.1 T1: the commit-in-flight input guard ──────────────────────
+  // A commit awaits /api/render and then rebuilds the surfaces it covers from
+  // `lines`. Anything typed into a surface while that request is out lands in
+  // DOM the render is about to throw away. Measured before this (audit
+  // 2026-10-10): Enter then an immediate `type('new')` in a tight list lost
+  // every character in Chromium and wrote an extra empty `-` item; with the
+  // render held 800 ms, 100% loss in both engines.
+  //
+  // While a flight is active (flightActive(): a commit in flight, or held
+  // entries still waiting to replay), what is typed into an armed surface is held in
+  // `flightBuffer` instead of reaching the DOM — text, paste, and the keys
+  // that edit or move: Enter, Tab, Backspace/Delete (and their word/line
+  // chords), arrows, Home/End. Escape drops everything held (R12: Escape
+  // means "throw away what I have not committed", in flight or not). Once
+  // the render has landed and its caller has placed focus, the entries are
+  // replayed in order, each through the path the live input would have taken
+  // (ruling R13): text through the browser's own insertText (which replaces a
+  // selection and rebalances whitespace; insertTextAtCaret() is the fallback),
+  // paste through routePaste(), keys as a keydown through the
+  // document handler — so ↑/↓ can still cross blocks and a table cell still
+  // owns its keys — and, when no handler claims the key, its native default
+  // (execCommand deletion, Selection.modify movement).
+  //
+  // WHERE an entry replays (fix rounds 1-3):
+  //  * A "continuation" entry (pos === null) replays at the selection the
+  //    replay has reached — wherever focus is once the caller placed it, or
+  //    wherever an earlier replayed key moved it (a held ArrowDown that walks
+  //    to the next block takes the keys typed after it there). A held key
+  //    never moves the DOM selection; a pointer press does, so the press
+  //    first PINS the run of continuation entries that opened the flight to
+  //    the selection it is about to move away from (pinFirstFlightRun(); a
+  //    failed render pins it too, since then no caller places focus). Every
+  //    other run already starts at a positioned entry. Measured before round
+  //    3: click B@5, `xy`, click Omega, `Z` replayed `xy` at B's start.
+  //  * A "positioned" entry is the first one held after a pointer press into
+  //    a surface during the flight: it carries a tag (surface, block id,
+  //    table cell index) and the full selection (anchor and focus offsets),
+  //    restored before it replays. Offsets are shifted past the held text
+  //    that will be inserted before them in the same surface by the time it
+  //    replays (heldShiftBefore()). The tag is re-pointed when a render
+  //    replaces its surface: by the committed run's own line map for an item
+  //    of a list run the commit rewrote (an item the split pushed down a
+  //    line, the provisional item), otherwise by its block's start line,
+  //    shifted by the commit's line delta when it lay below the edited range.
+  //    Measured before round 2: Enter, `ab`, click `charlie`, `Z` saved
+  //    `- abZ` with charlie untouched.
+  //  * A pointer press during the flight with nothing typed after it becomes
+  //    a { kind: 'focus' } entry, so the click is not lost to the commit's
+  //    own focusBlockAtLine().
+  //
+  // A failed render keeps the buffer too: rerenderAll() leaves `.content`
+  // untouched on failure, every surface is still connected, and the replay
+  // lands where it was typed.
+  let commitFlight = 0;
+  const flightBuffer = [];
+  // A pointer press into a surface during a flight: the next held entry is
+  // positioned (see above).
+  let flightSelMoved = false;
+  // Set while an entry replays: the replay's own keydown / insertText must
+  // not be held again.
+  let flightReplaying = false;
+  function flightActive() {
+    return !flightReplaying && (commitFlight > 0 || flightBuffer.length > 0);
+  }
+  // The selection right before the latest render replaced the DOM (R11).
+  let lastRenderSel = null;
+  // Where continuation entries go when the render took focus away and no
+  // caller put it anywhere (e.g. a Ctrl+S commit of the focused block).
+  let flightFallback = null;
+  // commitListStructure() -> safeRerenderAll(): the run's line map.
+  let pendingFlightLineMap = null;
+  const FLIGHT_DROPPED_MESSAGE = '重新整理期間打的字沒有地方放，已略過';
+
+  function beginCommitFlight() {
+    commitFlight++;
+  }
+
+  // Not a synchronous decrement. The caller's continuation after
+  // `await safeRerenderAll(...)` — focusBlockAtLine(), an arrow walk's
+  // landing — is a microtask, so it runs before this timer and focus is
+  // placed before the replay. Keys that arrive between the render landing
+  // and the timer are still held, behind the earlier ones.
+  function endCommitFlight() {
+    setTimeout(() => {
+      commitFlight--;
+      if (!commitFlight) flushFlightBuffer();
+    }, 0);
+  }
+
+  // A replay that had to wait for a focus change resumes from here (the
+  // focusin handlers call it once their burst is open).
+  function scheduleFlightFlush() {
+    if (flightBuffer.length && !commitFlight) setTimeout(flushFlightBuffer, 0);
+  }
+
+  function flightSurfaceOf(node) {
+    const el = node && (node.nodeType === 1 ? node : node.parentElement);
+    return el && el.closest ? el.closest('.ed-wys-armed, .ed-wys-cell') : null;
+  }
+  function activeFlightSurface() {
+    return flightSurfaceOf(document.activeElement);
+  }
+
+  // Selection points as character offsets inside a surface, counted over
+  // text nodes only — the same count pointInSurface() walks back.
+  function offsetInSurface(surface, node, offset) {
+    const r = document.createRange();
+    r.selectNodeContents(surface);
+    r.setEnd(node, offset);
+    return r.toString().length;
+  }
+  function pointInSurface(surface, offset) {
+    let left = offset;
+    let lastText = null;
+    const walker = document.createTreeWalker(surface, NodeFilter.SHOW_TEXT);
+    for (let t = walker.nextNode(); t; t = walker.nextNode()) {
+      if (left <= t.data.length) return [t, left];
+      left -= t.data.length;
+      lastText = t;
+    }
+    return lastText ? [lastText, lastText.data.length] : [surface, 0];
+  }
+  // { surface, anchor, focus } for the selection in `surface`; offsets are
+  // null when the selection is not inside it.
+  function selectionSnapshotIn(surface) {
+    if (!surface) return null;
+    const sel = window.getSelection();
+    if (!sel.rangeCount || !surface.contains(sel.anchorNode) || !surface.contains(sel.focusNode)) {
+      return { surface, anchor: null, focus: null };
+    }
+    return { surface,
+      anchor: offsetInSurface(surface, sel.anchorNode, sel.anchorOffset),
+      focus: offsetInSurface(surface, sel.focusNode, sel.focusOffset) };
+  }
+  function restoreSelection(surface, anchor, focus) {
+    if (anchor === null || anchor === undefined) return;
+    const a = pointInSurface(surface, anchor);
+    const f = pointInSurface(surface, focus === null || focus === undefined ? anchor : focus);
+    window.getSelection().setBaseAndExtent(a[0], a[1], f[0], f[1]);
+  }
+
+  function flightTagOf(snap) {
+    if (!snap || !snap.surface) return null;
+    const blockEl = snap.surface.closest('.ed-block');
+    const isCell = snap.surface.classList.contains('ed-wys-cell');
+    return {
+      surface: snap.surface,
+      blockId: blockEl ? blockEl.getAttribute('data-block-id') : null,
+      cellIndex: isCell && blockEl
+        ? Array.prototype.indexOf.call(blockEl.querySelectorAll('.ed-wys-cell'), snap.surface) : null,
+      anchor: snap.anchor, focus: snap.focus,
+    };
+  }
+
+  // The committed run's lines after the commit: the serializer's own
+  // line -> block map (`lineMeta`, one entry per emitted line), keyed by the
+  // block ids the run had before it. The provisional item has no id.
+  function flightLineMapOf(lineMeta, startLine) {
+    const map = { ids: {}, provisional: null };
+    (lineMeta || []).forEach((m, k) => {
+      if (m.blank) return;
+      if (m.blockId === null || m.blockId === undefined) {
+        if (map.provisional === null) map.provisional = startLine + k;
+      } else if (!(m.blockId in map.ids)) {
+        map.ids[m.blockId] = startLine + k;
+      }
+    });
+    return map;
+  }
+
+  // How far held text will have pushed `offset` in `surface` by the time an
+  // entry positioned there replays: the text of every run pinned (or, for
+  // the opening run, typed) in the same surface at or before that offset.
+  function heldShiftBefore(surface, offset) {
+    let pin = null;
+    let shift = 0;
+    flightBuffer.forEach((en, i) => {
+      if (en.pos || i === 0) pin = en.pos || en.hint;
+      if (en.kind !== 'text' || !pin || pin.surface !== surface || pin.anchor === null) return;
+      if (Math.min(pin.anchor, pin.focus === null ? pin.anchor : pin.focus) <= offset) shift += en.data.length;
+    });
+    return shift;
+  }
+  function shiftedTag(tag) {
+    if (!tag || tag.anchor === null) return tag;
+    tag.anchor += heldShiftBefore(tag.surface, tag.anchor);
+    if (tag.focus !== null) tag.focus += heldShiftBefore(tag.surface, tag.focus);
+    return tag;
+  }
+
+  // Pins the run of continuation entries that opened this flight (if it is
+  // still unpinned) to `snap`, or to its own first entry's hint — where it
+  // was typed — when there is no usable selection.
+  function pinFirstFlightRun(snap) {
+    const first = flightBuffer[0];
+    if (!first || first.pos) return;
+    const tag = snap && snap.anchor !== null ? flightTagOf(snap) : null;
+    first.pos = tag || (first.hint ? Object.assign({}, first.hint) : null);
+  }
+
+  function holdFlightEntry(surface, entry) {
+    entry.pos = null;
+    entry.hint = flightTagOf(selectionSnapshotIn(surface));
+    if (flightSelMoved) {
+      flightSelMoved = false;
+      entry.pos = shiftedTag(flightTagOf(selectionSnapshotIn(surface)));
+    }
+    const last = flightBuffer[flightBuffer.length - 1];
+    if (entry.kind === 'text' && !entry.pos && last && last.kind === 'text') {
+      last.data += entry.data;
+      return;
+    }
+    flightBuffer.push(entry);
+  }
+
+  // After a render lands: re-point every tag whose surface it replaced.
+  function reanchorFlightBuffer(before, editRange, lineMap) {
+    if (flightSelMoved && lastRenderSel) {
+      flightSelMoved = false;
+      flightBuffer.push({ kind: 'focus', pos: shiftedTag(flightTagOf(lastRenderSel)) });
+    }
+    flightFallback = lastRenderSel && !lastRenderSel.surface.isConnected
+      ? flightTagOf(lastRenderSel) : null;
+    const remap = (pos) => {
+      if (!pos) return;
+      if (pos.surface && pos.surface.isConnected) {
+        const own = pos.surface.closest('.ed-block');
+        pos.blockId = own ? own.getAttribute('data-block-id') : pos.blockId;
+        return;
+      }
+      let line = null;
+      if (lineMap) {
+        if (pos.blockId === null) line = lineMap.provisional;
+        else if (pos.blockId in lineMap.ids) line = lineMap.ids[pos.blockId];
+      }
+      if (line === null && pos.blockId !== null) {
+        const rec = (before || []).find((b) => b.id === Number(pos.blockId));
+        if (rec) {
+          line = rec.startLine;
+          if (editRange && line > editRange.endLine) line += editRange.delta;
+        }
+      }
+      pos.surface = null;
+      if (line === null) return;
+      const nb = blocks.find((b) => b.startLine === line);
+      const nEl = nb ? document.querySelector('.ed-block[data-block-id="' + nb.id + '"]') : null;
+      if (!nEl) return;
+      let surf = pos.cellIndex !== null && pos.cellIndex !== undefined
+        ? nEl.querySelectorAll('.ed-wys-cell')[pos.cellIndex] || null
+        : blockContentEl(nEl);
+      if (surf && !surf.matches('.ed-wys-armed, .ed-wys-cell')) surf = null;
+      pos.surface = surf;
+      pos.blockId = String(nb.id);
+    };
+    flightBuffer.forEach((en) => { remap(en.pos); remap(en.hint); });
+    remap(flightFallback);
+  }
+
+  // A deletion chord's input type, and a caret chord's movement, per
+  // platform (Ctrl on Linux/Windows, Alt and Cmd on a Mac).
+  const FLIGHT_IS_MAC = /Mac|iPhone|iPad/.test(navigator.platform);
+  function deletionForKey(e) {
+    const word = FLIGHT_IS_MAC ? (e.altKey && !e.metaKey && !e.ctrlKey) : (e.ctrlKey && !e.metaKey && !e.altKey);
+    const line = FLIGHT_IS_MAC && e.metaKey && !e.altKey && !e.ctrlKey;
+    const plain = !e.ctrlKey && !e.metaKey && !e.altKey;
+    if (e.key === 'Backspace') {
+      return plain ? 'deleteContentBackward' : word ? 'deleteWordBackward' : line ? 'deleteSoftLineBackward' : null;
     }
+    if (e.key === 'Delete') {
+      return plain ? 'deleteContentForward' : word ? 'deleteWordForward' : line ? 'deleteSoftLineForward' : null;
+    }
+    return null;
+  }
+  function caretMoveForKey(e) {
+    const word = FLIGHT_IS_MAC ? (e.altKey && !e.metaKey && !e.ctrlKey) : (e.ctrlKey && !e.metaKey && !e.altKey);
+    const plain = !e.ctrlKey && !e.metaKey && !e.altKey;
+    const extend = !!e.shiftKey;
+    if (e.key === 'ArrowLeft' || e.key === 'ArrowRight') {
+      if (!plain && !word) return null;
+      return { dir: e.key === 'ArrowLeft' ? 'backward' : 'forward', unit: word ? 'word' : 'character', extend };
+    }
+    if (!plain) return null;
+    if (e.key === 'Home' || e.key === 'End') return { dir: e.key === 'Home' ? 'backward' : 'forward', unit: 'lineboundary', extend };
+    if (e.key === 'ArrowUp' || e.key === 'ArrowDown') return { dir: e.key === 'ArrowUp' ? 'backward' : 'forward', unit: 'line', extend };
+    return null;
+  }
+  function isHeldTyping(en) {
+    return en.kind === 'text' || en.kind === 'paste' || en.kind === 'delete' ||
+      (en.kind === 'key' && !caretMoveForKey(en));
+  }
+  function dropHeldTyping() {
+    const kept = [];
+    let carry = null;
+    flightBuffer.forEach((en) => {
+      if (isHeldTyping(en)) {
+        if (en.pos) carry = en.pos;
+        return;
+      }
+      if (en.pos) carry = null;
+      else if (carry) { en.pos = carry; carry = null; }
+      kept.push(en);
+    });
+    flightBuffer.length = 0;
+    kept.forEach((en) => flightBuffer.push(en));
+  }
+  function flightHoldsKey(e) {
+    if ((e.key === 'Enter' || e.key === 'Tab') && !e.ctrlKey && !e.metaKey && !e.altKey) return true;
+    return !!(deletionForKey(e) || caretMoveForKey(e));
+  }
+
+  // The native default of a deletion, against the restored selection: a
+  // selection is deleted whole; a collapsed caret deletes one character, or
+  // is first extended by a word / to the line boundary.
+  function nativeFlightDeletion(t, target) {
+    const sel = window.getSelection();
+    if (!sel.rangeCount) return;
+    const back = /Backward$/.test(t);
+    const unit = /Word/.test(t) ? 'word' : (/Line/.test(t) ? 'lineboundary' : null);
+    if (sel.isCollapsed && unit) {
+      if (!sel.modify) return;
+      sel.modify('extend', back ? 'backward' : 'forward', unit);
+      // Nothing to delete in that direction: a collapsed 'delete' would take
+      // a character instead.
+      if (sel.isCollapsed) return;
+    }
+    snapBurstIfActive(target, 'replay-pre');
+    document.execCommand(sel.isCollapsed && !back ? 'forwardDelete' : 'delete');
+    snapBurstIfActive(target, 'replay');
+  }
+
+  function replayFlightEntry(item, target) {
+    if (item.kind === 'text') {
+      // The browser's own insertText, not insertTextAtCaret(): it replaces a
+      // selection the same way, and it also rebalances the whitespace around
+      // the caret the way live typing does (measured: a held Ctrl+Backspace
+      // leaves `ab` + NBSP, and only the native insertion of the next `e`
+      // turns that back into `ab e`).
+      snapBurstIfActive(target, 'replay-pre');
+      if (/[\r\n]/.test(item.data) || !document.execCommand('insertText', false, item.data)) {
+        insertTextAtCaret(item.data);
+      }
+      snapBurstIfActive(target, 'replay');
+    } else if (item.kind === 'paste') {
+      plainPasteArmed = item.plainOnly;
+      routePaste(target, item.dt);
+    } else if (item.kind === 'delete') {
+      nativeFlightDeletion(item.inputType, target);
+    } else if (item.kind === 'key') {
+      const ev = new KeyboardEvent('keydown', { key: item.key, shiftKey: item.shiftKey,
+        ctrlKey: item.ctrlKey, altKey: item.altKey, metaKey: item.metaKey, bubbles: true, cancelable: true });
+      target.dispatchEvent(ev);
+      if (ev.defaultPrevented) return;
+      const del = deletionForKey(item);
+      if (del) { nativeFlightDeletion(del, target); return; }
+      const move = caretMoveForKey(item);
+      const sel = window.getSelection();
+      if (move && sel.modify) sel.modify(move.extend ? 'extend' : 'move', move.dir, move.unit);
+    }
+  }
+
+  function flushFlightBuffer() {
+    if (commitFlight || switching) return;
+    let dropped = false;
+    // Replay in order. A replayed key, or the focus change to a positioned
+    // entry's surface, can start a new commit (or wait on one); the rest
+    // waits and resumes from its endCommitFlight() or the focusin handlers.
+    while (flightBuffer.length && !commitFlight && !switching) {
+      const item = flightBuffer[0];
+      let target = null;
+      if (item.pos) {
+        target = item.pos.surface && item.pos.surface.isConnected ? item.pos.surface : null;
+        if (!target) { flightBuffer.shift(); dropped = true; continue; }
+        if (activeFlightSurface() !== target) {
+          target.focus();
+          if (commitFlight || switching) break;
+        }
+        restoreSelection(target, item.pos.anchor, item.pos.focus);
+      } else {
+        target = activeFlightSurface();
+        const fb = flightFallback;
+        if (!target && fb && fb.surface && fb.surface.isConnected) {
+          fb.surface.focus();
+          if (commitFlight || switching) break;
+          restoreSelection(fb.surface, fb.anchor, fb.focus);
+          flightFallback = null;
+          target = activeFlightSurface();
+        }
+        if (!target) { flightBuffer.shift(); dropped = true; continue; }
+      }
+      flightBuffer.shift();
+      if (item.kind !== 'focus') {
+        flightReplaying = true;
+        try { replayFlightEntry(item, target); } finally { flightReplaying = false; }
+      }
+    }
+    if (!flightBuffer.length && !commitFlight) flightFallback = null;
+    if (dropped) showNotice(FLIGHT_DROPPED_MESSAGE);
+  }
+
+  // An IME composition cannot be cancelled (its beforeinput is not
+  // cancelable), so the committed text is already in the DOM when
+  // compositionend reports it. It is taken back out when it sits right
+  // before the caret, which leaves the buffer its only owner — a render that
+  // keeps this surface (a failed one, or a patch that does not cover it)
+  // would otherwise show it twice once the replay lands. Returns false when
+  // it cannot be found there; the caller holds it anyway, and the render
+  // that replaces the surface is what removes the DOM copy.
+  function takeBackComposedText(data) {
+    const sel = window.getSelection();
+    if (!data || !sel.rangeCount) return false;
+    const r = sel.getRangeAt(0);
+    if (!r.collapsed || r.startContainer.nodeType !== 3) return false;
+    const node = r.startContainer;
+    const start = r.startOffset - data.length;
+    if (start < 0 || node.data.slice(start, r.startOffset) !== data) return false;
+    node.deleteData(start, data.length);
+    const c = document.createRange();
+    c.setStart(node, start);
+    c.collapse(true);
+    sel.removeAllRanges();
+    sel.addRange(c);
+    return true;
   }
 
   function autoSize(ta) {
@@ -3021,8 +3545,6 @@
         // own comment for why only the more recent of the two stashes may
         // ever answer the next Ctrl+Z.
         dropDiscardedBurst();
-        // …and with the wave twin, for the same reason.
-        dropDiscardedWaveEdit();
         discardedRawEdit = {
           blockId, range, startLine, endLine, source,
           value: ta.value, caret: ta.selectionStart,
@@ -7271,8 +7793,6 @@
     // discardedRawEdit's own comment for why the two stashes must stay
     // mutually exclusive.
     dropDiscardedRawEdit();
-    // v3.4.0 batch3 Task 7: …and the wave twin, same rule, three stashes.
-    dropDiscardedWaveEdit();
     const blockEl = editEl.closest('.ed-block');
     if (!blockEl) return;
     const blockId = Number(blockEl.getAttribute('data-block-id'));
@@ -7509,11 +8029,19 @@
         commitMd = runMd;
         commitStart = range.startLine;
         commitEnd = range.endLine;
+        // v3.13.1 T1 fix round 3: the whole run is rewritten — including any
+        // provisional item still in it, which then gets a line of its own and
+        // pushes the items after it down one. Keys held for those items find
+        // them by this map (see flightLineMapOf()). Measured without it: a
+        // failed Enter render, then `ab` replayed into the new item, then the
+        // blur commit of this run — `Z` held for charlie landed in `ab`.
+        pendingFlightLineMap = flightLineMapOf(lineMeta, range.startLine);
       }
       const liCommitResult = (commitMd === '')
         ? commitRangeRemoval({ lines, blocks, stack }, commitStart, commitEnd)
         : commitRangeEdit({ lines, blocks, stack }, commitStart, commitEnd, commitMd);
       if (liCommitResult.op === null) {
+        pendingFlightLineMap = null;
         endBurstWithoutResolve();
         return true;
       }
@@ -7567,7 +8095,13 @@
     // commit '#'.repeat(depth) + ' ' with nothing after the space. Every
     // non-heading burst's `depth` is null (blockDepthOf() only computes it for
     // 'heading'), so it takes the plain result.md branch.
-    const newText = burst.depth === null ? result.md :
+    // v3.13.1 T2 (F-1): a paragraph's text is escaped where it would read as
+    // a block marker (`## `, `- `, `> `, `1. ` …), or the next render turns
+    // the paragraph into that block. A heading's text sits after its own
+    // `# ` and needs none; a table's rows START with `|`, so its markdown
+    // must never reach the escape — hence the blockType test, not just depth.
+    const newText = burst.depth === null
+      ? (burst.blockType === 'paragraph' ? inlineMd.escapeBlockStarts(result.md) : result.md) :
       (result.md === '' ? '#'.repeat(burst.depth) : '#'.repeat(burst.depth) + ' ' + result.md);
     // S1 removed the pre-per-li "a whole-list burst that serialized to ''"
     // branch that lived here alongside the dead 'list' serializer arm above.
@@ -8284,7 +8818,7 @@
   async function commitListStructure(runEls, focusStartLine, caretToEnd, opts) {
     const span = runEls || [];
     const presetRange = opts && opts.presetRange;
-    const { md } = serializeListEls(span, { carryOver: (opts && opts.carryOver) || null });
+    const { md, lineMeta } = serializeListEls(span, { carryOver: (opts && opts.carryOver) || null });
     // The run's line range is read back off its own li blocks' ids — which
     // requires at least one li to still BE there. A caller whose mutation
     // removed the run's last item therefore captures the range BEFORE mutating
@@ -8313,6 +8847,10 @@
           endLine: Math.max(result.op.startLine - 1, result.op.endLine),
           delta: result.op.after.length - result.op.before.length }
       : undefined;
+    // v3.13.1 T1 fix round 2: where each item of the run will start once this
+    // commit lands, so a key held for an item of this very run — one the
+    // split pushed down a line, or the provisional item itself — finds it.
+    if (result.op !== null) pendingFlightLineMap = flightLineMapOf(lineMeta, range.startLine);
     const ok = await safeRerenderAll(editRange);
     if (!ok) {
       lines = rollbackFailedRender({ lines, stack }, result, prevLines);
@@ -8548,7 +9086,6 @@
     // v3.4.0 (Task 7 item 5): mutual exclusivity with the raw-editor twin —
     // see discardedRawEdit's own comment.
     dropDiscardedRawEdit();
-    dropDiscardedWaveEdit();
     discardedBurst = {
       history: burst.history, editEl, blockType: burst.blockType, cellIdx: -1,
       reverted: burstBaselineHtml(editEl),
@@ -8570,7 +9107,6 @@
     // v3.4.0 (Task 7 item 5): mutual exclusivity with the raw-editor twin —
     // see discardedRawEdit's own comment.
     dropDiscardedRawEdit();
-    dropDiscardedWaveEdit();
     discardedBurst = {
       history: burst.history, editEl: tableEl, blockType: 'table', cellIdx,
       reverted: burstBaselineHtml(tableEl),
@@ -9063,6 +9599,28 @@
   //
   // Returns the new block element, or null when the caret is not inside
   // `blockEl`'s own surface (nothing mutated).
+  // v3.13.1 T1: the item splitListItemAtCaret() just built is a plain div
+  // until the commit's render replaces it — not editable, so the caret stayed
+  // in the OLD item and anything typed before the render landed went there.
+  // Arm it the way armEditables() arms an li (the same two writes), focus it
+  // and put the caret at its start, where the render's own
+  // focusBlockAtLine() will put it again.
+  // The focusin this raises starts no burst: Enter's burst is still current
+  // here, so that handler's `if (currentBurst) return;` returns.
+  function armProvisionalLi(newLi) {
+    const textEl = liTextEl(newLi);
+    if (!textEl) return;
+    textEl.setAttribute('contenteditable', 'true');
+    textEl.classList.add('ed-wys-armed');
+    textEl.focus();
+    const range = document.createRange();
+    range.selectNodeContents(textEl);
+    range.collapse(true);
+    const sel = window.getSelection();
+    sel.removeAllRanges();
+    sel.addRange(range);
+  }
+
   function splitListItemAtCaret(blockEl) {
     const sel = window.getSelection();
     if (!sel.rangeCount) return null;
@@ -9950,7 +10508,14 @@
     // splitListItemAtCaret() keeps `li` itself in place (only `newLi` is a
     // freshly-inserted sibling) and never touches the focused node's
     // attachment.
-    const newLi = mutateListRun(() => splitListItemAtCaret(li));
+    // v3.13.1 T1: the new item is armed and focused inside the same span, so
+    // the old item's focusout stays suppressed and the next keystroke is
+    // already aimed at the new item while the commit below is in flight.
+    const newLi = mutateListRun(() => {
+      const n = splitListItemAtCaret(li);
+      if (n) armProvisionalLi(n);
+      return n;
+    });
     if (!newLi) return true;
     run = listRunOf(newLi);
     // `li` had its text CUT IN TWO in the DOM; replaying its source would put
@@ -10002,7 +10567,6 @@
     dropDiscardedBurst();
     // v3.4.0 (Task 7 item 5): see startBurst()'s own comment just above.
     dropDiscardedRawEdit();
-    dropDiscardedWaveEdit();
     const tableEl = cellEl.closest('table');
     const blockEl = tableEl && tableEl.closest('.ed-block');
     if (!blockEl) return;
@@ -15451,6 +16015,10 @@
       mtimeMs = j.mtimeMs;
       stack.markSaved(token);
       setDirty();
+      // Spec section 4.8: Ctrl+S inside the wave editor saves the whole file
+      // and leaves the editor open; the toolbar's status slot is behind the
+      // modal, so the result is said at the bottom as well.
+      if (waveSaveStatusSink !== null) showWaveNotice('已儲存', null, null);
       // v3.4.0 §3: markSaved() just moved documentIsDirty() from true to
       // false, and the `save` button's own lit/grey state is read off
       // exactly that value (toolbarContext()'s `dirty` field) — without this
@@ -15622,11 +16190,6 @@
     // discardedRawEdit's own comment), so checking both in sequence never
     // answers a stale one while the other substrate holds the fresher discard.
     if (await restoreDiscardedRawEdit()) return;
-    // v3.4.0 batch3 Task 7: the wave twin. Third in the sequence for no reason
-    // other than that it is the newest; all three are mutually exclusive by
-    // construction (one editing session at a time) and each nulls its own slot
-    // before deciding, so order cannot make a stale one answer.
-    if (await restoreDiscardedWaveEdit()) return;
     // Resolve any open editor BEFORE the .content-replacing swap below —
     // see the `activeEditor` / switchAwayFrom() comments near its
     // declaration for why this is required (undo/redo silently detaching an
@@ -15635,6 +16198,24 @@
     // first), so the undo that follows targets whatever is now the newest
     // op — which, if an auto-commit just happened, IS that commit.
     if (!(await switchAwayFrom())) return;
+    // Wave redesign Task 11 (spec section 4.8): the first Ctrl+Z after the wave
+    // editor closed takes that whole session back as one step, while nothing
+    // else has changed the document since. After the two stashes above on
+    // purpose: either of them can only exist because something was opened and
+    // discarded AFTER the close, so it is the newer thing to undo. And after
+    // switchAwayFrom() (Ruling R25): typing still sitting in an open editor is
+    // newer than the close too, and its commit replaces `lines`, which expires
+    // the offer. Spent here whether or not it held — an offer that did not
+    // hold now never will.
+    if (waveUndoOffer !== null) {
+      const held = waveUndoOfferValid();
+      const offer = waveUndoOffer;
+      waveUndoOffer = null;
+      if (held) {
+        const done = await undoWaveSession(offer);
+        if (done !== 'missing') return;
+      }
+    }
     const prevLines = lines;
     const r = stack.undo(lines);
     if (!r) return;
@@ -15679,6 +16260,19 @@
 
   async function redo() {
     if (!(await switchAwayFrom())) return;
+    // Wave redesign Task 11 (spec section 4.8: 可再被 Ctrl+Y 取消): while the
+    // stack stands where the whole-session undo left it, Ctrl+Y re-applies the
+    // session as one step (Ruling R24). A stack question, not an identity of
+    // `lines`: an ordinary Ctrl+Z / Ctrl+Y over an earlier edit comes back to
+    // the same stack, and the drawing still comes back whole after it. So the
+    // offer is NOT spent when it does not hold; it simply stops holding for
+    // good once a new edit clears the redo branch.
+    if (waveRedoOffer !== null && waveRedoOfferValid()) {
+      const ro = waveRedoOffer;
+      waveRedoOffer = null;
+      await redoWaveSession(ro);
+      return;
+    }
     const prevLines = lines;
     const r = stack.redo(lines);
     if (!r) return;
@@ -17453,6 +18047,38 @@
       e.target.classList.contains('ed-raw');
     if (inTextarea) return; // Ctrl+Enter/Esc handled by openRawEditor()'s own per-instance listener
 
+    // v3.13.1 T1: a key that edits or moves, pressed while a commit is in
+    // flight, would act on DOM the render is about to replace. Held, in order
+    // with the text around it, and replayed by flushFlightBuffer() through
+    // this same handler (see `commitFlight`). An IME's own keys (isComposing)
+    // are left alone. Escape drops everything held (R12) and then carries on
+    // to its usual meaning. A standing table cell range keeps its own keys —
+    // its Delete clears the range, which a held character delete would not.
+    if (flightActive() && !e.isComposing && !cellRangeBurst()) {
+      const flightSurface = flightSurfaceOf(e.target);
+      if (flightSurface && e.key === 'Escape') { flightBuffer.length = 0; flightSelMoved = false; }
+      // Ctrl/Cmd+Z with keys held: the most recent thing to undo is that
+      // typing, which never reached the document — dropping it IS the undo,
+      // and the commit in flight stays (the next Ctrl+Z, with nothing held,
+      // undoes it as usual). Measured before: the undo reverted the Enter
+      // underneath the held keys, and they replayed into the next item
+      // (`abccharlie`). Held navigation (and a click's focus entry) is not
+      // typing and stays; a dropped entry's position passes to the next kept
+      // entry of its run.
+      if (flightSurface && flightBuffer.some(isHeldTyping) && (e.ctrlKey || e.metaKey) && !e.shiftKey &&
+          !e.altKey && (e.key === 'z' || e.key === 'Z')) {
+        e.preventDefault();
+        dropHeldTyping();
+        return;
+      }
+      if (flightSurface && flightHoldsKey(e)) {
+        e.preventDefault();
+        holdFlightEntry(flightSurface, { kind: 'key', key: e.key, shiftKey: e.shiftKey,
+          ctrlKey: e.ctrlKey, altKey: e.altKey, metaKey: e.metaKey });
+        return;
+      }
+    }
+
     // Task 5: a table cell (class 'ed-wys-cell') owns its own Enter/Tab/
     // Escape/Ctrl+Z/Ctrl+Y contract, materially different from paragraph/
     // heading/list (Enter is an UNCONDITIONAL <br>, Tab moves the active
@@ -17693,7 +18319,7 @@
   // top of each listener below — see handleTableCellFocusIn() above.
   document.addEventListener('focusin', async (e) => {
     const cellEl = e.target && e.target.closest && e.target.closest('.ed-wys-cell');
-    if (cellEl) { await handleTableCellFocusIn(cellEl); return; }
+    if (cellEl) { await handleTableCellFocusIn(cellEl); scheduleFlightFlush(); return; }
     const editEl = e.target && e.target.closest && e.target.closest('.ed-wys-armed');
     if (!editEl) return;
     if (currentBurst && currentBurst.editEl === editEl) return; // already tracking
@@ -17704,7 +18330,17 @@
     // switchAwayFrom()'s single-flight `switching`. Await it before
     // starting a new burst so the two never race a concurrent commit.
     if (switching) await switching;
-    if (currentBurst) return; // a concurrent focusin already won the race
+    // v3.13.1 T1 fix round 2: focus may have moved on while this waited — an
+    // arrow walk lands on the NEXT block from inside that same resolution, and
+    // its own focusin is queued behind this one. Starting a burst here would
+    // open it on a surface that no longer has focus and leave the one that
+    // does without one: measured on base and head, Enter, `ab`, ArrowDown, `Z`
+    // put `Z` in charlie's DOM, and the blur that followed committed nothing.
+    if (document.body.contains(editEl) && !editEl.contains(document.activeElement)) {
+      scheduleFlightFlush();
+      return;
+    }
+    if (currentBurst) { scheduleFlightFlush(); return; } // a concurrent focusin already won the race
     let liveEditEl = editEl;
     if (!document.body.contains(editEl)) {
       // The awaited resolution above committed successfully and swapped the
@@ -17716,9 +18352,19 @@
       liveEditEl = liveBlockEl ? blockContentEl(liveBlockEl) : null;
       if (!liveEditEl || !liveEditEl.classList.contains('ed-wys-armed')) return;
       liveEditEl.focus();
+      // v3.13.1 R11: focus() alone puts the caret at the surface's start, not
+      // where the click that brought focus here put it. Measured on base and
+      // head, both engines: edit A, click mid-B, type — the characters landed
+      // at B's start; a drag or double-click selection collapsed. The
+      // selection was read just before the render replaced B (lastRenderSel).
+      if (lastRenderSel && lastRenderSel.surface === editEl) {
+        restoreSelection(liveEditEl, lastRenderSel.anchor, lastRenderSel.focus);
+      }
+      scheduleFlightFlush();
       return;
     }
     startBurst(liveEditEl);
+    scheduleFlightFlush();
   });
 
   document.addEventListener('focusout', (e) => {
@@ -17859,6 +18505,79 @@
     return currentBurst.history;
   }
 
+  // v3.13.1 T1: a pointer press into a surface during a flight moves the
+  // selection the user means the next held key for (see `flightSelMoved`).
+  // A press anywhere else — the toolbar, the margin — is not one.
+  // Capture phase: this runs before the press moves the selection, which is
+  // what pins the opening run to where it was typed (see pinFirstFlightRun()).
+  document.addEventListener('pointerdown', (e) => {
+    if (!flightActive()) return;
+    pinFirstFlightRun(selectionSnapshotIn(activeFlightSurface()));
+    if (flightSurfaceOf(e.target)) flightSelMoved = true;
+  }, true);
+
+  // v3.13.1 T1: the input half of the commit-in-flight guard (see
+  // `commitFlight`). Registered ahead of the native-format listener below,
+  // both in the capture phase, so a held keystroke never reaches it.
+  //
+  // `isComposing` insertText is skipped: an engine that reports a
+  // composition's commit that way also reports it to compositionend below,
+  // and the text must be held once.
+  function flightSurfaceOfEvent(e) {
+    return flightActive() ? flightSurfaceOf(e.target) : null;
+  }
+  // The text compositionend just held. An engine that inserts a
+  // composition's commit AFTER compositionend (WebKit's
+  // insertFromComposition) would put it in the DOM a second time; that
+  // insertion is cancelled, or taken back out on its input event when it
+  // cannot be cancelled. Cleared on the next task: the follow-up arrives in
+  // the same one or not at all.
+  let composedHeld = null;
+  let composedTakeBack = null;
+  document.addEventListener('beforeinput', (e) => {
+    if (composedHeld !== null && e.data === composedHeld &&
+        (e.inputType === 'insertFromComposition' || e.inputType === 'insertText')) {
+      composedHeld = null;
+      if (e.cancelable) e.preventDefault(); else composedTakeBack = e.data;
+      return;
+    }
+    const surface = flightSurfaceOfEvent(e);
+    if (!surface) return;
+    const t = e.inputType;
+    if ((t === 'insertText' || t === 'insertReplacementText') && !e.isComposing) {
+      // insertReplacementText (autocorrect, spellcheck) carries its text in
+      // dataTransfer in some engines and in `data` in others.
+      const data = e.data != null ? e.data
+        : (e.dataTransfer && e.dataTransfer.getData('text/plain')) || '';
+      e.preventDefault();
+      if (data) holdFlightEntry(surface, { kind: 'text', data });
+      return;
+    }
+    // A deletion that did not come from a held key (the keyboard ones are
+    // held at keydown — WebKit fires no beforeinput at all for Backspace on
+    // an empty surface, measured): a context-menu delete, say.
+    if (/^delete/.test(t) && t !== 'deleteByCut' && t !== 'deleteByDrag' && t !== 'deleteCompositionText') {
+      e.preventDefault();
+      holdFlightEntry(surface, { kind: 'delete', inputType: t });
+    }
+  }, true);
+  document.addEventListener('input', (e) => {
+    if (composedTakeBack !== null && e.data === composedTakeBack) takeBackComposedText(e.data);
+    composedTakeBack = null;
+  }, true);
+  // Known limit: a composition still open when the flight ends is left to
+  // the browser — its compositionend arrives with no flight to hold it, and
+  // if the render replaced the surface mid-composition, what the engine does
+  // with the rest of it is its own.
+  document.addEventListener('compositionend', (e) => {
+    const surface = flightSurfaceOfEvent(e);
+    if (!surface || !e.data) return;
+    takeBackComposedText(e.data);
+    holdFlightEntry(surface, { kind: 'text', data: e.data });
+    composedHeld = e.data;
+    setTimeout(() => { composedHeld = null; }, 0);
+  }, true);
+
   // Capture phase, matching the phase the ordering above was measured in.
   document.addEventListener('beforeinput', (e) => {
     if (!NATIVE_FORMAT_INPUT_TYPES.has(e.inputType)) return;
@@ -17925,10 +18644,35 @@
     // wave field is not — this is here so the boundary is one predicate rather
     // than a property of which targets those two selectors happen to match.
     if (waveEditorIsModal()) return;
-    const cellEl = e.target && e.target.closest && e.target.closest('.ed-wys-cell');
-    if (cellEl) {
+    // v3.13.1 T1 fix round 1: a paste while a commit is in flight is held like
+    // typing (measured before: lost outright) and replayed through
+    // routePaste(), the path a live paste takes. The clipboard is readable
+    // only during the event, so its flavours are copied out here.
+    const flightSurface = flightSurfaceOfEvent(e);
+    if (flightSurface) {
       e.preventDefault();
-      const dt = e.clipboardData || window.clipboardData;
+      holdFlightEntry(flightSurface, { kind: 'paste',
+        dt: snapshotClipboard(e.clipboardData || window.clipboardData), plainOnly: plainPasteArmed });
+      plainPasteArmed = false;
+      return;
+    }
+    const target = e.target && e.target.closest &&
+      (e.target.closest('.ed-wys-cell') || e.target.closest('.ed-wys-armed'));
+    if (!target) return;
+    e.preventDefault();
+    routePaste(target, e.clipboardData || window.clipboardData);
+  });
+  function snapshotClipboard(dt) {
+    const data = {};
+    ['text/plain', 'text/html'].forEach((k) => {
+      try { data[k] = dt ? dt.getData(k) || '' : ''; } catch (err) { data[k] = ''; }
+    });
+    const files = dt && dt.files ? Array.prototype.slice.call(dt.files) : [];
+    return { files, types: Object.keys(data).filter((k) => data[k]), getData: (k) => data[k] || '' };
+  }
+  function routePaste(target, dt) {
+    const cellEl = target.closest('.ed-wys-cell');
+    if (cellEl) {
       const grid = dt ? clipboardGrid(dt) : null;
       if (grid && pasteGridIntoTable(cellEl, grid)) return;
       snapBurstIfActive(cellEl.closest('table'), 'paste-pre');
@@ -17936,10 +18680,8 @@
       snapBurstIfActive(cellEl.closest('table'), 'paste');
       return;
     }
-    const editEl = e.target && e.target.closest && e.target.closest('.ed-wys-armed');
+    const editEl = target.closest('.ed-wys-armed');
     if (!editEl) return;
-    e.preventDefault();
-    const dt = e.clipboardData || window.clipboardData;
     // v3.1.0 追加 2: paste-md.js decides what the clipboard actually holds
     // (text/html -> markdown, an image, or plain text) and this routes the
     // answer. The TABLE-CELL branch above deliberately keeps its plain-text
@@ -17947,7 +18689,7 @@
     // pasted into one cell would be a nested structure the serializer has no
     // way to represent.
     handleArmedPaste(dt, editEl);
-  });
+  }
 
   // Task 5: hover-edge insert bubbles — one delegated, rAF-throttled
   // mousemove listener (never a per-block/per-boundary listener) drives
@@ -18760,16 +19502,18 @@
   //
   // Task 7's own fields, and why each is here rather than derived:
   //   ops        how many commits this session has pushed onto the document
-  //              stack. Escape reverses exactly this many — see
-  //              finishWaveSession().
+  //              stack since it last stood at its opening bytes. The net-zero
+  //              unwind (unwindWaveOps()) reverses exactly this many, and the
+  //              close's toast counts them (spec 4.8: N 處修改).
   //   baseLines  `lines` as it stood when the editor opened, and
-  //   baseBlocks `blocks` likewise. Escape restores both BY VALUE instead of
-  //              trusting the reversal's arithmetic to land back where it
-  //              started; the two are the same answer, and one of them cannot
-  //              be off by a line.
-  //   baseSource the block body the store was opened over, i.e. what `lines`
-  //              holds again once an Escape has run. The stash's staleness
-  //              guard compares against it.
+  //   baseBlocks `blocks` likewise. The net-zero unwind restores both BY
+  //              VALUE instead of trusting the reversal's arithmetic to land
+  //              back where it started; the two are the same answer, and one
+  //              of them cannot be off by a line.
+  //   baseSource the block body the store was opened over: what the net-zero
+  //              unwind compares against, and what the whole-session undo
+  //              after closing writes back (waveUndoOffer). The seam's own
+  //              copy, never the store's rebased source (Rulings R16/R17).
   //   unwritten  this session has a gesture the file could not express (the
   //              document-level flag `waveUnwrittenEdit` is the same fact; the
   //              flag is what documentIsDirty() reads, this is what the
@@ -18780,8 +19524,8 @@
   //              killed the arithmetic it replaces (fix 2 / MUST-FIX 1).
   //   baseRedoTail  the redo branch that existed before the session (fix 1 /
   //              F3). The session's first commit clears it like any other edit;
-  //              a session that is DISCARDED has to hand it back, or the user
-  //              silently loses a redo to a document that ends up
+  //              a session that is unwound to nothing has to hand it back, or
+  //              the user silently loses a redo to a document that ends up
   //              byte-identical.
   let waveSeam = null;
   // Gestures that arrived with no editor left to own them. Zero is the
@@ -18966,9 +19710,16 @@
     // button does nothing visible", never to a throw out of a click handler.
     if (!ui || !mods || !mods['wave-store.js'] || !mods['wave-codec.js'] ||
         !mods['wave-geometry.js'] || !mods['wave-draw.js'] ||
-        !mods['wave-panels.js']) return;
+        !mods['wave-panels.js'] || !mods['wave-canvas.js']) return;
     if (waveEditor !== null) return;
     hideWaveEditBtn();
+    // Spec section 6: no engine, no editor — a red card, never a blank canvas
+    // and never a fallback drawing of our own (the engine IS the canvas).
+    if (typeof WaveDrom === 'undefined' || WaveDrom === null ||
+        typeof WaveDrom.RenderWaveForm !== 'function') {
+      showError('波形引擎沒有載入，無法編輯', null, null);
+      return;
+    }
 
     // Settle the document BEFORE reading a single line out of it. An open
     // burst or block editor is committed here, deliberately in front of the
@@ -19048,6 +19799,13 @@
         geometry: mods['wave-geometry.js'],
         draw: mods['wave-draw.js'],
         panels: mods['wave-panels.js'],
+        // The engine canvas (wave redesign Task 6a) and the theme API it
+        // recolours with in dark (lib/theme/runtime.js).
+        canvas: mods['wave-canvas.js'],
+        theme: window.md2docTheme || null,
+        // Task 10: the overflow rule's `suggestScale` (lib/wave-overflow.js),
+        // for ⚙'s and the canvas chip's 「改每拍 K×」.
+        waveOverflow: mods['wave-overflow.js'] || null,
         createStore: mods['wave-store.js'].createStore,
         // The store's own answer to「哪一條 lane 是哪一條」across one operation,
         // handed over rather than re-derived: the editor's cell cursor and its
@@ -19057,12 +19815,24 @@
         // another.
         laneTrace: mods['wave-store.js'].laneTrace,
         wavedrom: (typeof WaveDrom !== 'undefined') ? WaveDrom : null,
+        // Spec section 4.8's two message levels, on this page's own banner:
+        // 'error' is the red card that stays, 'notice' the 4-second toast.
+        notify: (level, text, action) => {
+          const label = action && action.label ? action.label : null;
+          const run = action && typeof action.run === 'function' ? action.run : null;
+          if (level === 'error') showError(text, label, run);
+          else showWaveNotice(text, label !== null && run !== null ? label : null, run);
+        },
+        // The file's save state for the editor's title bar; later changes
+        // arrive through `waveSaveStatusSink` (setDirty()).
+        saveStatus: () => ({ dirty: documentIsDirty() }),
+        saveKeyHint: SAVE_KEY_HINT,
         onGesture: (info) => {
           if (waveSeam === null) { waveStrayGestures++; return; }
           waveSeam.lastGesture = info;
           writeWaveGestureBack(info);
         },
-        onClose: (reason) => {
+        onClose: () => {
           // Read the seam out and null BOTH before doing anything slow: the
           // predicate every global listener asks (`waveEditorIsModal()`) has to
           // answer "no" from this instant, and finishWaveSession() below awaits
@@ -19071,7 +19841,8 @@
           const seam = waveSeam;
           waveEditor = null;
           waveSeam = null;
-          finishWaveSession(seam, reason)
+          waveSaveStatusSink = null;
+          finishWaveSession(seam)
             // …and only then the keyboard, because the commit path RE-RENDERS
             // `.content` and every block element that existed when the overlay
             // was up is gone by the time that resolves. Focusing before the
@@ -19087,9 +19858,11 @@
     } catch (err) {
       waveEditor = null;
       waveSeam = null;
+      waveSaveStatusSink = null;
       throw err;
     }
     waveEditor = editor;
+    waveSaveStatusSink = typeof editor.setSaveStatus === 'function' ? editor.setSaveStatus : null;
     waveSeam = { blockId: id, startLine: body.startLine, endLine: body.endLine,
                  lastGesture: null, ops: 0, unwritten: false,
                  blockStartLine: block.startLine, blockEndLine: block.endLine,
@@ -19099,6 +19872,10 @@
     // A fresh session cannot inherit the previous one's unwritten work: that
     // session is over, and whatever it could not express went with it.
     waveUnwrittenEdit = false;
+    // Nor the previous session's whole-session undo: a new session takes over
+    // the block, and a Ctrl+Z after IT closes is about it alone.
+    waveUndoOffer = null;
+    waveRedoOffer = null;
   }
 
   // ── Task 7: one gesture, one write-back ────────────────────────────────
@@ -19119,16 +19896,15 @@
   // written directly. Two things fall out of that for free and are load-
   // bearing, not incidental: `stack.dirtyDepth` counts the waveform (so the
   // title dot, the save button and the beforeunload guard all see it without
-  // knowing what a waveform is), and Escape can take the session back off the
-  // stack rather than needing a stash of its own for the part that committed.
+  // knowing what a waveform is), and a session that comes back to its opening
+  // bytes can take its own ops back off the stack (unwindWaveOps()).
   //
   // What is deliberately NOT done here: re-rendering `.content`. The overlay
   // covers the document, a render replaces `.content` wholesale, and doing it
   // per paint would tear down and re-run WaveDrom on every gesture for a
   // picture nobody can see. `.content` therefore lags `lines` for exactly as
-  // long as the modal is up, and the session's close settles it — a commit by
-  // rendering, an Escape by putting `lines` back to what `.content` is still
-  // showing.
+  // long as the modal is up, and the session's close settles it by rendering
+  // (every route out of the editor keeps the drawing — spec section 4.8).
   function writeWaveGestureBack(info) {
     const seam = waveSeam;
     if (seam === null || !info || !info.patch) return;
@@ -19222,7 +19998,8 @@
     //
     // That is a FAMILY, not one caller: `addLaneFromToolbar` and 複製 have
     // written over the same refusal since before Task 16, and the rail's drag
-    // drop announces nothing at all. Re-ordering those says is behaviour, and
+    // drop announced nothing at all (since v3.13 the ⠿ grip's drop goes
+    // through `moveLaneTo`, which says where the lane landed). Re-ordering those says is behaviour, and
     // it is parked as a next-version follow-up rather than done here. So the
     // banner below is not a nicety layered on a status line that already said
     // it — it is the only part of the refusal that cannot be clobbered.
@@ -19357,12 +20134,6 @@
       });
   }
 
-  /**
-   * Settle a wave session that has just gone off screen.
-   *
-   * `reason` is wave-ui's, not inferred here: 'escape' means the user asked for
-   * the session to be thrown away, anything else means they kept it.
-   */
   /**
    * Give the keyboard back to the block the editor was opened over.
    *
@@ -19397,60 +20168,16 @@
     setBlockSelection({ anchorLine: b.startLine, focusLine: b.startLine });
   }
 
-  async function finishWaveSession(seam, reason) {
+  /**
+   * Settle a wave session that has just gone off screen.
+   *
+   * Every route out of the editor — ✕, 完成, Esc — keeps the session (spec
+   * section 4.8): each gesture was committed as it was drawn, so all that is
+   * left is the one render `.content` has been waiting for, and the offer
+   * that lets the next Ctrl+Z take the whole session back at once.
+   */
+  async function finishWaveSession(seam) {
     if (seam === null) return;
-    if (reason === 'escape') {
-      // Escape DISCARDS — the same word it means everywhere else in v3.3.0 —
-      // and here that has to reach the document stack, because the session has
-      // been committing all along.
-      const painted = bodyNow(seam);
-      const hadOps = seam.ops > 0;
-      if (!unwindWaveOps(seam)) {
-        // A Ctrl+S landed inside this session, so its commits cannot simply be
-        // popped — see unwindWaveOps() for the measured failure that produces.
-        // A revert COMMIT is the honest answer instead: the document goes back
-        // to where the session found it, and the stack only ever grows, so
-        // `dirtyDepth` stays strictly positive and can never walk back through
-        // zero over a document that differs from disk. The cost is a `●` the
-        // user clears with one Ctrl+S — which is TRUE, because disk is still
-        // holding the drawing they just discarded.
-        const result = commitRangeEdit({ lines, blocks, stack },
-          seam.startLine, seam.endLine, seam.baseSource);
-        if (result.op !== null) lines = result.lines;
-        blocks = seam.baseBlocks;
-        seam.endLine = seam.startLine + seam.baseSource.split('\n').length - 1;
-        // fix 2 (R1): the redo branch, on THIS path too. Both Escape branches
-        // end with `lines` byte-identical to `seam.baseLines` — only the seam
-        // range is ever written during a session — so the pre-session redo ops
-        // still address the document they were recorded against, and a user who
-        // lands here is otherwise in exactly F3's position: a byte-identical
-        // document with their redo silently eaten. AFTER the commit, because
-        // `push()` is what cleared it.
-        stack.setRedoTail(seam.baseRedoTail);
-      }
-      if (hadOps && painted !== seam.baseSource) {
-        // …and the discard is recoverable by exactly one Ctrl+Z. See
-        // discardedWaveEdit's own comment for which of discardedBurst's rules
-        // this reuses and which of them cannot apply here.
-        dropDiscardedBurst();
-        dropDiscardedRawEdit();
-        discardedWaveEdit = {
-          blockId: seam.blockId,
-          blockStartLine: seam.blockStartLine, blockEndLine: seam.blockEndLine,
-          startLine: seam.startLine, endLine: seam.endLine,
-          source: seam.baseSource, painted: painted,
-        };
-      }
-      // Work the file could not hold goes with the session it belonged to.
-      // The banner that said so is deliberately NOT dismissed here: it is the
-      // only record the user has that something did not survive.
-      waveUnwrittenEdit = false;
-      setDirty();
-      // No render. `.content` was never repainted while the overlay was up, so
-      // it is still showing exactly the base document just restored — rendering
-      // would be a round trip to say nothing.
-      return;
-    }
     if (seam.unwritten) {
       // Kept, with a hole in it. The user is told once more on the way out,
       // because the status line they were reading has just been removed from
@@ -19463,6 +20190,8 @@
       waveUnwrittenEdit = false;
       setDirty();
     }
+    // Nothing written (or the drawing came back to its opening bytes, which
+    // unwound the ops): no render, no toast, no offer.
     if (seam.ops === 0) return;
     // fix 1 (F2): `blocks` is settled from the session's own arithmetic BEFORE
     // the render, not instead of it. A successful render overwrites it with the
@@ -19497,61 +20226,150 @@
         '畫面沒有重畫成功，但你畫的波形還在文件裡（按 Ctrl+S 可以存檔，' +
         'Ctrl+Z 可以撤銷）。', null, null);
     }
+    // Wave redesign Task 11: the whole-session undo offer (see waveUndoOffer's
+    // own comment). Made AFTER the render rather than before it: an offer used
+    // while the close render is still in flight would start a second render
+    // racing this one. `lines` does not move across a render, so this is the
+    // array the close left either way. The keyboard's way in is Ctrl+Z (spec
+    // section 7.3: the keyboard goes back to the block, not to the toast); the
+    // toast's 整段復原 is the pointer's.
+    //
+    // Ruling R24: the offer pops the session's own entries, so it is made only
+    // when they are exactly the top `ops` of the stack. When they are not
+    // (nothing known reaches that today), the close still says what changed,
+    // without promising a one-step undo it could not keep.
+    waveRedoOffer = null;
+    if (stack.depth === seam.baseDepth + seam.ops) {
+      waveUndoOffer = { blockId: seam.blockId, startLine: seam.startLine, endLine: seam.endLine,
+                        baseSource: seam.baseSource, baseDepth: seam.baseDepth,
+                        lines: lines, depth: stack.depth, count: seam.ops };
+      showWaveNotice('波形已更新（' + seam.ops + ' 處修改）· Ctrl+Z 整段復原', '整段復原',
+        () => { revertWaveSessionFromToast(); });
+    } else {
+      showWaveNotice('波形已更新（' + seam.ops + ' 處修改）', null, null);
+    }
+  }
+
+  /** Whether the closed session's whole-session undo still describes the document. */
+  function waveUndoOfferValid() {
+    return waveOfferHolds(waveUndoOffer, { lines: lines, depth: stack.depth, burstOpen: burstHasUncommittedEdit() });
+  }
+  /** Whether the stack still stands where the whole-session undo left it, so
+   *  Ctrl+Y can re-apply the session as one step. */
+  function waveRedoOfferValid() {
+    return waveRedoHolds(waveRedoOffer, { depth: stack.depth, tail: stack.redoTail(), burstOpen: burstHasUncommittedEdit() });
+  }
+
+  /**
+   * The toast's 整段復原: the same step as Ctrl+Z, but only while the offer
+   * still holds. A press on a toast that outlived its offer must not fall
+   * through to an ordinary undo of somebody else's edit. An open editor is
+   * committed first, exactly as undo() does (Ruling R25).
+   */
+  async function revertWaveSessionFromToast() {
+    if (!(await switchAwayFrom())) return;
+    if (!waveUndoOfferValid()) {
+      waveUndoOffer = null;
+      showNotice('文件在關閉後又改過了，整段復原已經失效；請用 Ctrl+Z 一步一步退');
+      return;
+    }
+    const offer = waveUndoOffer;
+    waveUndoOffer = null;
+    await undoWaveSession(offer);
   }
 
   /**
-   * Ctrl+Z straight after an Escape out of the wave editor: put the discarded
-   * drawing back and re-open the editor over it.
+   * Spec section 4.8 / Ruling R24: take the closed session back as ONE user
+   * step by popping its own `count` entries off the document stack, then
+   * render once.
    *
-   * The restore is an ordinary commit, not a special case — so the reopened
-   * session opens over a document that already holds the drawing, one more
-   * Ctrl+Z steps back over the restore itself, and Ctrl+S saves it. That is
-   * the difference from restoreDiscardedRawEdit(), whose stashed value lives
-   * in a textarea until a later blur commits it: there is no "uncommitted
-   * surface" shape available here, because the wave editor's surface IS the
-   * document.
+   * A pop, not a commit. The first cut wrote the opening body back as an
+   * ordinary commit, and the stack then ping-ponged: the next Ctrl+Z popped
+   * that commit and the whole drawing came back, so an edit made before the
+   * session was count + 3 presses away. Popping keeps the stack linear (the
+   * next Ctrl+Z is whatever came before the session), the save marker honest,
+   * and Ctrl+Y re-applies the same entries (redoWaveSession()).
    *
-   * Staleness is asked at the `lines`/`blocks` level, the same level
-   * restoreDiscardedRawEdit() asks at and for the same reason — the overlay
-   * was removed from the DOM by `close()`, so there is no node whose presence
-   * could answer it.
+   * Why popping exactly `count` entries is the session: the caller has checked
+   * the offer holds (`lines` is still the array the close left and the stack
+   * the depth it left), and the offer was only made when that depth was
+   * `baseDepth + ops`. The opening body is still checked after the pops — a
+   * gesture that ever wrote other than one entry would show up there — and a
+   * mismatch puts the entries back and says so instead of writing anything.
+   *
+   * Returns 'done', 'refused' (nothing changed; already said) or 'missing'
+   * (the block is not in the map; said, and the caller undoes one step as
+   * usual).
    */
-  async function restoreDiscardedWaveEdit() {
-    const d = discardedWaveEdit;
-    discardedWaveEdit = null;
-    if (!d) return false;
-    const b = blocks.find((x) => x.id === d.blockId);
-    if (!b || b.startLine !== d.blockStartLine || b.endLine !== d.blockEndLine) return false;
-    if (lines.slice(d.startLine - 1, d.endLine).join('\n') !== d.source) return false;
+  async function undoWaveSession(offer) {
+    const b = blocks.find((x) => x.id === offer.blockId);
+    if (!b) {
+      showNotice('找不到剛才編輯的那張波形，沒辦法整段退回；這一下 Ctrl+Z 照常退一步');
+      return 'missing';
+    }
     const prevLines = lines;
-    const result = commitRangeEdit({ lines, blocks, stack },
-      d.startLine, d.endLine, d.painted);
-    if (result.op === null) return false;
-    lines = result.lines;
-    // `blocks` deliberately not reassigned — the same shape every other
-    // commit-then-render site in this file has: the render that follows is what
-    // replaces it, and rollbackFailedRender() below restores `lines` only, so
-    // an assignment here would survive a failed render as the one value nothing
-    // puts back.
-    setDirty();
-    const ok = await safeRerenderAll({
-      startLine: d.startLine,
-      endLine: d.startLine + d.painted.split('\n').length - 1,
-      delta: result.op.after.length - result.op.before.length,
+    const popped = [];
+    while (popped.length < offer.count) {
+      const r = stack.undo(lines);
+      if (!r) break;
+      lines = r.lines;
+      popped.push(r.op);
+    }
+    // `b` is from the map the close render made: the fence line has not moved
+    // (every gesture rewrote the body only), so the body starts right after it.
+    const n = offer.baseSource.split('\n').length;
+    const back = popped.length === offer.count &&
+      lines.slice(b.startLine, b.startLine + n).join('\n') === offer.baseSource;
+    if (back) setDirty();
+    const ok = back && await safeRerenderAll({
+      startLine: b.startLine + 1, endLine: b.startLine + n, delta: lines.length - prevLines.length,
     });
     if (!ok) {
-      lines = rollbackFailedRender({ lines, stack }, result, prevLines);
+      for (let i = 0; i < popped.length; i++) lines = stack.redo(lines).lines;
+      setDirty();
+      if (!back) {
+        showNotice('這次的波形修改沒辦法整段退回（文件的復原紀錄跟關閉時對不上），所以沒有動；' +
+          '請用 Ctrl+Z 一步一步退');
+      }
+      return 'refused';
+    }
+    waveRedoOffer = { baseDepth: offer.baseDepth, ops: popped, offer: offer };
+    showWaveNotice('已退回這次的波形修改', null, null);
+    return 'done';
+  }
+
+  /**
+   * Ctrl+Y while the stack stands where undoWaveSession() left it: re-apply
+   * the session's entries with stack.redo(), as one step, and render once. The
+   * document is then exactly where the close left it, so the whole-session
+   * undo is on offer again. waveRedoHolds() has checked that the top of the
+   * redo branch is those very entries, so the redos cannot come up short; if
+   * the render fails they are undone again.
+   */
+  async function redoWaveSession(ro) {
+    const prevLines = lines;
+    let done = 0;
+    while (done < ro.ops.length) {
+      const r = stack.redo(lines);
+      if (!r) break;
+      lines = r.lines;
+      done++;
+    }
+    let ok = done === ro.ops.length;
+    if (ok) {
+      setDirty();
+      const b = blocks.find((x) => x.id === ro.offer.blockId);
+      ok = await safeRerenderAll(b ? { startLine: b.startLine + 1, endLine: b.startLine + 1,
+        delta: lines.length - prevLines.length } : undefined);
+    }
+    if (!ok) {
+      for (let i = 0; i < done; i++) lines = stack.undo(lines).lines;
       setDirty();
       return false;
     }
-    // Re-open over the block the render just rebuilt. `openWaveEditor()` wants
-    // something INSIDE the block and resolves the block with `closest()`, and
-    // `closest()` matches the element itself — so the block element is a valid
-    // argument and does not depend on WaveDrom having finished painting a
-    // `.wavedrom-diagram` into it yet.
-    const blockEl = blockElById(d.blockId);
-    if (!blockEl) return true; // the drawing is back in the document either way
-    await openWaveEditor(blockEl);
+    waveUndoOffer = Object.assign({}, ro.offer, { lines: lines, depth: stack.depth });
+    showWaveNotice('波形修改已恢復 · Ctrl+Z 整段復原', '整段復原',
+      () => { revertWaveSessionFromToast(); });
     return true;
   }
 
@@ -19564,13 +20382,16 @@
     return {
       open: waveEditor !== null,
       stray: waveStrayGestures,
-      // Task 7's three: whether the document currently believes it has
+      // Task 7's two: whether the document currently believes it has
       // anything unsaved (the thing the Reload button's beforeunload guard
-      // asks), whether this session has work the file could not hold, and
-      // whether a discarded session is sitting there waiting for a Ctrl+Z.
+      // asks) and whether this session has work the file could not hold.
+      // Task 11's two: whether a closed session's whole-session undo is on
+      // offer and would hold now, and the same for its Ctrl+Y.
       dirty: documentIsDirty(),
       unwritten: waveUnwrittenEdit,
-      stashed: discardedWaveEdit !== null,
+      undoOffer: waveUndoOffer === null ? null
+        : { count: waveUndoOffer.count, blockId: waveUndoOffer.blockId, holds: waveUndoOfferValid() },
+      redoOffer: waveRedoOffer === null ? null : { holds: waveRedoOfferValid() },
       seam: waveSeam === null ? null : {
         blockId: waveSeam.blockId,
         startLine: waveSeam.startLine,