@helping-ai-workflow/md2doc 3.17.2 → 3.17.3

package/lib/editor/client.js

@@ -50,18 +50,115 @@
     return { lines: state.lines, blocks: state.blocks, op: null, refused: 'inverted-range' };
   }
 
+  // v3.17.3 N2b (R54): lines between two blocks that no block owns, a link
+  // reference definition today (blockmap.js hands each block the definition
+  // lines above it as `defLinesAbove`, distances above its startLine). A merge,
+  // a span delete or a span convert rewrites the range from its first block to
+  // its last, and every one of them used to drop such a line unseen: Backspace
+  // at the start of P. in '# D\n\nA.\n\n[r]: http://u\n\nP.\n' wrote
+  // '# D\n\nA.P.\n'. Both helpers below now keep them, so every path that
+  // commits a range is covered in one place. Groups of adjacent lines, in
+  // document order.
+  function definitionLinesIn(state, startLine, endLine) {
+    const at = [];
+    for (const b of state.blocks) {
+      const ds = b.defLinesAbove;
+      if (!Array.isArray(ds)) continue;
+      for (const d of ds) {
+        const n = b.startLine - d;
+        const text = state.lines[n - 1];
+        if (n >= startLine && n <= endLine && text !== undefined && text.trim() !== '') at.push(n);
+      }
+    }
+    at.sort((x, y) => x - y);
+    const groups = [];
+    let last = -1;
+    for (const n of at) {
+      if (n === last) continue;
+      if (groups.length && n === last + 1) {
+        const g = groups[groups.length - 1];
+        g.at.push(n); g.lines.push(state.lines[n - 1]);
+      } else groups.push({ at: [n], lines: [state.lines[n - 1]] });
+      last = n;
+    }
+    return groups;
+  }
+  // Fix round 1 (M3): a kept definition is written with its first line at
+  // column 0. Indented by one to three spaces it is still a definition where
+  // it stood, but written after a list it would become the last item's
+  // continuation ('- P.' then '  [r]: …' is one item, and deleting that item
+  // deleted the definition).
+  function definitionLinesToWrite(g) {
+    return [g.lines[0].replace(/^ {1,3}/, '')].concat(g.lines.slice(1));
+  }
+  // The range's lines without its definition lines, blank runs collapsed:
+  // what a structural rewrite that changed nothing hands back (M4).
+  function withoutDefinitionLines(state, startLine, endLine, groups) {
+    const skip = new Set();
+    groups.forEach((g) => g.at.forEach((n) => skip.add(n)));
+    const out = [];
+    for (let n = startLine; n <= endLine; n++) {
+      if (skip.has(n)) continue;
+      const l = state.lines[n - 1];
+      if (l.trim() === '' && out.length && out[out.length - 1].trim() === '') continue;
+      out.push(l);
+    }
+    return out;
+  }
+  function collapseBlankRuns(rows) {
+    return rows.filter((l, i) => !(l.trim() === '' && i > 0 && rows[i - 1].trim() === ''));
+  }
+  // `after` with the definition lines of startLine..endLine written AFTER
+  // its content, one blank line apart, before its own trailing blank lines.
+  // A blank line separates them from text on either side, so a paragraph
+  // cannot absorb them. `null`: the rewrite changed nothing but the
+  // definitions' absence (M4), so nothing is written.
+  //
+  // Fix round 3 (R56): no scan of `after` decides whether a definition is
+  // already in it — reading Markdown on the client is a second copy of
+  // marked's grammar, and it read '<!--' / '$' blocks wrongly. The caller
+  // says so instead: a gesture whose new text replays the lines between its
+  // blocks verbatim passes the carriesGap option (see the census row in
+  // test/editor-client.test.js for the callers allowed to); every other
+  // caller has the definitions appended. A missing flag costs a second copy,
+  // a wrong one the definition, so the flag is only for text that is built
+  // by slicing `lines` across every gap of the range.
+  function keepDefinitionLines(state, startLine, endLine, after) {
+    const groups = definitionLinesIn(state, startLine, endLine);
+    if (!groups.length) return after;
+    if (collapseBlankRuns(after).join('\n') === withoutDefinitionLines(state, startLine, endLine, groups).join('\n')) return null;
+    let tail = after.length;
+    while (tail > 0 && after[tail - 1] === '') tail--;
+    const out = after.slice(0, tail);
+    const prev = startLine >= 2 ? state.lines[startLine - 2] : undefined;
+    if (!out.length && prev !== undefined && prev.trim() !== '') out.push('');
+    for (const g of groups) {
+      if (out.length && out[out.length - 1] !== '') out.push('');
+      out.push(...definitionLinesToWrite(g));
+    }
+    const next = state.lines[endLine];
+    if (tail === after.length && next !== undefined && next.trim() !== '') out.push('');
+    return out.concat(after.slice(tail));
+  }
+
   // Pure: apply a raw-edit commit to an EXPLICIT line range (startLine..endLine,
   // 1-indexed inclusive); push onto stack.
   // Returns {lines, blocks, op}; op === null when text is unchanged.
   // The shift anchor is the LAST block whose endLine <= the range's endLine,
   // so that only blocks after the committed range are shifted — not blocks
   // inside it. Guards the no-anchor case (range before every block).
-  function commitRangeEdit(state, startLine, endLine, newText) {
+  // Fix round 1 (I1, R55): `opts.verbatim` is text the user wrote (the raw
+  // box, an in-place code edit): it replaces what it covers exactly, so a
+  // definition the user deleted or changed there is not kept as well.
+  // Fix round 3 (R56): `opts.carriesGap` is structural text that already
+  // holds every line between the range's blocks verbatim (keepDefinitionLines()).
+  function commitRangeEdit(state, startLine, endLine, newText, opts) {
     const refusal = refuseInvertedRange(state, 'commitRangeEdit', startLine, endLine);
     if (refusal) return refusal;
     const before = state.lines.slice(startLine - 1, endLine);
-    const after = newText.split('\n');
-    if (before.join('\n') === after.join('\n')) {
+    const typed = newText.split('\n');
+    const after = opts && (opts.verbatim || opts.carriesGap) ? typed : keepDefinitionLines(state, startLine, endLine, typed);
+    if (after === null || before.join('\n') === after.join('\n')) {
       return { lines: state.lines, blocks: state.blocks, op: null };
     }
     const op = { startLine, endLine, before, after };
@@ -75,9 +172,9 @@
   // Pure: apply a raw-edit commit to (lines, blocks); push onto stack.
   // Returns {lines, blocks, op}; op === null when text is unchanged.
   // Wrapper over commitRangeEdit: looks up the block by id and delegates.
-  function commitEdit(state, blockId, newText) {
+  function commitEdit(state, blockId, newText, opts) {
     const block = state.blocks.find((b) => b.id === blockId);
-    return commitRangeEdit(state, block.startLine, block.endLine, newText);
+    return commitRangeEdit(state, block.startLine, block.endLine, newText, opts);
   }
 
   // Generalized range removal: deletes startLine..endLine (zero lines) and
@@ -92,6 +189,14 @@
   function commitRangeRemoval(state, startLine, endLine) {
     const refusal = refuseInvertedRange(state, 'commitRangeRemoval', startLine, endLine);
     if (refusal) return refusal;
+    // v3.17.3 N2b: a span delete across a definition removes only the blocks'
+    // own lines; the definition stays where the span was, the blank lines
+    // around the span untouched. Same anchor, same single op.
+    const kept = definitionLinesIn(state, startLine, endLine);
+    if (kept.length) {
+      return commitRangeEdit(state, startLine, endLine,
+        kept.map((g) => definitionLinesToWrite(g).join('\n')).join('\n\n'), { carriesGap: true });
+    }
     const anchor = state.blocks.filter((b) => b.endLine <= endLine).pop();
     let sl = startLine, el = endLine;
     // state.lines[el] (0-indexed) is the line immediately AFTER the range.
@@ -128,7 +233,7 @@
     const refusal = refuseInvertedRange(state, 'commitTightRemoval', startLine, endLine);
     if (refusal) return refusal;
     const anchor = state.blocks.filter((b) => b.endLine <= endLine).pop();
-    const span = growOverBlanks(state.lines, startLine, endLine, 'both');
+    const span = growOverBlanks(state.lines, startLine, endLine, 'both', state.blocks);
     const before = state.lines.slice(span[0] - 1, span[1]);
     const op = { startLine: span[0], endLine: span[1], before, after: [] };
     const r = ops.replaceLines(state.lines, span[0], span[1], []);
@@ -278,6 +383,9 @@
   //   * no blocks at all — an empty or whitespace-only file. Its whole line
   //     range is replaced by [...newLines, ''], so the file ends with exactly
   //     one newline whatever blank lines it held.
+  //     v3.17.3 N2b (R54): or a file holding only link reference
+  //     definitions, which make no block; their lines are kept after the new
+  //     ones, one blank line apart.
   // Returns { lines, blocks, op, newStartLine }; op is null only for a
   // refusal (commitBlockInsertion()'s inverted-anchor case).
   function commitInsertionAt(state, anchorBlockId, newLines) {
@@ -292,7 +400,9 @@
         state.stack.push(op);
         return { lines: r.lines, blocks: state.blocks, op, newStartLine: 1 };
       }
-      const z = commitRangeEdit(state, 1, state.lines.length, newLines.concat(['']).join('\n'));
+      const kept = state.lines.filter((l) => l.trim() !== '');
+      const z = commitRangeEdit(state, 1, state.lines.length,
+        newLines.concat(kept.length ? [''].concat(kept, ['']) : ['']).join('\n'));
       return { lines: z.lines, blocks: z.blocks, op: z.op, newStartLine: 1 };
     }
     const first = state.blocks[0];
@@ -329,14 +439,28 @@
   // 'below', R58) grows op 2 over the blank lines to that side.
   // v3.15.0 B2 fix round 1 (R58): `start..end` grown over the blank lines
   // right above it (`side` 'above'), right below it ('below') or both ('both',
-  // R62). Every line
-  // between two blocks is blank by construction, so this is the separator to
-  // the neighbouring block — the one a list item eats to join that list tight.
-  function growOverBlanks(lines, start, end, side) {
+  // R62): the separator to the neighbouring block, the one a list item eats to
+  // join that list tight. Final review I1 (R54): the lines between two blocks
+  // are NOT all blank — a link reference definition is on lines no block owns
+  // (blockmap.js, `defLinesAbove`). So a side is grown only when its blank run
+  // reaches a block of `blocks` exactly (the block above ends on the line
+  // before the run, the block below starts on the line after it) or the end
+  // of the file. A run that stops at an unowned line is left as it is: eating
+  // it made `- Intro` then `[r]: http://u` one item, the definition its text.
+  function growOverBlanks(lines, start, end, side, blocks) {
+    const bs = Array.isArray(blocks) ? blocks : [];
     let s = start;
     let e = end;
-    if (side === 'above' || side === 'both') while (s >= 2 && String(lines[s - 2]).trim() === '') s--;
-    if (side === 'below' || side === 'both') while (e < lines.length && String(lines[e]).trim() === '') e++;
+    if (side === 'above' || side === 'both') {
+      let k = s;
+      while (k >= 2 && String(lines[k - 2]).trim() === '') k--;
+      if (k === 1 || bs.some((b) => b.endLine === k - 1)) s = k;
+    }
+    if (side === 'below' || side === 'both') {
+      let k = e;
+      while (k < lines.length && String(lines[k]).trim() === '') k++;
+      if (k === lines.length || bs.some((b) => b.startLine === k + 1)) e = k;
+    }
     return [s, e];
   }
 
@@ -350,7 +474,11 @@
     return { lines: r.lines, blocks: r.blocks, op: r.op, newStartLine: before ? at : at + 1 };
   }
 
-  function commitShortcut(state, at, literalLines, convertedLines, join) {
+  // v3.17.3 N4 (R41): `tail` ({ range, md }, renumberedRunFrom()) is the
+  // ordered list right below, renumbered: op 2 also replaces its lines when
+  // they still follow op 2's range unchanged, so the join and the new numbers
+  // are one step. `tailEnd` (its last line before the ops) is reported then.
+  function commitShortcut(state, at, literalLines, convertedLines, join, tail) {
     let first;
     let start;
     if (at && at.blockId !== undefined && at.blockId !== null) {
@@ -367,8 +495,21 @@
     const mid = { lines: first.lines, blocks: first.blocks, stack: state.stack };
     // R58: a list item joining the list above or below takes the separator
     // between the two into op 2's range, so the list stays tight.
-    const span = growOverBlanks(mid.lines, start, start + literalLines.length - 1, join || null);
-    const second = commitRangeEdit(mid, span[0], span[1], convertedLines.join('\n'));
+    const span = growOverBlanks(mid.lines, start, start + literalLines.length - 1, join || null, mid.blocks);
+    let spanEnd = span[1];
+    let text = convertedLines.join('\n');
+    let tailEnd = null;
+    if (tail && tail.range && typeof tail.md === 'string') {
+      const n = tail.range.endLine - tail.range.startLine + 1;
+      const before = state.lines.slice(tail.range.startLine - 1, tail.range.endLine);
+      const here = mid.lines.slice(span[1], span[1] + n);
+      if (n > 0 && here.length === n && here.every((l, k) => l === before[k])) {
+        spanEnd = span[1] + n;
+        text += '\n' + tail.md;
+        tailEnd = tail.range.endLine;
+      }
+    }
+    const second = commitRangeEdit(mid, span[0], spanEnd, text);
     if (second.op === null) {
       // Nothing to convert (cannot happen for a real marker: the literal is
       // escaped and the conversion is not). Op 1 alone is not a shortcut, so
@@ -377,7 +518,7 @@
       return { lines: state.lines, blocks: state.blocks, ops: [null, null], newStartLine: null };
     }
     return { lines: second.lines, blocks: second.blocks, ops: [first.op, second.op],
-      newStartLine: span[0], literalStartLine: start };
+      newStartLine: span[0], literalStartLine: start, tailEnd: tailEnd };
   }
 
   // ── S4 Task 3: relocating ONE block's lines (spec §4.5) ────────────────
@@ -483,7 +624,10 @@
     if (!plan) {
       return { lines: state.lines, blocks: state.blocks, op: null, noop: 'same-position' };
     }
-    const r = commitRangeEdit(state, plan.startLine, plan.endLine, plan.after.join('\n'));
+    // R56: planBlockMove() builds `after` by slicing `lines` — the source's
+    // own span, everything between source and destination — so every
+    // definition line of the range is in it, where it stood.
+    const r = commitRangeEdit(state, plan.startLine, plan.endLine, plan.after.join('\n'), { carriesGap: true });
     r.newRange = plan.newRange;
     return r;
   }
@@ -1421,8 +1565,19 @@
     // v3.17.2 B1 (v3.17.0 final review T2 L74): and so is the text typed into
     // an open raw box. Measured before: type in the box, and the status
     // read clean and a tab close raised no dialog — the typing was lost.
+    // v3.17.3 C8: and so is alt text typed into the image toolbar's field and
+    // not yet applied (Enter). Measured before: the status read clean and a
+    // tab close raised no dialog.
     return stack.isDirty() || burstHasUncommittedEdit() || waveUnwrittenEdit || pendingStructure !== null ||
-      codeEditHasUncommittedText() || diagramPanelHasUncommittedText() || rawEditHasUncommittedText();
+      codeEditHasUncommittedText() || diagramPanelHasUncommittedText() || rawEditHasUncommittedText() ||
+      imgTbHasPendingAlt();
+  }
+  // Guarded the way its neighbours are: documentIsDirty() also runs in the
+  // beforeunload handler, and the toolbar's state is declared far below.
+  function imgTbHasPendingAlt() {
+    try {
+      return !!imgTbAlt && !imgTbInput.hidden && imgTbInput.value !== imgTbAlt.original;
+    } catch (e) { return false; }
   }
   // Guarded the same way, for the same reason (the beforeunload handler).
   function rawEditHasUncommittedText() {
@@ -2244,14 +2399,19 @@
                       absorbedOutsideContent(lastRenderLines, blocks,
                                              lines, j.blocks,
                                              j.blocks[j.blocks.length - 1]);
-    const plan = (editRange && window.md2docPatchmap && !lastPartsIsBootstrapSeed && domMatchesLastRender())
+    // v3.17.3 B10: read against the blocks the transient was placed among,
+    // before applyFullRender() replaces them. A transient on screen is a child
+    // the last render did not draw, so domMatchesLastRender() is false and
+    // this render is always the full one.
+    const keptTransient = transientKeptThroughRender(editRange, isReconcile);
+    const plan = (!keptTransient && editRange && window.md2docPatchmap && !lastPartsIsBootstrapSeed && domMatchesLastRender())
       ? window.md2docPatchmap.patchmap({
           oldBlocks: blocks, newBlocks: j.blocks,
           oldParts: lastParts, newParts: j.parts, editRange: editRange,
         })
       : null;
     const ok = plan ? await applyPatch(j, plan, declaredRange)
-                    : await applyFullRender(j, scrollY, declaredRange);
+                    : await applyFullRender(j, scrollY, declaredRange, keptTransient);
     // applyPatch() 與 applyFullRender() 今天都只回 true：applyFullRender() 全函
     // 式唯一的 return 就是尾端
     // 那個 `return true`，而 applyPatch() 要嘛回 true、要嘛在自己的 catch 裡
@@ -2893,7 +3053,7 @@
     return true;
   }
 
-  async function applyFullRender(j, scrollY, declaredRange) {
+  async function applyFullRender(j, scrollY, declaredRange, keptTransient) {
     blocks = j.blocks;
     lastParts = j.parts;                       // v3.2.0: 供下一次 patch 當 oldParts
     lastPartsIsBootstrapSeed = false;
@@ -2928,8 +3088,10 @@
     // fresh assignment.
     pristineInsert = null;
     // v3.14.0 T1: the transient lived in the `.content` children the
-    // innerHTML write above just replaced — every render drops it (D3).
+    // innerHTML write above just replaced — every render drops it (D3),
+    // except the one transientKeptThroughRender() kept (v3.17.3 B10).
     transient = null;
+    if (keptTransient) restoreKeptTransient(keptTransient);
     // Task 2 (Phase 3): same belt-and-braces reasoning for the always-on
     // WYSIWYG burst — whatever block had one open a moment ago was just
     // detached by the innerHTML replacement above, so its own focusout
@@ -3061,10 +3223,79 @@
       }
     }
     reapDiagramPanel(); // T10: a panel this render took away is disposed here
+    // v3.17.3 B10: last, after every teardown above (the burst one would
+    // dispose the burst this focus opens).
+    if (keptTransient && keptTransient.focused && transient === keptTransient.t) focusTransientStart(transient.el);
     setDirty();
     return true;
   }
 
+  // ── v3.17.3 B10: which transient a render keeps ───────────────────────
+  //
+  // A render replaces every `.content` child, so it used to drop the
+  // transient with them (D3). That took away the empty paragraph an Enter at
+  // a block's start leaves ABOVE the caret as soon as the block below it was
+  // committed: measured, Enter at `Omega.`'s start, type X, then ArrowUp —
+  // the paragraph was gone and the caret landed in `Alpha.` at offset 1; a
+  // click on it instead left focus on the body. This is the one rule for that
+  // (Task 7's nested-list commit goes through it too): an EMPTY transient
+  // whose whole neighbourhood above sits before the render's edit — the
+  // edit starts at or below the first real block after it — is the same
+  // element after the render, back after the block it followed (the lines
+  // above the edit do not move, so that block keeps its start line), still
+  // `transient`, and focused again if it had focus. Anything else is dropped
+  // as before: a transient with text is committed by its own path, never
+  // rendered over; an edit at or above it may have moved or removed the block
+  // it follows; a reconciliation redraw restores no transient.
+  // R29 (fix round 1): and only while the user is still at it — focus is in
+  // the transient, or in the block right below it that this render commits
+  // (the caret an Enter at that block's start left there; an ArrowUp held
+  // behind the commit still has it there when this runs). A transient the
+  // user has left (a press into another block) is not kept: it was never
+  // written, so it goes as an empty transient that was left goes (D3), and
+  // while one stands on screen every render is a full one
+  // (domMatchesLastRender()).
+  //   → null, or { t, anchorLine, focused }; anchorLine null = top of
+  //     `.content`.
+  function transientKeptThroughRender(editRange, isReconcile) {
+    const t = transient;
+    if (!t || isReconcile || !editRange || !t.el.isConnected || t.el.parentNode !== contentEl) return null;
+    if (!transientSurfaceEmpty(t.el) || transientIsOnlyBlock(t.el)) return null;
+    const realSibling = (step) => {
+      let n = step(t.el);
+      while (n && !(n.classList.contains('ed-block') && n.getAttribute('data-block-id') !== null)) n = step(n);
+      return n;
+    };
+    const belowEl = realSibling((n) => n.nextElementSibling);
+    const below = blockRecOf(belowEl);
+    if (!below || editRange.startLine < below.startLine) return null;
+    const ae = document.activeElement;
+    if (!ae || !(t.el.contains(ae) || belowEl.contains(ae))) return null;
+    const aboveEl = realSibling((n) => n.previousElementSibling);
+    const above = aboveEl ? blockRecOf(aboveEl) : null;
+    if (aboveEl && !above) return null;
+    return { t, anchorLine: above ? above.startLine : null, focused: t.el.contains(document.activeElement) };
+  }
+  // applyFullRender()'s half, against the new `blocks`: the element goes back
+  // right after the block now starting at `anchorLine`. A block no longer
+  // there leaves it dropped.
+  function restoreKeptTransient(kept) {
+    const el = kept.t.el;
+    const after = kept.anchorLine === null ? null : blockElAtLine(kept.anchorLine);
+    if (kept.anchorLine !== null && !after) return;
+    if (after) after.parentNode.insertBefore(el, after.nextSibling);
+    else contentEl.insertBefore(el, contentEl.firstChild);
+    // M1 (fix round 1): `stayEl` is nulled, not re-pointed at the block now
+    // below. burstUndo() reads it as "Ctrl+Z in that block takes the
+    // transient away as the Enter's undo step", which holds only while
+    // nothing has been committed since the Enter. This render committed
+    // something (it has an editRange), so the next Ctrl+Z belongs to that
+    // newer op; taking the older Enter's transient first would undo out of
+    // order. The transient goes when it is left (D3).
+    kept.t.stayEl = null;
+    transient = kept.t;
+  }
+
   // ── v3.15.0 T4 (D12, R9): diagram engines on demand ────────────────────
   //
   // The edit page inlines Mermaid / WaveDrom / the KaTeX stylesheet only when
@@ -4118,6 +4349,10 @@
   // answer — the "/" menu's 引用 opens the box seeded `> ` with the caret at
   // its end. hasChanges() compares against it, so a box left untouched stays
   // pristine.
+  // v3.17.3 fix round 1 (R47): the raw box textarea whose commit is
+  // rendering (its text is already in `lines`), or null. The keydown handler
+  // sends its Ctrl+Z / Ctrl+Y to the document instead of the box.
+  let rawBoxCommitting = null;
   async function openRawEditor(blockEl, range, seedOverride) {
     if (blockEl.querySelector('.ed-raw')) return; // already editing this block
     // Task G fix round 1 (npm test RED on f63c88a): the guard below used to
@@ -4420,8 +4655,8 @@
       // delegates), so the two branches are the same pipeline — replaceLines()
       // + one undo op — differing only in which lines they name.
       const result = rangeMode
-        ? commitRangeEdit({ lines, blocks, stack }, startLine, endLine, ta.value)
-        : commitEdit({ lines, blocks, stack }, blockId, ta.value);
+        ? commitRangeEdit({ lines, blocks, stack }, startLine, endLine, ta.value, { verbatim: true })
+        : commitEdit({ lines, blocks, stack }, blockId, ta.value, { verbatim: true });
       if (result.op === null) {
         // §10-gap fix (review): an explicit commit (Ctrl+Enter/✓) whose
         // text happens to be byte-identical to `source` is still an
@@ -4436,7 +4671,14 @@
             endLine: Math.max(result.op.startLine - 1, result.op.endLine),
             delta: result.op.after.length - result.op.before.length }
         : undefined;
-      const ok = await safeRerenderAll(editRange);
+      // R47: see `rawBoxCommitting`.
+      rawBoxCommitting = ta;
+      let ok;
+      try {
+        ok = await safeRerenderAll(editRange);
+      } finally {
+        if (rawBoxCommitting === ta) rawBoxCommitting = null;
+      }
       if (!ok) {
         // Roll back the optimistic edit: pop the op safeRerenderAll's
         // failure means was never actually rendered, so `lines` stays
@@ -4804,6 +5046,22 @@
     }, () => {});
   }
 
+  // v3.17.3 C2: a click lands in the RENDERED text, where the fence's indent
+  // is already stripped from every line; the edit's text is the body with the
+  // indent still on each line. Add the stripped width of every line up to the
+  // click's line back. Lines that do not pair up (never today) leave the
+  // offset as measured.
+  function codeEditBodyOffset(rendered, bodyLines, off) {
+    const rl = String(rendered).split('\n');
+    if (rl.length !== bodyLines.length) return off;
+    let line = 0;
+    let left = off;
+    while (line < rl.length - 1 && left > rl[line].length) { left -= rl[line].length + 1; line++; }
+    let add = 0;
+    for (let i = 0; i <= line; i++) add += Math.max(0, bodyLines[i].length - rl[i].length);
+    return off + add;
+  }
+
   // Opens the edit on `blockEl` with the caret at `opts.offset` (default 0)
   // or under the click point `opts.clientX/clientY`. false when the block is
   // not a fenced code block (the caller opens the raw box instead); true
@@ -4847,6 +5105,7 @@
     const host = blockEl.firstElementChild;
     const body = fence.body.join('\n');
     let caret = o.clientX !== undefined ? codeCaretFromPoint(host, o.clientX, o.clientY) : null;
+    if (caret !== null) caret = codeEditBodyOffset(host.textContent, fence.body, caret);
     if (caret === null) caret = o.offset || 0;
     caret = Math.max(0, Math.min(body.length, caret));
     const s = {
@@ -5018,7 +5277,7 @@
   // text. RENDER_SUPERSEDED: not success yet, the caller touches no DOM. true:
   // rendered.
   async function commitFencedRangeAndRender(startLine, endLine, text) {
-    const result = commitRangeEdit({ lines, blocks, stack }, startLine, endLine, text);
+    const result = commitRangeEdit({ lines, blocks, stack }, startLine, endLine, text, { verbatim: true });
     if (result.op === null) return null;
     const prevLines = lines;
     lines = result.lines;
@@ -5916,7 +6175,30 @@
   // Enter made the item) takes the spacing of the list it joins, which the
   // renderer stamped from marked's own looseness as data-list-loose.
   function serializeListEls(els, opts) {
-    return listMd.serializeBlocks(els, Object.assign({ blankBefore: looseBlankBefore }, opts || {}));
+    return listMd.serializeBlocks(els, Object.assign({ blankBefore: looseBlankBefore,
+      sourceMarker: sourceMarkerOf }, opts || {}));
+  }
+  // v3.17.3 A9 (R5): the bullet character / ordinal delimiter this block's
+  // own marker has in the file ('-', '*', '+', '.', ')'), or null for a block
+  // with no record (an item just made). list-md.js asks it for every item it
+  // re-serialises — a carried one answers from its carried line — and writes
+  // each run in the style most of its items have, so an edit to `* b` no
+  // longer rewrites the list as `- `. A zero-line block (the outer item of a
+  // same-line nest, `- * b`) has its marker on the line of the item that owns
+  // it, at its own depth's place in that line's marker chain.
+  function sourceMarkerOf(el) {
+    const rec = blockRecOf(el);
+    if (!rec) return null;
+    const chain = sourceMarkerChain(lines[rec.startLine - 1]);
+    if (!chain.length) return null;
+    let at = chain.length - 1;
+    if (rec.endLine < rec.startLine) {
+      const owner = blocks.find((b) => b.startLine === rec.startLine && b.endLine >= b.startLine);
+      if (!owner) return null;
+      at = chain.length - 1 - (owner.indent - rec.indent);
+      if (at < 0) return null;
+    }
+    return chain[at].bullet || chain[at].delim || null;
   }
   function looseBlankBefore(el, prevEl) {
     if (!prevEl) return false;
@@ -8689,8 +8971,13 @@
     const original = currentBurst && currentBurst.blockEl === blockEl ? currentBurst.original : null;
     if (currentBurst && currentBurst.blockEl === blockEl) endBurstWithoutResolve();
     // R58 (`joinSide`): the blank lines to the list being joined go too.
-    const range = growOverBlanks(lines, block.startLine, block.endLine, joinSide || null);
-    const result = commitRangeEdit({ lines, blocks, stack }, range[0], range[1], newLines.join('\n'));
+    // v3.17.3 A6: no lines at all is a removal (the dismissed 圖片 picker),
+    // the paragraph and one blank line with it, like removeEmptiedParagraph().
+    const range = newLines.length === 0 ? [block.startLine, block.endLine]
+      : growOverBlanks(lines, block.startLine, block.endLine, joinSide || null, blocks);
+    const result = newLines.length === 0
+      ? commitRangeRemoval({ lines, blocks, stack }, range[0], range[1])
+      : commitRangeEdit({ lines, blocks, stack }, range[0], range[1], newLines.join('\n'));
     if (result.op === null) return null;
     const prevLines = lines;
     lines = result.lines;
@@ -8742,6 +9029,17 @@
       });
       const startLine = await replaceParagraphWithLines(live, liveSurface, newLines);
       if (startLine !== null) focusBlockAtLine(startLine, true);
+    }, {
+      // v3.17.3 A6 (R8): a dismissed dialog consumes the "/圖片" text, by the
+      // commit the picked file would have made, minus the image. A paragraph
+      // that was edited meanwhile, or that cannot be found again, is left alone.
+      onCancel: async () => {
+        const live = refindBlock(blockEl, identity, selfSession);
+        const liveSurface = live ? blockContentEl(live) : null;
+        if (!liveSurface || slashSurfaceText(liveSurface) !== typed) return;
+        const startLine = await replaceParagraphWithLines(live, liveSurface, []);
+        if (startLine !== null) focusBlockAtLine(startLine, true);
+      },
     });
   }
 
@@ -8860,8 +9158,13 @@
       }
       const join = isListKind(match.kind) ? listJoinOf(blockEl, match.kind) : null;
       const lines2 = join ? listJoinLines(join, match.kind, rest === '' ? [] : rest.split('\n')) : converted;
+      // v3.17.3 N4 (R41): an ordered item joining the ordered list below
+      // (same delimiter) renumbers it in op 2 — renumberedRunFrom(), A7's.
+      const belowJoin = !join ? null : join.side === 'below' ? join : join.side === 'both' ? join.below : null;
+      const tail = match.kind === 'ol' && belowJoin && belowJoin.delim === join.delim
+        ? renumberedRunFrom(belowJoin.run, join.ordinal + 1) : null;
       await commitShortcutAt(blockEl, surface, isT, match, literal.split('\n'), lines2, markerLen,
-        join ? join.side : null);
+        join ? join.side : null, tail);
     } finally {
       if (rawBoxKind) shortcutRawBoxFlight = false;
       endCommitFlight();
@@ -8901,6 +9204,20 @@
     const all = allBlockEls().filter((el) => el === blockEl || !el.hasAttribute('data-ed-transient'));
     const i = all.indexOf(blockEl);
     if (i < 0) return null;
+    // Final review I1 (R54): the lines this item is written over (a real
+    // block's own) or after (a transient's: right after its anchor, or before
+    // the first block, as commitInsertionAt() writes it). A neighbour list with
+    // a line that is not blank in between (a link reference definition, which
+    // no block owns) is a separate list in the file: joining it would write
+    // over that line or past it, so that side does not join.
+    const ownRec = blockRecOf(blockEl);
+    const anchorRec = ownRec ? null : blockRecOf(transientAnchorEl(blockEl));
+    const ownBottom = ownRec ? ownRec.endLine : anchorRec ? anchorRec.endLine : (blocks.length ? blocks[0].startLine - 1 : 0);
+    const ownTop = ownRec ? ownRec.startLine : ownBottom + 1;
+    const gapIsBlank = (from, to) => {
+      for (let n = from; n <= to; n++) if (String(lines[n - 1] === undefined ? '' : lines[n - 1]).trim() !== '') return false;
+      return true;
+    };
     const sideOf = (el, above) => {
       if (!el || el.getAttribute('data-block-type') !== 'li' || el.getAttribute('data-block-id') === null) return null;
       if (!above && (Number(el.getAttribute('data-indent')) || 0) !== 0) return null;
@@ -8915,11 +9232,12 @@
       const refRec = blockRecOf(ref);
       const edgeRec = blockRecOf(el);
       if (!refRec || !edgeRec || refRec.endLine < refRec.startLine || edgeRec.endLine < edgeRec.startLine) return null;
+      if (above ? !gapIsBlank(edgeRec.endLine + 1, ownTop - 1) : !gapIsBlank(ownBottom + 1, edgeRec.startLine - 1)) return null;
       const m = /^(?:([-*+])|(\d{1,9})([.)]))(?:[ \t]|$)/.exec(lines[refRec.startLine - 1] || '');
       if (!m) return null;
       return { side: above ? 'above' : 'below', bullet: m[1] || '-',
         ordinal: m[2] ? Number(m[2]) + (above ? 1 : 0) : 1, delim: m[3] || '.',
-        at: above ? edgeRec.endLine : edgeRec.startLine };
+        at: above ? edgeRec.endLine : edgeRec.startLine, run: run };
     };
     const above = sideOf(all[i - 1], true);
     const below = sideOf(all[i + 1], false);
@@ -8939,11 +9257,12 @@
       // writes it at the top level, and in an ordered list the empty path
       // renumbers while this one keeps the number typed.
       const oneList = isTransient(blockEl) && all[i + 1].getAttribute('data-list-start') !== '1';
-      if (!oneList) return Object.assign(above, { side: 'both' });
+      // v3.17.3 N4: `below` names the list below for the shortcut's renumbering.
+      if (!oneList) return Object.assign(above, { side: 'both', below: below });
       const aRec = blockRecOf(all[i - 1]);
       const bRec = blockRecOf(all[i + 1]);
       const tight = !!(aRec && bRec && bRec.startLine === aRec.endLine + 1);
-      return tight ? Object.assign(above, { side: 'both' }) : null;
+      return tight ? Object.assign(above, { side: 'both', below: below }) : null;
     }
     return above || below;
   }
@@ -8992,7 +9311,7 @@
     await landSlashItem(result.newStartLine, item, true);
   }
 
-  async function commitShortcutAt(blockEl, surface, isT, match, literalLines, converted, markerLen, join) {
+  async function commitShortcutAt(blockEl, surface, isT, match, literalLines, converted, markerLen, join, tail) {
     let at;
     if (isT) {
       const anchorEl = transientAnchorEl(blockEl);
@@ -9006,7 +9325,7 @@
     }
     const rec = isT ? null : blocks.find((b) => b.id === at.blockId);
     if (!isT && !rec) return;
-    const r = commitShortcut({ lines, blocks, stack }, at, literalLines, converted, join);
+    const r = commitShortcut({ lines, blocks, stack }, at, literalLines, converted, join, tail || null);
     const op1 = r.ops[0];
     const op2 = r.ops[1];
     if (!op2) return;
@@ -9017,13 +9336,13 @@
     if (isT) {
       const first = op1 || op2;
       editRange = { startLine: Math.min(first.startLine, first.endLine + 1),
-        endLine: Math.max(first.startLine - 1, first.endLine), delta };
+        endLine: Math.max(first.startLine - 1, first.endLine, r.tailEnd || 0), delta };
       const shifted = {};
       blocks.forEach((b) => { if (b.startLine >= first.startLine) shifted[b.id] = b.startLine + delta; });
       pendingFlightLineMap = { ids: shifted, provisional: r.newStartLine };
     } else {
-      const grown = growOverBlanks(prevLines, rec.startLine, rec.endLine, join || null);
-      editRange = { startLine: grown[0], endLine: grown[1], delta };
+      const grown = growOverBlanks(prevLines, rec.startLine, rec.endLine, join || null, blocks);
+      editRange = { startLine: grown[0], endLine: Math.max(grown[1], r.tailEnd || 0), delta };
       pendingFlightLineMap = { ids: { [rec.id]: r.newStartLine }, provisional: r.newStartLine };
     }
     const original = !isT && currentBurst && currentBurst.blockEl === blockEl ? currentBurst.original : null;
@@ -9293,8 +9612,10 @@
   // R4: the text a paragraph / heading surface commits as — the heading's
   // own `#` run in front, a paragraph's line-start markers escaped (F-1).
   // resolveBurst() uses the same rule; split and merge serialize through it.
+  // The closing-sequence escape lives in convert-md.js (the block menu uses it too).
+  function escapeClosingHashes(md) { return convertMd.escapeClosingHashes(md); }
   function commitTextOf(md, blockType, depth) {
-    if (blockType === 'heading') return md === '' ? '#'.repeat(depth) : '#'.repeat(depth) + ' ' + md;
+    if (blockType === 'heading') return md === '' ? '#'.repeat(depth) : '#'.repeat(depth) + ' ' + escapeClosingHashes(md);
     return blockType === 'paragraph' ? inlineMd.escapeBlockStarts(md) : md;
   }
   function surfaceCommitText(surface, blockType, depth) {
@@ -9443,15 +9764,23 @@
     }
     if (place === 'middle') { await splitBlockAtCaret(burst, editEl, blockEl); return; }
     const live = await settleEnterSource(burst, blockEl);
-    if (!live) return;
+    if (!live) { keepFailedEdgeEnter(burst, editEl, place); return; }
+    openEdgeParagraph(live, place, true);
+  }
+
+  // The paragraph an Enter at `live`'s edge opens: above it for 'start' (the
+  // caret stays in `live`, at its start when `placeCaret`), below its subtree
+  // for 'end' (focused).
+  function openEdgeParagraph(live, place, placeCaret) {
     const surface = blockContentEl(live);
     if (place === 'start') {
       createTransient(previousBlockEl(live), { focus: false, byEnter: true, stayEl: live });
-      if (!surface || !surface.classList.contains('ed-wys-armed')) return;
+      if (!placeCaret || !surface || !surface.classList.contains('ed-wys-armed')) return;
       if (document.activeElement !== surface) surface.focus();
       const r = document.createRange();
       r.selectNodeContents(surface);
       r.collapse(true);
+      const sel = window.getSelection();
       sel.removeAllRanges();
       sel.addRange(r);
       // R3: a surface that kept focus through the commit gets no focusin, and
@@ -9463,6 +9792,36 @@
       anchorCaret: surface ? { surface, offset: surface.textContent.length } : null });
   }
 
+  // v3.17.3 B3: the edge Enter commits the typing before it first
+  // (settleEnterSource()). When that commit's render failed, the Enter was
+  // dropped: the card came up, no paragraph opened, and only a second Enter
+  // opened one. Now the typing is kept as the pending structure (D7) — so the
+  // one retry every other failed structure gets (a resolution such as Ctrl+S,
+  // a focus into a surface, a structural key, runToolbarAction()) writes it —
+  // and the Enter replays once that retry has landed (`after`), if the caret
+  // is still in this block then. A caret that went elsewhere drops it: an
+  // empty paragraph nobody is in would be removed again at once (D3). A
+  // second Enter pressed meanwhile is held behind the retry and replays into
+  // the paragraph this one opened, so it opens no second one.
+  function keepFailedEdgeEnter(burst, editEl, place) {
+    if (burst.transient || currentBurst !== burst || pendingStructure || !editEl.isConnected) return;
+    if (!burstHasUncommittedEdit() || reconcileBlocksCommits()) return;
+    const rec = blocks.find((b) => b.id === burst.blockId);
+    if (!rec) return;
+    const blockId = burst.blockId;
+    const startLine = rec.startLine;
+    setPendingStructure(rec.startLine, rec.endLine, [editEl], () => ({
+      text: surfaceCommitText(editEl, burst.blockType, burst.depth),
+      lineMap: { ids: { [blockId]: startLine }, provisional: null },
+    }), null, null);
+    pendingStructure.after = () => {
+      const live = blockElAtLine(startLine);
+      const surface = live ? blockContentEl(live) : null;
+      if (!surface || !surface.contains(document.activeElement)) return;
+      openEdgeParagraph(live, place, false);
+    };
+  }
+
   // The edge cases' first step: commit what is pending in the block Enter was
   // pressed in (R7) and hand back the live element it is now — re-resolved by
   // its start line when the commit re-rendered it, or the paragraph a
@@ -9564,10 +9923,13 @@
   // wrote as its own op before the structure ({ blockId, text }, or null).
   // The retry writes it as its own op again, so one Ctrl+Z still takes the
   // structure back alone.
+  // `after` (v3.17.3 B3, optional, set by the caller): run once a retry has
+  // landed and put the caret back — the gesture that was waiting on the
+  // structure (keepFailedEdgeEnter()).
   function setPendingStructure(startLine, endLine, surfaces, serialize, covers, typed) {
     pendingStructure = { range: { startLine, endLine },
       before: lines.slice(startLine - 1, endLine).join('\n'), surfaces, serialize, covers: covers || null,
-      typedIds: new Set(), typed: typed || null };
+      typedIds: new Set(), typed: typed || null, after: null };
     setDirty(); // R34: it is unsaved work (documentIsDirty())
   }
 
@@ -9627,7 +9989,7 @@
     // `text: null` is a removal (an emptied block whose removal did not land).
     const result = s.text === null
       ? commitRangeRemoval(state, ps.range.startLine, endLine)
-      : commitRangeEdit(state, ps.range.startLine, endLine, s.text);
+      : commitRangeEdit(state, ps.range.startLine, endLine, s.text, { carriesGap: s.carriesGap === true });
     if (result.op !== null) lines = result.lines;
     else if (typedOp) lines = typedOp.lines;
     const editRange = { startLine: ps.range.startLine, endLine: ps.range.endLine,
@@ -9679,6 +10041,14 @@
         restoreSelection(surface, caretTag.anchor, caretTag.focus);
       }
     }
+    // v3.17.3 B3: only when the caret was in the structure when the retry
+    // began (a press elsewhere has moved on from the waiting gesture).
+    // R30 (fix round 1): that includes a retry started by a toolbar action
+    // or an undo (both resolve through resolveOpenSession() with the caret
+    // still here). The failed Enter replays first and the action then
+    // applies to the paragraph it opened — the order the user pressed them
+    // in. Intended.
+    if (ps.after && caretTag) ps.after();
     return true;
   }
 
@@ -9744,8 +10114,10 @@
   // Spec §3.2. Backspace with the caret at the start of a paragraph joins it
   // to the block above (a paragraph, a heading, or a list item's text); at
   // the start of a heading it makes the heading a paragraph. Delete at the
-  // end of a paragraph or heading pulls the next one up. A neighbour that has
-  // no text to join (a table, a code block, a list item for Delete) is
+  // end of a paragraph or heading pulls the next one up (v3.17.3 B9: a list
+  // item with no children too, see pullListItemUp(); Delete at a list item's
+  // end is liDeleteAtEnd()). A neighbour that has no text to join (a table, a
+  // code block, a list item that owns children, for Delete) is
   // selected instead, and an EMPTY block below such a neighbour goes away
   // with the caret landing at the neighbour's end (R12). Every case is one
   // undo step; typing the key commits first is its own earlier step (D4).
@@ -9910,7 +10282,7 @@
       const range = o.range(state.blocks);
       second = o.text === null
         ? commitRangeRemoval(state, range[0], range[1])
-        : commitRangeEdit(state, range[0], range[1], o.text);
+        : commitRangeEdit(state, range[0], range[1], o.text, { carriesGap: o.carriesGap === true });
     }
     lines = second.lines;
     const delta = (typedOp ? typedOp.op.after.length - typedOp.op.before.length : 0) +
@@ -10001,7 +10373,10 @@
     const typed = empty ? null : typedInBurst(burst);
     let seam = 0;
     withFocusoutSuppressed(() => {
-      seam = joinSeam(prevSurface, Array.prototype.slice.call(editEl.childNodes), prevType === 'heading');
+      // v3.17.3 N1 (R33): into a loose item's <p>, not beside it (joinHostOf()).
+      // Measured before: `- a`, blank, `- b`, blank, `P.`, Backspace at the
+      // start of `P.` wrote `- a\n\n- P.\n` (`b` lost).
+      seam = joinSeam(joinHostOf(prevSurface), Array.prototype.slice.call(editEl.childNodes), prevType === 'heading');
       structureMutated = true;
       prevSurface.focus();
       restoreSelection(prevSurface, seam, seam);
@@ -10141,7 +10516,19 @@
       else selectBlock(next);
       return;
     }
-    // D14: a list item is never pulled up into a paragraph; it is selected.
+    // v3.17.3 B9 (R11, supersedes D14's select for this case): a list item
+    // with no children of its own is pulled up into a paragraph or heading,
+    // as in Notion. One that owns children is still selected (pulling it up
+    // would leave them with no parent), and so is one below a transient.
+    // R34: an item over several source lines (a hard wrap, a continuation
+    // paragraph, a fenced child) counts as one with children, and so does
+    // one whose list the structural serializer refuses: both keep the
+    // select, never a refusal notice.
+    if (nextSurface && nextType === 'li' && !curIsTransient && liJoinable(next) &&
+        listRunSupportsStructuralEdit(listRunOf(next), next)) {
+      await pullListItemUp(burst, editEl, next, nextSurface, empty);
+      return;
+    }
     if (!nextSurface || nextType === 'li') { selectBlock(next); return; }
     const nextRec = blockRecOf(next);
     const curRec = curIsTransient ? null : blocks.find((b) => b.id === burst.blockId);
@@ -10176,6 +10563,54 @@
     if (ok) focusBlockAtLineOffset(headLine, seam);
   }
 
+  // v3.17.3 B9 (R11): Delete at the end of a paragraph or heading whose next
+  // block is a list item with no children. The item's text joins the block
+  // and the item leaves its list; the commit is ONE op over the block's
+  // first line through the end of the list, written as the block, the lines
+  // that separated it from the list (kept byte for byte), then the rest of
+  // the list (its other items replayed from the file). An emptied list is
+  // written as nothing. The block's own typing is its own earlier op (D4).
+  async function pullListItemUp(burst, editEl, li, liSurface, empty) {
+    const curRec = blocks.find((b) => b.id === burst.blockId);
+    const run = listRunOf(li);
+    const runRange = run.length ? runRangeOfBlocks({ lines, blocks, stack }, run) : null;
+    // deleteAtEnd() checked the run and the item (R34) synchronously first.
+    if (!curRec || !runRange || runRange.startLine <= curRec.endLine) return;
+    const typed = empty ? null : typedInBurst(burst);
+    const gap = lines.slice(curRec.endLine, runRange.startLine - 1);
+    const survivors = run.filter((el) => el !== li);
+    let seam = 0;
+    withFocusoutSuppressed(() => {
+      seam = joinSeam(editEl, Array.prototype.slice.call(joinHostOf(liSurface).childNodes), burst.blockType === 'heading');
+      structureMutated = true;
+      restoreSelection(editEl, seam, seam);
+      mutateListRun(() => removeListItem(li));
+    });
+    endBurstWithoutResolve();
+    const serialize = () => {
+      const head = surfaceCommitText(editEl, burst.blockType, burst.depth);
+      const ids = { [curRec.id]: curRec.startLine };
+      if (!survivors.length) return { text: head, lineMap: { ids, provisional: null } };
+      const out = serializeListEls(survivors, { carryOver: bystanderCarryOver(survivors) });
+      const listStart = curRec.startLine + head.split('\n').length + gap.length;
+      Object.assign(ids, flightLineMapOf(out.lineMeta, listStart).ids);
+      // R56: `gap` is the lines between the block and the list, sliced from
+      // `lines` verbatim, and a list run never spans a definition (every list
+      // token opens a new run), so the text holds every definition line of
+      // the range.
+      return { text: [head].concat(gap, [out.md]).join('\n'), lineMap: { ids, provisional: null }, carriesGap: true };
+    };
+    const s = serialize();
+    const ok = await commitTypingThenStructure({ typed, text: s.text, carriesGap: s.carriesGap === true,
+      range: (bs) => {
+        const c = bs.find((b) => b.id === curRec.id);
+        return [c.startLine, runRangeOfBlocks({ blocks: bs }, run).endLine];
+      },
+      oldRange: [curRec.startLine, runRange.endLine], lineMap: s.lineMap,
+      pending: { surfaces: [editEl], serialize } });
+    if (ok) focusBlockAtLineOffset(curRec.startLine, seam);
+  }
+
   // S2 Task 7 — the li half of ＋. The new item is spliced into the run's own
   // span and the WHOLE span is re-serialized over the run's line range: one
   // commitRangeEdit, therefore one undo op, no leading blank line (so the run
@@ -10896,6 +11331,9 @@
   // block from the one that moved up into its place. An identity taken before
   // `tail` existed (none today) never reads as removed.
   function selfCommitRemovedBlock(identity) {
+    // v3.17.3 C4: the same epoch compare as reresolveBlockElAfterSelfCommit() below; a
+    // reconcile that landed meanwhile changed `lines` for another reason.
+    if (identity && identity.reconcileEpoch !== reconcileEpoch) return false;
     return !!identity && identity.tail !== undefined &&
       lines.length - identity.tail < identityStartLineNow(identity);
   }
@@ -11634,6 +12072,10 @@
       { el: i > 0 ? all[i - 1] : null, attrs: headAttrs, back: true },
       { el: (j >= 0 && j + 1 < all.length) ? all[j + 1] : null, attrs: tailAttrs, back: false },
     ];
+    // v3.17.3 A7: the neighbouring run each side compared equal to — the list
+    // the span joins there, blank line or not — for a caller that has to
+    // number into it (convertBlocksIntoList()).
+    const joined = { above: null, below: null };
     for (let k = 0; k < sides.length; k++) {
       const side = sides[k];
       if (!side.el || !side.attrs) continue;
@@ -11645,21 +12087,27 @@
       if ((Number(head.getAttribute('data-indent')) || 0) !== side.attrs.indent) continue;
       const headType = head.getAttribute('data-list-type') === 'ol' ? 'ol' : 'ul';
       if (headType !== side.attrs.listType) continue;
-      // Every line between two adjacent blocks is blank by construction
-      // (buildBlockMap() strips a token's trailing newlines, so no block ever
-      // owns a separator). Eating ALL of them is also 「正規化連續空行」:
-      // measured, '- a\n\n\n- b\n' is still ONE loose list, so stopping after
-      // one blank would leave the degrade in place.
-      let moved = false;
+      // No block owns a separator (buildBlockMap() strips a token's trailing
+      // newlines), but the lines between two blocks are not all blank: a link
+      // reference definition is on lines no block owns either (final review
+      // I1, R54). So the blank run is eaten only when it reaches the
+      // neighbour's run exactly; one that stops at another line (a definition)
+      // means the two are separate lists in the file, and nothing joins —
+      // eating the run made the definition the converted item's text. Eating
+      // ALL of a run that reaches is also 「正規化連續空行」: measured,
+      // '- a\n\n\n- b\n' is still ONE loose list, so stopping after one blank
+      // would leave the degrade in place.
+      let edge = side.back ? startLine : endLine;
       if (side.back) {
-        while (startLine >= 2 && String(lines[startLine - 2]).trim() === '') {
-          startLine -= 1; moved = true;
-        }
+        while (edge >= 2 && String(lines[edge - 2]).trim() === '') edge -= 1;
       } else {
-        while (endLine < lines.length && String(lines[endLine]).trim() === '') {
-          endLine += 1; moved = true;
-        }
+        while (edge < lines.length && String(lines[edge]).trim() === '') edge += 1;
       }
+      const reach = side.back ? edge - 1 : edge + 1;
+      if (!blocks.some((b) => (side.back ? b.endLine : b.startLine) === reach)) continue;
+      joined[side.back ? 'above' : 'below'] = nrun;
+      const moved = side.back ? edge !== startLine : edge !== endLine;
+      if (side.back) startLine = edge; else endLine = edge;
       // No separator between us and it: they are already two runs that
       // markdown keeps apart for a reason this rule does not touch (a
       // delimiter change, `- a` / `* b`). Nothing to eat, nothing to gate.
@@ -11673,7 +12121,23 @@
         return { startLine: range.startLine, endLine: range.endLine, ok: false };
       }
     }
-    return { startLine: startLine, endLine: endLine, ok: true };
+    return { startLine: startLine, endLine: endLine, ok: true, joined: joined };
+  }
+
+  // v3.17.3 A7 / N4 (R6, R41): the bytes of the ordered run `run` renumbered
+  // from `firstOrdinal`, for a gesture whose new item(s) join that list from
+  // above — the run's own re-serialization with every item carried (each
+  // item's bytes replayed, only its marker re-stated: the commit a typed
+  // `1. x` gets once x is typed), and its current line range. The caller
+  // writes them in its OWN op, so one undo step takes the join and the new
+  // numbers back together. null when the run cannot be located or the run
+  // gate refuses it (the join then leaves its numbers as they were).
+  function renumberedRunFrom(run, firstOrdinal) {
+    if (!run || !run.length) return null;
+    const range = runRangeOfBlocks({ lines, blocks, stack }, run);
+    if (!range || !listRunSupportsStructuralEdit(run, null, { columnOnly: true })) return null;
+    const out = serializeListEls(run, { carryOver: bystanderCarryOver(run, null), firstOrdinal: firstOrdinal });
+    return out.md === '' ? null : { range: range, md: out.md };
   }
 
   // The {listType, indent} a span member will carry once the operand set
@@ -12093,18 +12557,6 @@
   async function convertBlocksIntoList(blockEls, recs, kinds, target) {
     const attrs = convertMd.listAttrsFor(target);
     if (!attrs) return;
-    // One item per member, joined by a bare newline: the members' own
-    // separators are INSIDE the commit range and are replaced, which is what
-    // makes N paragraphs one TIGHT list. A blank between them would make the
-    // list loose and degrade every item read-only (§4.3 rule 2).
-    const pieces = [];
-    for (let i = 0; i < recs.length; i++) {
-      const stripped = convertMd.stripMarker(
-        lines.slice(recs[i].startLine - 1, recs[i].endLine), kinds[i]);
-      if (!stripped.ok) { refuseStructuralListEdit('此區塊的格式無法轉換'); return; }
-      pieces.push(convertMd.emitAs(stripped.content, target, {}).join('\n'));
-    }
-    const md = pieces.join('\n');
     const first = recs[0];
     const last = recs[recs.length - 1];
 
@@ -12117,16 +12569,73 @@
       { startLine: first.startLine, endLine: last.endLine }, blockEls, self, self);
     if (!merged.ok) { refuseStructuralListEdit(); return; }
 
+    // v3.17.3 A7 (R6) + A9 (R5): the items JOIN the list on either side
+    // (merged.joined), so they are numbered and markered as its items. They
+    // are written with its bullet character / ordinal delimiter, because with
+    // any other one markdown reads them as a list of their own beside it (why,
+    // not a check — see joinedStyle()); numbered, they continue from the list
+    // above (the number its last top-level item has in the file, as
+    // listJoinOf() reads it) or start at 1; and the ordered list they join
+    // BELOW is renumbered after them — through the run's own re-serialization
+    // with every item carried, the commit a typed `1. x` gets once x is typed
+    // (each item's bytes replayed, only its marker re-stated). Same commit,
+    // so one Ctrl+Z puts the paragraph and the old numbers back. Before this
+    // `Intro` over `1. a\n2. b` wrote `1. Intro\n1. a\n2. b`.
+    // `joined` only ever names a run whose head has the target's list type
+    // (widenRangeForListMerge() sets it after that comparison), so `ref` is a
+    // li of that type; null only when its marker cannot be read off the file.
+    const joinedStyle = (run, which) => {
+      if (!run || !run.length) return null;
+      const tops = run.filter((x) => (Number(x.getAttribute('data-indent')) || 0) === 0);
+      const ref = which === 'above' ? tops[tops.length - 1] : tops[0];
+      const st = ref ? sourceMarkerOf(ref) : null;
+      return st ? { style: st, ref: ref } : null;
+    };
+    const above = joinedStyle(merged.joined && merged.joined.above, 'above');
+    const below = joinedStyle(merged.joined && merged.joined.below, 'below');
+    const style = above ? above.style : below ? below.style : null;
+    let ordinal = 1;
+    if (attrs.listType === 'ol' && above) {
+      const rec = blockRecOf(above.ref);
+      const m = rec ? /^\s*(\d{1,9})[.)]/.exec(lines[rec.startLine - 1] || '') : null;
+      ordinal = m ? Number(m[1]) + 1 : 1;
+    }
+    // One item per member, joined by a bare newline: the members' own
+    // separators are INSIDE the commit range and are replaced, which is what
+    // makes N paragraphs one TIGHT list. A blank between them would make the
+    // list loose and degrade every item read-only (§4.3 rule 2).
+    const pieces = [];
+    for (let i = 0; i < recs.length; i++) {
+      const stripped = convertMd.stripMarker(
+        lines.slice(recs[i].startLine - 1, recs[i].endLine), kinds[i]);
+      if (!stripped.ok) { refuseStructuralListEdit('此區塊的格式無法轉換'); return; }
+      const piece = convertMd.emitAs(stripped.content, target, { ordinal: ordinal + i });
+      // One character either way, so the continuation indent emitAs() put
+      // under the marker still fits.
+      if (style) piece[0] = attrs.listType === 'ol' ? piece[0].replace(/^(\d+)\./, '$1' + style) : style + piece[0].slice(1);
+      pieces.push(piece.join('\n'));
+    }
+    const convertedMd = pieces.join('\n');
+    let md = convertedMd;
+    let endLine = merged.endLine;
+    if (attrs.listType === 'ol' && below && (!above || below.style === above.style)) {
+      const tail = renumberedRunFrom(merged.joined.below, ordinal + recs.length);
+      if (tail && tail.range.startLine === merged.endLine + 1) {
+        md = convertedMd + '\n' + tail.md; endLine = tail.range.endLine;
+      }
+    }
+
     const result = commitRangeEdit({ lines, blocks, stack },
-      merged.startLine, merged.endLine, md);
+      merged.startLine, endLine, md);
     if (result.op === null) return;
     const prevLines = lines;
     lines = result.lines;
-    // §3.3's collapse: the emitted items occupy the whole (possibly widened)
-    // commit range — nothing else is written here.
+    // §3.3's collapse: the converted items' own lines, which start the
+    // (possibly widened) commit range; a list below renumbered in the same
+    // commit is not part of the result.
     declareCollapse({
       startLine: merged.startLine,
-      endLine: merged.startLine + md.split('\n').length - 1,
+      endLine: merged.startLine + convertedMd.split('\n').length - 1,
     });
     const editRange = result.op
       ? { startLine: Math.min(result.op.startLine, result.op.endLine + 1),
@@ -12325,15 +12834,68 @@
   // through its serializer, rewriting `|a|b|` as `| a | b |`. The baseline
   // strings themselves are untouched: burst histories restore them as HTML.
   // An allow-list of the declarations that count, so a style nobody has
-  // thought about reads as not an edit only when it is a style; any other
-  // foreign attribute still counts, as before.
+  // thought about reads as not an edit only when it is a style. (Other
+  // foreign attributes stopped counting in v3.17.3, see BURST_KEPT_ATTRS.)
   const BURST_KEPT_STYLE = /^(?:text-align|--ed-[\w-]+)$/;
+  // v3.17.3 C9 (R15): and no attribute counts unless the editor or the
+  // renderer writes it. A writing extension marks the editable element it
+  // sits in (Grammarly: data-gramm, data-gramm_editor, data-enable-grammarly;
+  // LanguageTool: data-lt-*), and a table burst's editEl is the whole table,
+  // so a mark on one cell read as typing: the status went dirty and Ctrl+S
+  // re-serialized the table (measured: the pipes `|a|b|` came back padded).
+  // The paragraph surface was never affected, its own attributes sit outside
+  // the editEl's innerHTML. An ALLOW-list, so an attribute nobody has thought
+  // about is ignored (the failure that costs nothing) rather than an editor
+  // attribute silently dropped from the list costing a real edit. Enumerated
+  // from `setAttribute(`, `.dataset.` and `.className` writes in this file and
+  // from the attributes the server-side renderer emits into blocks:
+  //   markup the editor's own edits change   class, href, title, src, alt,
+  //     start, type, checked, disabled (task checkbox), id, name, target, rel,
+  //     width, height, colspan, rowspan, align, value, lang, dir
+  //   renderer / block structure             data-block-id, data-block-type,
+  //     data-svg-plate, data-hard-break, data-indent, data-list-type,
+  //     data-list-start, data-list-loose, data-checked, data-task,
+  //     data-run-start, data-placeholder, data-kind, data-level,
+  //     data-drawio-pages
+  //   editor state on the surface            contenteditable, spellcheck,
+  //     tabindex, role, aria-label and every aria-*, every data-ed-*
+  //   a column's alignment                   style, filtered to text-align
+  //     and --ed-* above (setColumnAlign() writes a style attribute)
+  // 'style' itself is handled by BURST_KEPT_STYLE, not listed here.
+  const BURST_KEPT_ATTRS = new Set(['class', 'href', 'title', 'src', 'alt', 'start', 'type', 'checked', 'disabled',
+    'id', 'name', 'target', 'rel', 'width', 'height', 'colspan', 'rowspan', 'align', 'value', 'lang', 'dir',
+    'data-block-id', 'data-block-type', 'data-svg-plate', 'data-hard-break', 'data-indent', 'data-list-type',
+    'data-list-start', 'data-list-loose', 'data-checked', 'data-task', 'data-run-start', 'data-placeholder',
+    'data-kind', 'data-level', 'data-drawio-pages', 'contenteditable', 'spellcheck', 'tabindex', 'role']);
+  function burstAttrIsKept(name) {
+    const n = name.toLowerCase();
+    return n === 'style' || BURST_KEPT_ATTRS.has(n) || n.indexOf('aria-') === 0 || n.indexOf('data-ed-') === 0;
+  }
+  // Whether `html` carries any attribute outside the list (or a style): the
+  // cheap gate in front of the parse. A hit that is only text that looks like
+  // an attribute costs a parse and changes nothing.
+  function burstHasForeignMarkup(html) {
+    if (html.indexOf('style=') !== -1) return true;
+    const tagRe = /<[a-zA-Z][^>]*>/g;
+    let t;
+    while ((t = tagRe.exec(html))) {
+      const attrRe = /\s([^\s"'<>\/=]+)=/g;
+      let a;
+      while ((a = attrRe.exec(t[0]))) if (!burstAttrIsKept(a[1])) return true;
+    }
+    return false;
+  }
   const burstFingerprints = new Map();
   function burstEditFingerprint(html) {
     const hit = burstFingerprints.get(html);
     if (hit !== undefined) return hit;
     const tpl = document.createElement('template');
     tpl.innerHTML = html;
+    Array.prototype.forEach.call(tpl.content.querySelectorAll('*'), (el) => {
+      Array.prototype.slice.call(el.attributes).forEach((at) => {
+        if (!burstAttrIsKept(at.name)) el.removeAttribute(at.name);
+      });
+    });
     Array.prototype.forEach.call(tpl.content.querySelectorAll('[style]'), (el) => {
       const kept = [];
       String(el.getAttribute('style')).split(';').forEach((decl) => {
@@ -12354,12 +12916,12 @@
     return out;
   }
   // Both sides go through the same parse and serialize whenever either holds
-  // a style, so a string the page serialized and one re-serialized here are
+  // a style or an attribute outside the list, so a string the page serialized and one re-serialized here are
   // never compared with each other.
   function sameBurstHtml(a, b) {
     if (a === b) return true;
     if (typeof a !== 'string' || typeof b !== 'string') return false;
-    if (a.indexOf('style=') === -1 && b.indexOf('style=') === -1) return false;
+    if (!burstHasForeignMarkup(a) && !burstHasForeignMarkup(b)) return false;
     return burstEditFingerprint(a) === burstEditFingerprint(b);
   }
 
@@ -12505,6 +13067,7 @@
       // §10-gap fix (review): untouched AND was pristine — an ordinary
       // "insert ＋, click away without typing" changed-my-mind. Auto-remove
       // the block instead of leaving its skeleton on disk.
+      if (wasPristineForThisBlock && pristineItemSurvivesSave(burst)) return true;
       if (wasPristineForThisBlock) return await discardPristineInsert();
       return true;
     }
@@ -13131,8 +13694,14 @@
   // armed on one of these, or Shift+Clicking the ⠿ handle would build a
   // selection instead of opening the menu, and a drag inside the raw
   // textarea would fight its own text selection.
+  // v3.17.3 A13: the diagram panel's source and the in-place code edit are
+  // two more editors with a text selection of their own (ED_OWN_TEXT_EDITORS).
+  // Measured before: a drag from the panel's source up over the blocks above
+  // selected three blocks and closed the panel.
+  const ED_OWN_TEXT_EDITORS = 'textarea.ed-diagram-src, pre[data-ed-code-edit]';
   const ED_SEL_GESTURE_CHROME = '.ed-handle, .ed-handle-menu, .ed-insert, .ed-slash-menu, ' +
-    '.ed-te-menu, .ed-te-grip, .ed-tb-insert, .ed-seltb, .ed-linkbar, .ed-linkcard, .ed-imgtb, .ed-conflict, .ed-raw';
+    '.ed-te-menu, .ed-te-grip, .ed-tb-insert, .ed-seltb, .ed-linkbar, .ed-linkcard, .ed-imgtb, .ed-conflict, .ed-raw, ' +
+    ED_OWN_TEXT_EDITORS;
   function isSelGestureChrome(target) {
     return !!(target && target.closest && target.closest(ED_SEL_GESTURE_CHROME));
   }
@@ -13191,6 +13760,25 @@
   // false by the next pointerdown so a gesture whose click never arrives
   // (an abort, a release outside the window) cannot swallow a later one.
   let blockSelClickSuppressed = false;
+  // v3.17.3 A13: the diagram source or code edit (ED_OWN_TEXT_EDITORS) the
+  // current press began in. Its trailing click, released outside that editor,
+  // lands on an ancestor of both ends, and the click router's "outside any
+  // block" branch would then resolve the editor the user is selecting in
+  // (measured: a drag from the panel's source out to the page margin closed
+  // the panel). The click belongs to the editor. Set by the pointerdown
+  // listener, spent by that click, and cleared a task after the release
+  // either way, so a press whose click never comes swallows nothing later.
+  let ownTextPress = null;
+  document.addEventListener('pointerup', () => {
+    if (ownTextPress) setTimeout(() => { ownTextPress = null; }, 0);
+  });
+  // Fix round 1 (R47 M2): a native drag of selected text ends without a
+  // pointerup (Chromium sends pointercancel when the drag starts) and without
+  // a click, so the mark is dropped there and at the drag's end. Measured
+  // before: the next click with no press of its own (a synthetic one outside
+  // every block) was swallowed and the panel stayed open.
+  document.addEventListener('pointercancel', () => { ownTextPress = null; });
+  document.addEventListener('dragend', () => { ownTextPress = null; });
 
   function armBlockSelDrag(e) {
     if (isSelGestureChrome(e.target)) return;
@@ -13406,20 +13994,69 @@
       await new Promise((r) => setTimeout(r, SETTLE_POLL_MS));
     }
   }
-  // R94: `blockEl` once every in-flight commit has landed, if that render
-  // kept the node; one that replaced it leaves nothing to point at, and the
-  // gesture is refused with the notice — never re-found by a guess. Measured
-  // (final re-review, follow-up round): a split's render replaced every block
-  // below the split, and a blockquote above it too, so a gesture on those is
-  // refused; it is acted on only where the render kept the node.
+  // R94: `blockEl` once every in-flight commit has landed — the node itself
+  // when that render kept it. v3.17.3 B4 (R17): one the render replaced is
+  // found again, and the gesture is refused with the notice only when the
+  // block is gone. Measured before: a split's render replaced every block
+  // below the split, and a plain text commit's render every block, so a ⠿
+  // 刪除 picked on another paragraph during the write deleted nothing and
+  // showed 「文件已更新，請重試這個操作」. The identity is what the block READ
+  // on screen at the gesture (drawnBlockPrint()), not its source: mid-flight
+  // `lines` already holds the commit while `blocks` may or may not (R94), so
+  // no line number or source taken then is trustworthy, while the drawn text
+  // is what the user pointed at, typing included. Found again by
+  // uniqueBlockElByPrint(), R104's rule (the one block of its type that reads
+  // so, uniqueness being the proof of position), and never across a
+  // reconciliation (R102).
+  //
+  // Fix round 1 (R46): only when all three hold — the print was unique AT
+  // THE PRESS (the block it named is the one that reads so), it is unique
+  // after the write, and no undo or redo rendered meanwhile (whose result is
+  // not on screen at the press, so the screen the user pointed at says
+  // nothing about the document it lands). Measured before: with `Omega.`
+  // twice on screen and a 復原 rendering that turns the first back into
+  // `Alpha.`, ⠿ 刪除 on the first deleted the second, silently. Otherwise the
+  // notice, as before.
   async function settledGestureBlock(blockEl) {
     if (!blockEl) return null;
     if (commitsSettled()) return blockEl;
+    const print = drawnBlockPrint(blockEl);
+    const refindable = historyRendersInFlight === 0 && uniqueBlockElByPrint(print) === blockEl;
+    const epoch = reconcileEpoch;
+    const historyAt = historyRenderSeq;
     await settleCommits();
     if (blockEl.isConnected) return blockEl;
+    const live = refindable && epoch === reconcileEpoch && historyAt === historyRenderSeq && !reconcileBlocksCommits()
+      ? uniqueBlockElByPrint(print) : null;
+    if (live) return live;
     showError(DROPPED_GESTURE_MESSAGE, null, null);
     return null;
   }
+  // v3.17.3 B4: a block as the screen draws it — its type and its text, white
+  // space folded (a typed NBSP reads as the render's space). A list item's is
+  // its own line, not its children's; any other block's is its whole text
+  // without the editor's chrome (⠿, ＋, buttons), which a hover may add or
+  // drop between two renders.
+  const DRAWN_PRINT_CHROME = '.ed-handle, .ed-insert, button';
+  function drawnBlockPrint(blockEl) {
+    let text = '';
+    if (blockEl.getAttribute('data-block-type') === 'li') {
+      const own = blockContentEl(blockEl);
+      text = own ? own.textContent : '';
+    } else {
+      const copy = blockEl.cloneNode(true);
+      copy.querySelectorAll(DRAWN_PRINT_CHROME).forEach((x) => x.remove());
+      text = copy.textContent;
+    }
+    return { type: blockEl.getAttribute('data-block-type'), text: text.replace(/\s+/g, ' ').trim() };
+  }
+  function uniqueBlockElByPrint(print) {
+    const hits = Array.prototype.slice.call(contentEl.querySelectorAll('.ed-block[data-block-id]')).filter((el) => {
+      const p = drawnBlockPrint(el);
+      return p.type === print.type && p.text === print.text;
+    });
+    return hits.length === 1 ? hits[0] : null;
+  }
 
   // R93: a task item as a checkbox press saw it. `fromEnd` counts rendered
   // blocks after it (a commit above moves every id, never that count);
@@ -13968,6 +14605,15 @@
     // v3.14.0 T1: Escape in a transient abandons it — it wrote nothing, so
     // there is nothing to stash for Ctrl+Z. The only block of an empty
     // document stays (D3), emptied.
+    // v3.17.3 B11 (R10): only an EMPTY one. A transient with text is
+    // committed, the path leaving it takes (resolveTransientBurst(): one op,
+    // the caret at the new paragraph's end), so one Ctrl+Z takes it back.
+    // Measured before: type `hello` in a new paragraph, Escape — the text was
+    // gone and Ctrl+Z did not bring it back (the transient had no stash).
+    if (burst.transient && !transientSurfaceEmpty(burst.blockEl)) {
+      await switchAwayFrom();
+      return;
+    }
     if (burst.transient) {
       burst.history.dispose();
       currentBurst = null;
@@ -14222,6 +14868,9 @@
   function burstUndo(editEl) {
     const burst = currentBurst;
     if (!burst || burst.editEl !== editEl) return;
+    // v3.17.3 A8: an undo is not a save — a pristine item it resolves is
+    // taken away (willAutoRemove below), whatever an earlier Ctrl+S marked.
+    burst.forSave = false;
     const state = burst.history.undo();
     if (state !== null) {
       editEl.innerHTML = state;
@@ -14264,8 +14913,9 @@
     // caret and the burst stayed where it was. With nothing left to step back
     // through here, taking that transient away is the Enter's undo step; the
     // caret stays put. Only in the block the Enter was pressed in (`stayEl`):
-    // a transient the user has already left behind is on its way out (its
-    // removal waits for the press that left it), and a Ctrl+Z in another
+    // a transient the user has already left behind is on its way out (the
+    // next render drops it: transientKeptThroughRender() keeps only one the
+    // user is still at), and a Ctrl+Z in another
     // block means that block's undo. MEASURED without the `stayEl` test (ER
     // 'burst undo: … cascades to the previous commit'): Enter at the end,
     // a click straight into the paragraph above, typing, Ctrl+Z twice — the
@@ -15135,7 +15785,9 @@
       at = sg.end + 1;
     });
     out.push(...lines.slice(at - 1, hi));
-    const result = commitRangeEdit({ lines, blocks, stack }, lo, hi, out.join('\n'));
+    // R56: every line between the segments (blocks' own ranges and list runs,
+    // neither of which holds a definition) is sliced from `lines` verbatim.
+    const result = commitRangeEdit({ lines, blocks, stack }, lo, hi, out.join('\n'), { carriesGap: true });
     if (result.op === null) return;
     endBurstWithoutResolve();
     const prevLines = lines;
@@ -15173,8 +15825,9 @@
     // Every member was a paragraph, or every heading already sat at its clamp:
     // §3.5 rules that a no-op, so nothing is committed and nothing re-renders.
     if (!changed) return;
+    // R56: `span` is the range sliced from `lines`, only heading lines rewritten.
     const result = commitRangeEdit({ lines, blocks, stack },
-      first.startLine, last.endLine, span.join('\n'));
+      first.startLine, last.endLine, span.join('\n'), { carriesGap: true });
     if (result.op === null) return;
     const prevLines = lines;
     lines = result.lines;
@@ -15431,6 +16084,126 @@
     await convertBlockViaMenu(li, 'text', { caretToEnd: false });
   }
 
+  // v3.17.3 B9 (R11): plain Delete with the caret at the end of a list item
+  // (or in an empty one) pulls the next block's text up into it, as in
+  // Notion: the next item of the same list when it owns no children, or the
+  // paragraph / heading right after the list. Every other neighbour keeps
+  // today's behaviour, the browser's own Delete, which changes nothing at the
+  // end of the surface: an item with children (they would have no parent),
+  // an item of another list, a transient, a code block, table, diagram,
+  // image or divider, the end of the document. true = handled.
+  function liDeleteAtEnd(e, editEl) {
+    if (e.ctrlKey || e.metaKey || e.altKey || e.shiftKey || e.isComposing || e.keyCode === 229) return false;
+    const burst = currentBurst;
+    if (!burst || burst.editEl !== editEl || burst.blockType !== 'li') return false;
+    const place = caretPlace(editEl, true);
+    if (place !== 'end' && place !== 'empty') return false;
+    const li = closestLiBlock(editEl);
+    if (!li || liTextEl(li) !== editEl) return false;
+    const run = listRunOf(li);
+    if (!run.length) return false;
+    const next = nextBlockEl(li);
+    if (!next || isTransient(next)) return false;
+    const nextSurface = mergeSurfaceOf(next);
+    if (!nextSurface) return false;
+    const nextIsLi = next.getAttribute('data-block-type') === 'li';
+    // R34: the item and, for an item below, that item too must be joinable
+    // (one source line, no children), and the run one the structural
+    // serializer takes. Otherwise the browser's own Delete, never a
+    // refusal notice.
+    const own = blockRecOf(li);
+    if (!own || own.endLine !== own.startLine) return false;
+    if (nextIsLi) {
+      if (run.indexOf(next) === -1 || !liJoinable(next)) return false;
+    } else if (run[run.length - 1] !== li) return false;
+    if (!listRunSupportsStructuralEdit(run, nextIsLi ? [li, next] : [li])) return false;
+    e.preventDefault();
+    startStructuralKey();
+    liPullNextUp(burst, editEl, li, run, next, nextSurface, place === 'empty').catch(structuralKeyFailed);
+    return true;
+  }
+
+  // The element a Delete join appends into, or takes the text of: a loose
+  // list item's surface holds its text in ONE <p> (v3.11), and the join goes
+  // inside that paragraph. Measured before: `- a` + blank + `- b`, Delete at
+  // the end of `a` put two <p> in one surface and wrote `-` (both texts lost).
+  // Anything else is the surface itself. Also the destination of Backspace's
+  // join into a loose item (joinIntoPrevious(), v3.17.3 N1).
+  //
+  // The whitespace test is list-md.js's isBlankText() (not exported), copied
+  // exactly: a text node that is pure whitespace AND holds a newline, the
+  // pretty-print artifact. A bare space is inline spacing and counts.
+  function joinHostOf(surface) {
+    const kids = Array.prototype.filter.call(surface.childNodes,
+      (n) => !(n.nodeType === 3 && /\n/.test(n.textContent) && /^\s*$/.test(n.textContent)));
+    return kids.length === 1 && kids[0].nodeName === 'P' ? kids[0] : surface;
+  }
+
+  // R34: a list item a Delete join may pull up — it owns one source line
+  // and no nested items. An item over several lines (a hard wrap, a
+  // continuation paragraph, a fenced child) counts as one with children.
+  function liJoinable(li) {
+    const rec = blockRecOf(li);
+    return !!rec && rec.endLine === rec.startLine && !liBlockHasChildren(li);
+  }
+
+  // The item's pending typing as its own op (D4): the item's own lines in its
+  // list's serialization (lineMeta's blank entries carry no blockId, so none
+  // is taken). Several lines replace the item's one source line, which
+  // commitEdit() takes; the join's range ends at a block after the item, so
+  // it moves with them. No gesture is known to reach that today: a typed
+  // newline in the surface makes liDeleteAtEnd() decline (the run check's
+  // multi-line target), and a Shift+Enter is `<br>` on the same line. null
+  // when nothing was typed.
+  function liTypedInBurst(burst, run, li) {
+    if (sameBurstHtml(burstBaselineHtml(burst.editEl), burst.original)) return null;
+    burst.history.flushTyping();
+    const out = serializeListEls(run, { carryOver: bystanderCarryOver(run, li) });
+    const id = String(burst.blockId);
+    const mdLines = out.md.split('\n');
+    const own = [];
+    out.lineMeta.forEach((m, k) => { if (m.blockId === id) own.push(mdLines[k]); });
+    return own.length ? { blockId: burst.blockId, text: own.join('\n') } : null;
+  }
+
+  // The join behind liDeleteAtEnd(): the next block's text appended to the
+  // item at the seam, the next block removed, then the item's whole list
+  // (and the paragraph's lines, when that was the next block) rewritten as
+  // ONE op, mirroring joinIntoPrevious() for Backspace. Synchronous up to the
+  // commit (no await before the DOM change, the v3.13.1 guard).
+  async function liPullNextUp(burst, editEl, li, run, next, nextSurface, empty) {
+    const runRange = runRangeOfBlocks({ lines, blocks, stack }, run);
+    const liRec = blockRecOf(li);
+    const nextRec = blockRecOf(next);
+    if (!runRange || !liRec || !nextRec) return;
+    const nextIsLi = next.getAttribute('data-block-type') === 'li';
+    // liDeleteAtEnd() checked the run and both items (R34) synchronously.
+    const typed = empty ? null : liTypedInBurst(burst, run, li);
+    const span = nextIsLi ? run.filter((el) => el !== next) : run;
+    let seam = 0;
+    withFocusoutSuppressed(() => {
+      seam = joinSeam(joinHostOf(editEl), Array.prototype.slice.call(joinHostOf(nextSurface).childNodes), false);
+      structureMutated = true;
+      restoreSelection(editEl, seam, seam);
+      if (nextIsLi) mutateListRun(() => removeListItem(next));
+      else next.parentNode.removeChild(next);
+    });
+    endBurstWithoutResolve();
+    const serialize = () => {
+      const out = serializeListEls(span, { carryOver: bystanderCarryOver(span, li) });
+      return { text: out.md, lineMap: { ids: flightLineMapOf(out.lineMeta, runRange.startLine).ids, provisional: null } };
+    };
+    const s = serialize();
+    const ok = await commitTypingThenStructure({ typed, text: s.text,
+      range: (bs) => {
+        const r = runRangeOfBlocks({ blocks: bs }, run);
+        return [r.startLine, nextIsLi ? r.endLine : bs.find((b) => b.id === nextRec.id).endLine];
+      },
+      oldRange: [runRange.startLine, nextIsLi ? runRange.endLine : nextRec.endLine], lineMap: s.lineMap,
+      pending: { surfaces: [editEl], serialize } });
+    if (ok) focusBlockAtLineOffset(liRec.startLine, seam);
+  }
+
   // Tab / Shift+Tab on a list item (and, v3.14.0 T3, Backspace at the start
   // of a nested one, which is Shift+Tab). Extracted unchanged from
   // handleLiKeydown(); `outdent` stands for the Shift key. `caretToEnd`
@@ -15505,6 +16278,9 @@
     // item goes and a transient paragraph takes its place (Enter's row-3
     // path). Anywhere else the browser's own deletion.
     if (e.key === 'Backspace') return liBackspaceAtStart(e, editEl);
+    // v3.17.3 B9 (R11): Delete at an item's end pulls the next item, or the
+    // paragraph / heading after the list, up (liDeleteAtEnd()).
+    if (e.key === 'Delete') return liDeleteAtEnd(e, editEl);
     if (e.key !== 'Enter' && e.key !== 'Tab') return false;
     e.preventDefault();
     // T21 item 2, the li half — see handleBurstKeydown()'s Tab branch. Ahead
@@ -19832,7 +20608,10 @@
           const r1 = blockRecOf(unit[unit.length - 1]);
           unitLines = lines.slice(r0.startLine - 1, r1.endLine);
         } else {
-          const res = serializeListEls(unit, { carryOver: carry });
+          // v3.17.3 A9 (review I1): a moved item's old marker is another
+          // list's; it takes the marker of the list it lands in (list-md.js's
+          // tiered vote, `foreign`).
+          const res = serializeListEls(unit, { carryOver: carry, foreign: (el) => moving.indexOf(el) !== -1 });
           unitLines = res.md.split('\n');
           meta = res.lineMeta;
         }
@@ -20169,6 +20948,8 @@
     // next one.
     blockSelClickSuppressed = false;
     if (blockSelDrag) endBlockSelDrag();
+    // v3.17.3 A13: and which own-text editor this press began in, if any.
+    ownTextPress = e.target.closest ? e.target.closest(ED_OWN_TEXT_EDITORS) : null;
     // Every defensive teardown above still runs — they are no-ops that must not
     // be skipped — but nothing behind the modal ARMS a new gesture. The backdrop
     // already makes this unreachable (measured: a Shift+press-drag on the canvas
@@ -21025,7 +21806,10 @@
       closeLinkField({ restore: true });
       return;
     }
-    f.el.style.top = Math.round(r.bottom + f.dy) + 'px';
+    // v3.17.3 C6: below the selection it can pass the viewport's bottom edge;
+    // keep it inside, with openLinkField()'s margin.
+    const fieldH = f.el.getBoundingClientRect().height;
+    f.el.style.top = Math.round(Math.min(r.bottom + f.dy, window.innerHeight - fieldH - 4)) + 'px';
     f.el.style.left = Math.round(r.left + f.dx) + 'px';
   }
 
@@ -21455,6 +22239,13 @@
       // below and clear the set it just built; one released on the page
       // margin would hit the outside-a-block switchAwayFrom() instead.
       if (blockSelClickSuppressed) { blockSelClickSuppressed = false; return; }
+      // v3.17.3 A13: see `ownTextPress`. Released inside the editor, the click
+      // carries on as before (the open-edit branch below answers it).
+      if (ownTextPress) {
+        const own = ownTextPress;
+        ownTextPress = null;
+        if (!own.contains(e.target)) return;
+      }
       // v3.17.0 T9b (R50): the release of this press already answered it.
       if (degradedReleaseOpened) { degradedReleaseOpened = false; return; }
       if (!e.target || !e.target.closest) { await switchAwayFrom(); closeGutterMenu(); return; }
@@ -21899,10 +22690,31 @@
   // copy of save()'s own body, just its one caller-side precondition named
   // once.
   async function commitThenSave() {
+    markBurstForSave();
     const ok = await switchAwayFrom();
     if (ok) return save();
   }
 
+  // v3.17.3 A8 (R9): an empty list item a "/" item, ＋ or the toolbar just
+  // inserted (pristineInsert) is taken away again when its burst resolves
+  // untouched — "insert, then leave without typing" is a change of mind. A
+  // save is not leaving: with the caret still in the item it stays, written
+  // as its skeleton (`- [ ] ` for 待辦清單), and the caret stays in it, as an
+  // empty item Enter made does. Measured before: Alpha., Enter, 「/待辦」,
+  // Enter, Ctrl+S — the item vanished, focus fell to the body, and the file
+  // was saved without it. The mark is set on the burst a save is about to
+  // resolve and read only by pristineItemSurvivesSave(); burstUndo() clears
+  // it, since an undo of the item is the one resolution that must remove it.
+  function markBurstForSave() {
+    if (currentBurst) currentBurst.forSave = true;
+  }
+  function pristineItemSurvivesSave(burst) {
+    if (!burst.forSave || burst.blockType !== 'li' || !burst.editEl.isConnected ||
+        !burst.blockEl.contains(document.activeElement)) return false;
+    startBurst(burst.editEl);
+    return true;
+  }
+
   // v3.17.0 T9b added this queue for the callers that ask for a save while an
   // earlier one may still be on its way (a Ctrl+S held through a code edit's
   // or diagram panel's re-entry, a second Ctrl+S while the first one's
@@ -22036,6 +22848,21 @@
   }
 
   // ── undo / redo ───────────────────────────────────────────────────────
+  // v3.17.3 fix round 1 (R46): the renders of undo() / redo() (and of the
+  // wave editor's whole-session undo / redo they call), counted, so a
+  // gesture that waited for a write can tell that write was an undo or redo
+  // (settledGestureBlock()).
+  let historyRenderSeq = 0;
+  let historyRendersInFlight = 0;
+  async function historyRerender(editRange) {
+    historyRenderSeq++;
+    historyRendersInFlight++;
+    try {
+      return await safeRerenderAll(editRange);
+    } finally {
+      historyRendersInFlight--;
+    }
+  }
   async function undo() {
     // T21 item 1: an Escape that discarded a burst leaves exactly one thing
     // for the next Ctrl+Z to undo, and it is not on this stack — the burst
@@ -22107,7 +22934,7 @@
           endLine: r.op.startLine + r.op.after.length - 1,
           delta: r.op.before.length - r.op.after.length }
       : undefined;
-    const ok = await safeRerenderAll(editRange);
+    const ok = await historyRerender(editRange);
     if (!ok) {
       // Reverse the undo attempt: push the op back and restore `lines` to
       // what was on screen before this undo was requested.
@@ -22153,7 +22980,7 @@
           endLine: Math.max(r.op.startLine - 1, r.op.endLine),
           delta: r.op.after.length - r.op.before.length }
       : undefined;
-    const ok = await safeRerenderAll(editRange);
+    const ok = await historyRerender(editRange);
     if (!ok) {
       // Reverse the redo attempt: pop the op back off and restore `lines`.
       const rollback = stack.undo(lines);
@@ -22189,7 +23016,32 @@
     // steps the burst, exactly as Ctrl+Z does there. It never commits what is
     // open first and then undoes the whole commit (a transient typed into
     // vanished entirely that way).
-    if (codeEditIsOpen()) { stepCodeEditHistory(codeEditState, -1); return; }
+    // v3.17.3 C1 (R22): the order is explicit — an open code edit, then an
+    // open diagram panel (its own text history: the panel stays open and the
+    // file is not reached), then a burst, and the document stack LAST.
+    // v3.17.3 A12 (R22): the document stack waits for a write in flight and
+    // then undoes it — one press, one step. Measured before: one press during
+    // the render of a raw box's Ctrl+Enter left that commit standing, and a
+    // second press undid it. Read from the code: the box keeps its session
+    // (`activeEditor`) until its render lands, so undo()'s switchAwayFrom()
+    // resolved that box again instead of the press reaching the stack (not
+    // traced further). Only this layer waits: the code edit's, the panel's
+    // and the burst's histories never reach a write. Fix round 1 (R47 M1):
+    // the routing runs again once the wait is over — an edit opened meanwhile
+    // (a code edit, the panel, typing) owns the press, as R22 orders.
+    if (undoInOpenEdit()) return;
+    if (!commitsSettled()) {
+      await settleCommits();
+      if (undoInOpenEdit()) return;
+    }
+    const saved = captureCaretForSave();
+    await undo();
+    restoreCaretForSave(saved);
+  }
+  // R22's first three layers: true when one of them took the press.
+  function undoInOpenEdit() {
+    if (codeEditIsOpen()) { stepCodeEditHistory(codeEditState, -1); return true; }
+    if (diagramPanelIsOpen()) { stepDiagramHistory(diagramPanelState, -1); return true; }
     const b = currentBurst;
     if (b && b.editEl && b.blockType !== 'table' && b.editEl.isConnected &&
         b.editEl.contains(document.activeElement) && burstHasUncommittedEdit()) {
@@ -22197,18 +23049,40 @@
       // transient left standing after Ctrl+S, say) leaves the button the
       // document undo it always was.
       burstUndo(b.editEl);
-      return;
+      return true;
     }
-    const saved = captureCaretForSave();
-    await undo();
-    restoreCaretForSave(saved);
+    return false;
+  }
+
+  // A12: two presses that both waited step twice, one after the other: the
+  // first to wake starts its undo's render within the same task chain (no
+  // timer between the wake and beginCommitFlight()), so the other one's next
+  // poll finds that render in flight and waits again. Pinned by the checks
+  // 「v3173 A12: two toolbar 復原 …」. Fix round 1 (R47): the keyboard's
+  // Ctrl+Z / Ctrl+Y take this wait only from a raw box whose commit is
+  // rendering (see the keydown handler).
+  async function settledHistoryStep(step) {
+    if (!commitsSettled()) await settleCommits();
+    return step();
   }
 
   async function redoViaToolbar() {
+    // v3.17.3 C1 (R22): undoViaToolbar()'s order; the document stack last.
+    if (redoInOpenEdit()) return;
+    // A12: and waits for a write in flight the same way, routing again after.
+    if (!commitsSettled()) {
+      await settleCommits();
+      if (redoInOpenEdit()) return;
+    }
     const saved = captureCaretForSave();
     await redo();
     restoreCaretForSave(saved);
   }
+  function redoInOpenEdit() {
+    if (codeEditIsOpen()) { stepCodeEditHistory(codeEditState, 1); return true; }
+    if (diagramPanelIsOpen()) { stepDiagramHistory(diagramPanelState, 1); return true; }
+    return false;
+  }
 
   // ── v3.1.0 §4: the always-visible editing toolbar ──────────────────────
   // The version's headline feature: before this there was no toolbar at all,
@@ -23314,7 +24188,9 @@
   // The hidden file input both image paths open; `onFiles` gets the picked
   // files (never called for an empty pick). v3.15.0 B1 fix: shared with
   // pickImageIntoParagraph().
-  function openImagePicker(onFiles, { multiple = true } = {}) {
+  // `onCancel` (v3.17.3 A6): the dialog was dismissed, which the browser says
+  // with a `cancel` event on the input; the input goes either way.
+  function openImagePicker(onFiles, { multiple = true, onCancel } = {}) {
     const input = document.createElement('input');
     input.type = 'file';
     // v3.4.1: extension tokens sit beside the MIME tokens deliberately.
@@ -23335,6 +24211,10 @@
       if (!files.length) return;
       Promise.resolve(onFiles(files)).catch(showUnexpectedFailure);
     });
+    input.addEventListener('cancel', () => {
+      input.remove();
+      if (typeof onCancel === 'function') Promise.resolve(onCancel()).catch(showUnexpectedFailure);
+    });
     input.click();
   }
 
@@ -23394,6 +24274,394 @@
     });
   }
 
+  // ── v3.17.3 B2 (R12): selected text dragged to another block ───────────
+  // Before, the browser's own move ran in two halves: the source's
+  // deleteByDrag went into the source's burst and the target's insertFromDrop
+  // into the target's DOM, and the source's commit re-rendered over the
+  // target. Measured: `Alpha bravo charlie.` / `Omega delta.`, `bravo`
+  // dragged into `Omega`, the file then held neither `bravo` (both engines).
+  // Now a drag that starts in the document and lands in ANOTHER block is the
+  // editor's: the drop is cancelled (and with it both browser halves) and the
+  // move is written by moveDroppedText() as one op. Both ends must be a plain
+  // text surface (a paragraph, a heading or a list item); a table cell, a
+  // code block, a diagram, an image, a raw box, the code edit or a transient
+  // paragraph at either end refuses the drop with a notice, and the source
+  // keeps its text; so does a drop outside every block (fix round 1, R38: the
+  // search box, the link field, the page around the document). A drop inside
+  // the drag's own block is left to the browser (its two halves land in one
+  // burst, which commits them together), and a drag that did not start in the
+  // document, or that carries files, is not this code's at all.
+  //
+  // `textDrag`: { blockEl, surface, range, text, handled } from dragstart to
+  // just after dragend, or null. `surface` / `range` are null when the drag
+  // is not a text selection in a plain surface (a table cell, an image).
+  // `handled` (set at the drop): this code took the drop, so any input the
+  // browser still raises for it (the source's deleteByDrag, an
+  // insertFromDrop) is cancelled by the beforeinput guard below. Measured
+  // with an event trace on a refused drop: neither engine raised either once
+  // the drop was cancelled; the guard is there so an engine that does cannot
+  // write the source behind the move.
+  let textDrag = null;
+  const TEXT_DROP_REFUSED_MESSAGE = '文字只能拖放到另一個段落、標題或清單項目裡，原文保持不動';
+
+  function elementOfNode(node) {
+    return node && (node.nodeType === 1 ? node : node.parentElement);
+  }
+  // The plain text surface of `blockEl` a drag can move text out of or into:
+  // a paragraph, heading or list item's armed surface; never a transient
+  // (its text has no line yet, R12: refused) or a picture.
+  function textDropSurfaceOf(blockEl) {
+    if (!blockEl || isTransient(blockEl) || blockEl.getAttribute('data-block-id') === null) return null;
+    if (isImageBlock(blockEl)) return null;
+    return mergeSurfaceOf(blockEl);
+  }
+  // The browser's caret under a point, as an offset in `surface`'s text, or
+  // null when the point is not over that surface's text.
+  function surfaceOffsetFromPoint(surface, x, y) {
+    let node = null;
+    let off = 0;
+    if (typeof document.caretPositionFromPoint === 'function') {
+      const p = document.caretPositionFromPoint(x, y);
+      if (p) { node = p.offsetNode; off = p.offset; }
+    } else if (typeof document.caretRangeFromPoint === 'function') {
+      const r = document.caretRangeFromPoint(x, y);
+      if (r) { node = r.startContainer; off = r.startOffset; }
+    }
+    if (!node || !surface.contains(node)) return null;
+    return offsetInSurface(surface, node, off);
+  }
+  function refuseTextDrop() {
+    showNotice(TEXT_DROP_REFUSED_MESSAGE);
+  }
+
+  // The block a drag event is over, or null outside every block.
+  function dragBlockAt(e) {
+    const t = elementOfNode(e.target);
+    return t && contentEl.contains(t) ? t.closest('.ed-block') : null;
+  }
+  // The drag this code answers for `e`, or null: an in-document drag
+  // (`textDrag`), never one that carries files — a picture or a .drawio from
+  // the desktop is wireImageDrop()'s whatever state a previous drag left.
+  function textDragFor(e) {
+    return textDrag && !dragCarriesFiles(e) ? textDrag : null;
+  }
+
+  function wireTextDrop() {
+    // Fix round 1 (I1): `dragend` is dispatched to the node the drag started
+    // on, and a move detaches that node (the deleted range, a dropped empty
+    // mark, normalize()), so a document listener never hears it. Measured
+    // before: after moving a whole bold word, `textDrag` stayed set with
+    // `handled`, and the next external drop (a text, a PNG file) was
+    // cancelled with the refusal notice. The listener therefore goes on the
+    // node itself (it still fires there once detached), the document one is
+    // kept for every other ending, and the next press clears it whatever
+    // happened.
+    const endTextDrag = (drag) => {
+      setTimeout(() => { if (textDrag === drag) textDrag = null; }, 0);
+    };
+    document.addEventListener('dragstart', (e) => {
+      textDrag = null;
+      const t = elementOfNode(e.target);
+      if (!t || !contentEl.contains(t)) return;
+      const blockEl = t.closest('.ed-block');
+      if (!blockEl || !contentEl.contains(blockEl)) return;
+      const drag = { blockEl, surface: null, range: null, text: '', handled: false };
+      const sel = window.getSelection();
+      const surface = textDropSurfaceOf(blockEl);
+      if (surface && sel.rangeCount && !sel.isCollapsed) {
+        const r = sel.getRangeAt(0);
+        // The selection is what is dragged only when the press was on it (a
+        // picture inside the same block drags itself, not the selection).
+        if (surface.contains(r.startContainer) && surface.contains(r.endContainer) && r.intersectsNode(t)) {
+          drag.surface = surface;
+          drag.range = r.cloneRange();
+          drag.text = r.toString();
+        }
+      }
+      textDrag = drag;
+      if (e.target && typeof e.target.addEventListener === 'function') {
+        e.target.addEventListener('dragend', () => endTextDrag(drag), { once: true });
+      }
+    }, true);
+    const clearOnPress = () => { textDrag = null; };
+    document.addEventListener('pointerdown', clearOnPress, true);
+    document.addEventListener('mousedown', clearOnPress, true);
+    // A drop needs a dragover the page accepted. A text surface accepts one
+    // by itself; a code block, a diagram, a picture or the page outside the
+    // blocks does not, and the refusal there would be silent. So everywhere
+    // but the drag's own block the drag is accepted, and the drop arrives
+    // and says why it is refused.
+    const acceptTextDrag = (e) => {
+      const drag = textDragFor(e);
+      if (!drag) return;
+      const t = elementOfNode(e.target);
+      if (!t || dragBlockAt(e) === drag.blockEl || t.isContentEditable) return;
+      e.preventDefault();
+      if (e.dataTransfer) e.dataTransfer.dropEffect = 'move';
+    };
+    // WebKit also needs the dragenter accepted: otherwise the drag's current
+    // target becomes the body and no dragover or drop reaches the block
+    // (measured on a code block: dragenter, then dragend, nothing between).
+    document.addEventListener('dragenter', acceptTextDrag, true);
+    document.addEventListener('dragover', acceptTextDrag, true);
+    // Capture phase, so it runs ahead of wireImageDrop()'s listener, which a
+    // picture dragged out of the document would otherwise reach.
+    document.addEventListener('drop', (e) => {
+      const drag = textDragFor(e);
+      if (!drag || waveEditorIsModal()) return;
+      const destBlockEl = dragBlockAt(e);
+      if (destBlockEl === drag.blockEl) return;
+      e.preventDefault();
+      e.stopPropagation();
+      drag.handled = true;
+      // Fix round 1 (M4, R38): outside every block (the search box, the link
+      // field, the page around the document) the drop is refused too; before,
+      // an input there took the text out of the document.
+      if (!destBlockEl) { refuseTextDrop(); return; }
+      const carried = e.dataTransfer ? e.dataTransfer.getData('text/plain') : '';
+      const destSurface = textDropSurfaceOf(destBlockEl);
+      const destOffset = destSurface ? surfaceOffsetFromPoint(destSurface, e.clientX, e.clientY) : null;
+      if (!drag.surface || !drag.text || !carried || destOffset === null) { refuseTextDrop(); return; }
+      moveDroppedText(drag.blockEl, drag.range, destBlockEl, destOffset).catch(structuralKeyFailed);
+    }, true);
+    // Cleared once the drag's own trailing input (deleteByDrag) has had its
+    // turn, which comes right after dragend.
+    document.addEventListener('dragend', () => endTextDrag(textDrag), true);
+  }
+
+  // The dragged fragment, marks included: Range.cloneContents() keeps a mark
+  // only when the range crosses it, so a selection wholly inside `**bravo**`
+  // would come out as plain `bravo`. The inline elements between the range
+  // and the surface are put back around it (shallow clones, attributes kept,
+  // so a link keeps its href).
+  function fragmentWithMarks(range, surface) {
+    let frag = range.cloneContents();
+    for (let n = elementOfNode(range.commonAncestorContainer); n && n !== surface && surface.contains(n);
+      n = n.parentElement) {
+      if (n.nodeName === 'P' || n.nodeName === 'DIV') continue; // a loose item's own paragraph
+      const wrap = n.cloneNode(false);
+      wrap.appendChild(frag);
+      frag = document.createDocumentFragment();
+      frag.appendChild(wrap);
+    }
+    return frag;
+  }
+
+  // Fix round 1 (I2, R37): the moved fragment fitted to the drop point. A
+  // mark it carries that the drop point already sits inside is unwrapped:
+  // `**bravo**` dropped into `**delta**` wrote `**de**bravo**lta**`, which
+  // reparses with bravo NOT bold. A link dropped inside a link has no
+  // Markdown at all (links do not nest; measured, the destination link came
+  // back broken), and inside inline code no mark can be written, so those
+  // two are refused: false.
+  const MARK_KIND = { STRONG: 'b', B: 'b', EM: 'i', I: 'i', DEL: 's', S: 's', STRIKE: 's', U: 'u', CODE: 'code', A: 'a' };
+  function fitFragmentToDrop(frag, atNode, surface) {
+    const kinds = {};
+    for (let n = elementOfNode(atNode); n && n !== surface && surface.contains(n); n = n.parentElement) {
+      if (MARK_KIND[n.nodeName]) kinds[MARK_KIND[n.nodeName]] = true;
+    }
+    const els = Array.prototype.slice.call(frag.querySelectorAll('*'));
+    if (kinds.a && els.some((el) => el.nodeName === 'A')) return false;
+    if (kinds.code && els.some((el) => el.nodeName !== 'BR')) return false;
+    els.forEach((el) => {
+      if (!kinds[MARK_KIND[el.nodeName]] || el.nodeName === 'A') return;
+      while (el.firstChild) el.parentNode.insertBefore(el.firstChild, el);
+      el.parentNode.removeChild(el);
+    });
+    return true;
+  }
+  // Merges `a` with its next sibling while both are the same mark
+  // (sameSeamMark()), repeated inward, as joinSeam() does at a join.
+  function mergeMarkSeam(a) {
+    let n = a;
+    while (n && sameSeamMark(n, n.nextSibling)) {
+      const b = n.nextSibling;
+      const inner = n.lastChild;
+      while (b.firstChild) n.appendChild(b.firstChild);
+      b.parentNode.removeChild(b);
+      n = inner;
+    }
+  }
+
+  // One end of a drag move: the lines it rewrites and how to serialize it.
+  // A paragraph or heading rewrites its own lines; a list item rewrites its
+  // whole run (its markers are run-global), with every other item replayed
+  // from the file. null: this end cannot be written here.
+  function textMoveEnd(blockEl, surface) {
+    const type = blockEl.getAttribute('data-block-type');
+    if (type === 'li') {
+      const run = listRunOf(blockEl);
+      const range = run.length ? runRangeOfBlocks({ lines, blocks, stack }, run) : null;
+      if (!range || blockOwnsNoLine(blockEl)) return null;
+      return { kind: 'run', run, lis: [blockEl], first: range.startLine, last: range.endLine };
+    }
+    const rec = blockRecOf(blockEl);
+    if (!rec || rec.endLine < rec.startLine) return null;
+    if (inlineMd.serializeInline(surface).unsupported.length) return null;
+    return { kind: 'block', blockEl, surface, type, depth: blockDepthOf(type, surface), id: rec.id,
+      first: rec.startLine, last: rec.endLine };
+  }
+  // { text, ids } for one end, ids relative to its first line; text null when
+  // the end is a paragraph left with no text (it is removed, as an emptied
+  // paragraph is, R95).
+  function textMoveEndText(end) {
+    if (end.kind === 'run') {
+      const carry = bystanderCarryOver(end.run, end.lis[0]);
+      if (carry && end.lis[1]) delete carry[end.lis[1].getAttribute('data-block-id')];
+      const out = serializeListEls(end.run, { carryOver: carry });
+      return { text: out.md, ids: flightLineMapOf(out.lineMeta, 0).ids };
+    }
+    if (end.type === 'paragraph' && end.surface.textContent === '' && !end.surface.querySelector('img')) {
+      return { text: null, ids: {} };
+    }
+    return { text: surfaceCommitText(end.surface, end.type, end.depth), ids: { [end.id]: 0 } };
+  }
+
+  // v3.17.3 B2 (R12): the move behind a text drop. `srcRange` is the dragged
+  // selection in `srcBlockEl`'s surface, `destOffset` the drop point as an
+  // offset in `destBlockEl`'s surface. The dragged fragment, with its marks,
+  // leaves the source and goes in at the drop point, and the span from the
+  // first affected line to the last is written as ONE commitRangeEdit (one
+  // Ctrl+Z): both ends serialized, the lines between them kept byte for byte.
+  // Pending typing is committed first, as its own op (D4), through the same
+  // switchAwayFrom() a ⠿ drag takes, and both blocks are found again after it
+  // (refindBlock(), as performBlockDrop() does). From there on it is
+  // synchronous up to commitTypingThenStructure() (the v3.13.1 guard); a
+  // failed render keeps the moved text on screen as a pending structure (D7).
+  async function moveDroppedText(srcBlockEl, srcRange, destBlockEl, destOffset) {
+    const srcSurface0 = textDropSurfaceOf(srcBlockEl);
+    if (!srcSurface0 || !srcSurface0.contains(srcRange.startContainer) ||
+        !srcSurface0.contains(srcRange.endContainer)) { refuseTextDrop(); return; }
+    const from = offsetInSurface(srcSurface0, srcRange.startContainer, srcRange.startOffset);
+    const to = offsetInSurface(srcSurface0, srcRange.endContainer, srcRange.endOffset);
+    const dragged = srcSurface0.textContent.slice(from, to);
+    if (!(to > from)) { refuseTextDrop(); return; }
+    // v3.15.0 R100 (b), as performBlockDrop(): no identity is taken while a
+    // commit is in flight; both ends must still be on screen once it lands.
+    if (!commitsSettled()) {
+      await settleCommits();
+      if (!srcBlockEl.isConnected || !destBlockEl.isConnected) {
+        showError(DROPPED_GESTURE_MESSAGE, null, null);
+        return;
+      }
+    }
+    const srcIdentity = captureBlockIdentity(srcBlockEl);
+    const destIdentity = captureBlockIdentity(destBlockEl);
+    const srcSelf = ownsOpenSession(srcBlockEl);
+    const destSelf = ownsOpenSession(destBlockEl);
+    if (!(await switchAwayFrom())) return;
+    if (!commitsSettled()) await settleCommits();
+    const src = refindBlock(srcBlockEl, srcIdentity, srcSelf);
+    const dest = refindBlock(destBlockEl, destIdentity, destSelf);
+    const srcSurface = src ? textDropSurfaceOf(src) : null;
+    const destSurface = dest ? textDropSurfaceOf(dest) : null;
+    if (!srcSurface || !destSurface || src === dest ||
+        srcSurface.textContent.slice(from, to) !== dragged || destOffset > destSurface.textContent.length) {
+      showError(DROPPED_GESTURE_MESSAGE, null, null);
+      return;
+    }
+    let ends;
+    const a = textMoveEnd(src, srcSurface);
+    const b = textMoveEnd(dest, destSurface);
+    if (!a || !b) { refuseTextDrop(); return; }
+    if (a.kind === 'run' && b.kind === 'run' && a.run[0] === b.run[0]) {
+      if (!listRunSupportsStructuralEdit(a.run, [src, dest])) { refuseTextDrop(); return; }
+      ends = [{ kind: 'run', run: a.run, lis: [src, dest], first: a.first, last: a.last }];
+    } else {
+      if ((a.kind === 'run' && !listRunSupportsStructuralEdit(a.run, src)) ||
+          (b.kind === 'run' && !listRunSupportsStructuralEdit(b.run, dest))) { refuseTextDrop(); return; }
+      ends = a.first < b.first ? [a, b] : [b, a];
+      if (ends[0].last >= ends[1].first) { refuseTextDrop(); return; }
+    }
+    const range = document.createRange();
+    const p = pointInSurface(srcSurface, from);
+    const q = pointInSurface(srcSurface, to);
+    range.setStart(p[0], p[1]);
+    range.setEnd(q[0], q[1]);
+    // The fragment is built, fitted to where it lands and asked of the inline
+    // serializer before anything on screen changes; the source's own nodes
+    // are untouched by all three (cloneContents()).
+    const at = pointInSurface(destSurface, destOffset);
+    const frag = fragmentWithMarks(range, srcSurface);
+    if (!fitFragmentToDrop(frag, at[0], destSurface)) { refuseTextDrop(); return; }
+    // A heading is one line: a hard break in the moved text becomes a space.
+    if (dest.getAttribute('data-block-type') === 'heading') {
+      Array.prototype.slice.call(frag.querySelectorAll('br')).forEach((br) => {
+        br.parentNode.replaceChild(document.createTextNode(' '), br);
+      });
+    }
+    const probe = document.createElement('p');
+    probe.appendChild(frag.cloneNode(true));
+    if (inlineMd.serializeInline(probe).unsupported.length) { refuseTextDrop(); return; }
+    if (currentBurst) endBurstWithoutResolve();
+    startStructuralKey();
+    const movedLen = frag.textContent.length;
+    withFocusoutSuppressed(() => {
+      range.deleteContents();
+      dropEmptyInlines(srcSurface);
+      srcSurface.normalize();
+      const firstIn = frag.firstChild;
+      const lastIn = frag.lastChild;
+      const ins = document.createRange();
+      ins.setStart(at[0], at[1]);
+      ins.collapse(true);
+      ins.insertNode(frag);
+      // A moved mark that lands against one of the same kind becomes one
+      // mark (`**bravo**` dropped at the start of `**delta**` is
+      // `**bravodelta**`, not two bold runs with an empty HTML comment
+      // between them). normalize()
+      // first: insertNode() splits the text node it lands in and leaves an
+      // empty one at the seam. Right seam first: the left one may absorb the
+      // first inserted node. A text node normalize() merged away has no mark
+      // seam to join.
+      destSurface.normalize();
+      if (lastIn && lastIn.isConnected) mergeMarkSeam(lastIn);
+      if (firstIn && firstIn.isConnected && firstIn.previousSibling) mergeMarkSeam(firstIn.previousSibling);
+      dropEmptyInlines(destSurface);
+      destSurface.normalize();
+      structureMutated = true;
+    });
+    const first = ends[0].first;
+    const last = ends[ends.length - 1].last;
+    const serialize = () => {
+      const t0 = textMoveEndText(ends[0]);
+      const ids = {};
+      const place = (rel, at) => Object.keys(rel).forEach((id) => { ids[id] = at + rel[id]; });
+      if (ends.length === 1) {
+        place(t0.ids, first);
+        return { text: t0.text, lineMap: { ids, provisional: null } };
+      }
+      const t1 = textMoveEndText(ends[1]);
+      let gap = lines.slice(ends[0].last, ends[1].first - 1);
+      // An emptied paragraph goes with one blank line next to it.
+      if (t0.text === null && gap.length && gap[0].trim() === '') gap = gap.slice(1);
+      if (t1.text === null && gap.length && gap[gap.length - 1].trim() === '') gap = gap.slice(0, -1);
+      const head = t0.text === null ? [] : t0.text.split('\n');
+      place(t0.ids, first);
+      place(t1.ids, first + head.length + gap.length);
+      const out = head.concat(gap, t1.text === null ? [] : t1.text.split('\n'));
+      // Final review I3 (R56): `gap` is every line between the two ends,
+      // sliced from `lines` (only a blank next to an emptied paragraph is
+      // dropped), so the text carries a definition there already. Unflagged,
+      // keepDefinitionLines() appended a second copy. The one-end text (one
+      // list run) has no gap: a list run never spans a definition.
+      return { text: out.join('\n'), lineMap: { ids, provisional: null }, carriesGap: true };
+    };
+    const s = serialize();
+    const destId = dest.getAttribute('data-block-id');
+    const ok = await commitTypingThenStructure({ typed: null, text: s.text, carriesGap: s.carriesGap === true,
+      range: () => [first, last], oldRange: [first, last], lineMap: s.lineMap,
+      pending: { surfaces: [srcSurface, destSurface], serialize } });
+    if (!ok) return;
+    // The moved text stays selected where it landed, as the browser's own
+    // move leaves it.
+    const landed = s.lineMap.ids[destId] !== undefined ? blockElAtLine(s.lineMap.ids[destId]) : null;
+    const surface = landed ? blockContentEl(landed) : null;
+    if (!surface || !surface.classList.contains('ed-wys-armed')) return;
+    surface.focus();
+    restoreSelection(surface, destOffset, destOffset + movedLen);
+  }
+
   // ── 追加 2: paste ──────────────────────────────────────────────────────
   // Reads a real DataTransfer into the plain { 'mime/type': string | Blob }
   // shape paste-md.js's pickPayload() documents. Only ONE image flavour is
@@ -23620,6 +24888,7 @@
     paintSaveStatus(documentIsDirty() ? 'dirty' : 'clean');
     wireToolbarTracking();
     wireImageDrop();
+    wireTextDrop();
     wirePlainPasteArming();
     // No separate first paint of the edge hint here: on this call the
     // remembered toolbar signature is still its initial empty string, which no
@@ -23931,6 +25200,7 @@
       // Both presses used to get the one cached `switching` promise and run
       // two save()s back to back, and the second 409'd into the conflict card.
       if (switching) { switching.then((ok) => { if (ok) saveAfterLastSave(); }); return; }
+      markBurstForSave();
       switchAwayFrom().then((ok) => { if (ok) save(); });
       return;
     }
@@ -23949,6 +25219,25 @@
 
     const inTextarea = e.target && e.target.tagName === 'TEXTAREA' &&
       e.target.classList.contains('ed-raw');
+    // v3.17.3 fix round 1 (R47): a raw box whose Ctrl+Enter / ✓ commit is
+    // rendering has already handed its text to the document — Ctrl+Z / Ctrl+Y
+    // there step the document once the write lands, not the box's native
+    // history. Measured before (A12's steps, focus still in the box): the
+    // press undid nothing, both engines, at 50 and 500 ms.
+    if (inTextarea && e.target === rawBoxCommitting && (e.ctrlKey || e.metaKey) && !e.altKey &&
+        (e.key === 'z' || e.key === 'Z' || e.key === 'y')) {
+      e.preventDefault();
+      // Final review M5: as the toolbar's 復原 / 重做 do — the caret is taken
+      // once the write has landed and put back after the step, and a failure
+      // is shown rather than left as an unhandled rejection.
+      const step = e.key === 'y' || e.shiftKey ? redo : undo;
+      settledHistoryStep(async () => {
+        const saved = captureCaretForSave();
+        await step();
+        restoreCaretForSave(saved);
+      }).catch(showUnexpectedFailure);
+      return;
+    }
     if (inTextarea) return; // Ctrl+Enter/Esc handled by openRawEditor()'s own per-instance listener
 
     // v3.13.1 T1: a key that edits or moves, pressed while a commit is in
@@ -24118,6 +25407,12 @@
       if (!e.shiftKey && e.key === 'Enter') {
         const from = selectionFocusBlockEl();
         const members = selectionLib ? selectionLib.membersOf(blockSelection, blocks) : [];
+        // v3.17.3 A1: a selected image block shows its toolbar instead, and
+        // keeps the block selected for Esc to come back to.
+        if (from && members.length === 1 && isImageBlock(from) && openImageToolbarByKeyboard(from)) {
+          e.preventDefault();
+          return;
+        }
         if (from && members.length === 1 && !waveDiagramInside(from)) {
           e.preventDefault();
           clearBlockSelection();
@@ -24243,6 +25538,13 @@
       return;
     }
 
+    // Fix round 1 (R47): NOT waited for, unlike the toolbar's. A Ctrl+Z
+    // during a render is the R77 / R83 / R84 machinery's own input (the undo
+    // supersedes the render in flight, and its failures reconcile); routed
+    // through settledHistoryStep() it waited for the split instead, and 33
+    // render-guard: / raw-box: runs (both engines) lost their third render.
+    // Only the raw box whose commit is rendering waits (above), because there
+    // the press never reached the document at all.
     if ((e.ctrlKey || e.metaKey) && !e.shiftKey && e.key === 'z') {
       e.preventDefault();
       undo();
@@ -24551,6 +25853,15 @@
     if (e.cancelable) e.preventDefault();
     noteStaleScreenDrop();
   }, true);
+  // v3.17.3 B2 (R12): a text drop the editor took (wireTextDrop()) is written
+  // by moveDroppedText() alone; the browser's own halves of the move (the
+  // source's deleteByDrag, an insertFromDrop) never reach a surface, should
+  // an engine raise them after the cancelled drop (neither did, measured).
+  document.addEventListener('beforeinput', (e) => {
+    if (!textDrag || !textDrag.handled) return;
+    if (e.inputType !== 'deleteByDrag' && e.inputType !== 'insertFromDrop') return;
+    e.preventDefault();
+  }, true);
   document.addEventListener('compositionend', (e) => {
     if (!staleScreenInput(e.target) || !e.data) return;
     takeBackComposedText(e.data);
@@ -25880,6 +27191,7 @@
     b.type = 'button';
     b.className = 'ed-imgtb-btn' + (extraClass ? ' ' + extraClass : '');
     b.textContent = label;
+    b.tabIndex = -1; // 0 only while the toolbar is open by keyboard (A1)
     b.addEventListener('click', (e) => { e.stopPropagation(); onClick(); });
     imgTbButtons.appendChild(b);
     return b;
@@ -25895,6 +27207,14 @@
   let imgTbBlock = null;      // the .ed-block the toolbar is drawn for
   let imgTbHideTimer = null;
   let imgTbAlt = null;        // { identity, original } while the input is showing
+  // v3.17.3 A1: opened from a selected image block with Enter. The buttons are
+  // then in the Tab order (tabindex 0), the toolbar stays until Esc or focus
+  // leaves it, and it is repositioned on scroll instead of hidden.
+  let imgTbKeyboard = false;
+  // v3.17.3 A2: alt text typed and not applied when the image left the
+  // viewport and the field went away; the next 替代文字 on the same source
+  // starts from it. { source, value } or null.
+  let imgTbAltDraft = null;
 
   // An image block: a paragraph whose source is one image (D16) and whose
   // rendered content is exactly one img. .drawio / .xml keep their own flow.
@@ -25922,21 +27242,35 @@
     if (imgTbHideTimer !== null) { clearTimeout(imgTbHideTimer); imgTbHideTimer = null; }
   }
   function scheduleImageToolbarHide() {
-    if (imgTb.hidden || imgTbAlt || imgTbHideTimer !== null) return;
+    if (imgTb.hidden || imgTbAlt || imgTbKeyboard || imgTbHideTimer !== null) return;
     imgTbHideTimer = setTimeout(() => { imgTbHideTimer = null; if (!imgTbAlt) hideImageToolbar(); }, IMGTB_HIDE_MS);
   }
-  function hideImageToolbar() {
+  // `opts.keepDraft` (A2): the field went away because its image left the
+  // viewport, so the text typed in it is kept for the next 替代文字 on the
+  // same source. Every other way out discards it.
+  function hideImageToolbar(opts) {
     cancelImageToolbarHide();
     const wasAlt = imgTbAlt;
+    const wasKeyboard = imgTbKeyboard;
+    const hadFocus = imgTb.contains(document.activeElement);
+    if (wasAlt && opts && opts.keepDraft && imgTbInput.value !== wasAlt.original) {
+      const rec = imgTbBlock && imgTbBlock.isConnected ? blockRecOf(imgTbBlock) : null;
+      imgTbAltDraft = rec ? { source: blockSourceOf(rec), value: imgTbInput.value } : null;
+    } else imgTbAltDraft = null;
     imgTbAlt = null;
     imgTbBlock = null;
+    imgTbKeyboard = false;
+    imgTbButtonsEl.forEach((b) => { b.tabIndex = -1; });
     if (wasAlt) {
       imgTbInput.hidden = true;
       imgTbButtons.hidden = false;
       if (document.activeElement === imgTbInput) imgTbInput.blur();
+      setDirty();
     }
     if (imgTb.hidden) return;
     imgTb.hidden = true;
+    // Opened by keyboard: focus goes back to the block selection it came from.
+    if (wasKeyboard && hadFocus && blockSelection) applySelectionClasses();
   }
   function reconcileImageToolbar() {
     if (imgTbBlock !== null && !imgTbBlock.isConnected) hideImageToolbar();
@@ -25944,10 +27278,10 @@
   function placeImageToolbar(blockEl) {
     const img = blockEl.querySelector('img');
     const r = img ? img.getBoundingClientRect() : null;
-    if (!r || (r.width === 0 && r.height === 0)) { hideImageToolbar(); return false; }
+    if (!r || (r.width === 0 && r.height === 0)) { hideImageToolbar({ keepDraft: true }); return false; }
     imgTb.hidden = false;
     const top = Math.max(r.top + IMGTB_INSET_PX, toolbarTopInset() + 4);
-    if (top > r.bottom - 4) { hideImageToolbar(); return false; }
+    if (top > r.bottom - 4) { hideImageToolbar({ keepDraft: true }); return false; }
     imgTb.style.top = Math.round(top) + 'px';
     imgTb.style.left = Math.round(Math.max(4, Math.min(r.left + IMGTB_INSET_PX,
       document.documentElement.clientWidth - imgTb.offsetWidth - 4))) + 'px';
@@ -25966,24 +27300,40 @@
   // everything that could have moved it (R104: by source, and only when it is
   // the one such block), one commitRangeEdit over its line, nothing written
   // when the source reads the same. false: refused or the render failed.
-  async function applyImageEdit(blockEl, identity, patch) {
-    if (!identity || !inlineMd) return false;
+  //
+  // `trace` (A4), when given, learns whether the file now refers to the new
+  // destination: `referenced` is false after a refusal or a failed render
+  // (rolled back), true when it landed, was superseded by a newer render
+  // (the commit stands), or changed nothing.
+  async function applyImageEdit(blockEl, identity, patch, trace) {
+    const note = (v) => { if (trace) trace.referenced = v; };
+    if (!identity || !inlineMd) { note(false); return false; }
     await settleCommits();
     const ok = await switchAwayFrom();
-    if (!ok) return false;
+    if (!ok) { note(false); return false; }
     let el = blockEl && blockEl.isConnected ? blockEl : null;
     let rec = el ? blockRecOf(el) : null;
     if (!rec || blockSourceOf(rec) !== identity.source || identity.reconcileEpoch !== reconcileEpoch) {
       el = uniqueBlockElBySource(identity);
       rec = el ? blockRecOf(el) : null;
     }
-    if (!el || !rec || reconcileBlocksCommits()) { showError(DROPPED_GESTURE_MESSAGE, null, null); return false; }
+    if (!el || !rec || reconcileBlocksCommits()) { note(false); showError(DROPPED_GESTURE_MESSAGE, null, null); return false; }
     const source = blockSourceOf(rec);
     const next = inlineMd.rewriteImage(source, patch);
-    if (next === source) return true;
+    if (next === source) { note(true); return true; }
     const r = await commitFencedRangeAndRender(rec.startLine, rec.endLine, next);
+    note(r !== false && r !== null);
     return r === true;
   }
+  // A4: a file this page uploaded and the file then did not take. The server
+  // deletes only what its own POST /api/asset wrote; any failure is ignored,
+  // the orphan is what it was before this call.
+  function discardUploadedAsset(assetPath) {
+    try {
+      fetch('/api/asset?fileId=' + encodeURIComponent(String(ED.fileId)) + '&path=' + encodeURIComponent(assetPath),
+        { method: 'DELETE', headers: { 'content-type': 'application/json' } }).catch(() => {});
+    } catch (e) { /* ignored */ }
+  }
 
   // 替換 (and T8's drop): the picked file replaces the picture, keeping alt
   // and title. A file that is not a raster picture writes nothing (R39).
@@ -26014,17 +27364,36 @@
     if (!live) { showError(DROPPED_GESTURE_MESSAGE, null, null); return false; }
     const path = await uploadImageBlob(file);
     if (!path) return false;
-    return applyImageEdit(el, live, { dest: markdownImageDest(path) });
+    // A4: the paragraph can change while the upload is out; the edit is then
+    // refused, and the file it uploaded must not stay behind in assets/.
+    const trace = { referenced: undefined };
+    let applied = false;
+    try {
+      applied = await applyImageEdit(el, live, { dest: markdownImageDest(path) }, trace);
+    } finally {
+      if (!applied && trace.referenced === false) discardUploadedAsset(path);
+    }
+    return applied;
   }
 
-  function exitImageAltMode() {
+  // `refocus`: focus goes back to the button that opened the field. Only Esc
+  // asks for it, and a blur whose focus stays inside the toolbar. Final review
+  // I2: a blur to anything else (a click into the text) is where the user is
+  // going, and chrome never steals an edit — measured before, the click left
+  // focus on 替代文字 and the next keys never reached the text.
+  function exitImageAltMode(refocus) {
     if (!imgTbAlt) return;
     imgTbAlt = null;
-    imgTbInput.hidden = true;
+    imgTbAltDraft = null;
     imgTbButtons.hidden = false;
+    // By keyboard, focus goes to the button that opened the field (moved
+    // before the field is hidden, so the toolbar never sees focus leave).
+    if (imgTbKeyboard && refocus === true) imgTbAltButton.focus({ preventScroll: true });
+    imgTbInput.hidden = true;
     if (document.activeElement === imgTbInput) imgTbInput.blur();
     if (imgTbBlock) placeImageToolbar(imgTbBlock);
     scheduleImageToolbarHide();
+    setDirty();
   }
   async function openImageAltMode() {
     const first = imgTbBlock;
@@ -26040,15 +27409,25 @@
     const parsed = inlineMd.parseImageParagraph(blockSourceOf(blockRecOf(live)));
     imgTbBlock = live;
     imgTbAlt = { identity: captureBlockIdentity(live), original: parsed.alt };
+    const draft = imgTbAltDraft && imgTbAltDraft.source === blockSourceOf(blockRecOf(live)) ? imgTbAltDraft : null;
+    imgTbAltDraft = null;
     imgTbButtons.hidden = true;
     imgTbInput.hidden = false;
-    imgTbInput.value = parsed.alt;
+    imgTbInput.value = draft ? draft.value : parsed.alt;
     if (!placeImageToolbar(live)) return;
     imgTbInput.focus({ preventScroll: true });
-    imgTbInput.select();
+    if (draft) imgTbInput.setSelectionRange(draft.value.length, draft.value.length);
+    else imgTbInput.select();
+    setDirty();
   }
   imgTbInput.addEventListener('keydown', (e) => {
-    if (e.key === 'Escape') { e.preventDefault(); e.stopPropagation(); exitImageAltMode(); return; }
+    if (e.key === 'Escape') {
+      // A5: an Esc that belongs to an IME composition cancels the composition,
+      // not the field (the Enter branch below has the same guard). It stays
+      // off the document handlers, whose Esc rungs would act on it.
+      if (e.isComposing || e.keyCode === 229) { e.stopPropagation(); return; }
+      e.preventDefault(); e.stopPropagation(); exitImageAltMode(true); return;
+    }
     if (e.key !== 'Enter' || e.isComposing) return;
     e.preventDefault();
     e.stopPropagation();
@@ -26059,7 +27438,12 @@
     if (!alt || value === alt.original) return;
     applyImageEdit(blk, alt.identity, { alt: value }).catch(showUnexpectedFailure);
   });
-  imgTbInput.addEventListener('blur', () => { if (imgTbAlt) exitImageAltMode(); });
+  imgTbInput.addEventListener('blur', (e) => {
+    if (!imgTbAlt) return;
+    const to = e.relatedTarget;
+    exitImageAltMode(!!(to && to.nodeType === 1 && to.closest('.ed-imgtb')));
+  });
+  imgTbInput.addEventListener('input', () => { setDirty(); });
 
   // Final review I1: the 🖼 path's order (pickAndInsertImage()). The press
   // resolves any open session first and takes the block's identity while its
@@ -26082,7 +27466,7 @@
     if (!blk || !blk.isConnected) return;
     pickReplacementImage(blk).catch(showUnexpectedFailure);
   });
-  addImgTbButton('替代文字', '', () => { openImageAltMode().catch(showUnexpectedFailure); });
+  const imgTbAltButton = addImgTbButton('替代文字', '', () => { openImageAltMode().catch(showUnexpectedFailure); });
   addImgTbButton('刪除', 'ed-imgtb-delete', () => {
     const blk = imgTbBlock;
     hideImageToolbar();
@@ -26091,21 +27475,79 @@
     deleteBlockViaGutter(blk).catch(showUnexpectedFailure);
   });
 
+  const imgTbButtonsEl = [].slice.call(imgTbButtons.children);
+
+  // A1: the keyboard way in. Enter on one selected image block shows the
+  // toolbar and puts focus on 替換; Tab / Shift+Tab and the left / right
+  // arrows walk the three buttons (round the ends), Enter or Space presses
+  // one, Esc goes back to the block selection. The block stays selected the
+  // whole time. false: nothing was shown (the caller keeps its old Enter).
+  function openImageToolbarByKeyboard(blockEl) {
+    if (waveEditorIsModal() || !blockEl || !blockEl.isConnected || !isImageBlock(blockEl)) return false;
+    cancelImageToolbarHide();
+    if (imgTbAlt) exitImageAltMode();
+    try { blockEl.scrollIntoView({ block: 'nearest' }); } catch (e) { /* ignored */ }
+    imgTbBlock = blockEl;
+    imgTbButtons.hidden = false;
+    imgTbInput.hidden = true;
+    if (!placeImageToolbar(blockEl)) return false;
+    imgTbKeyboard = true;
+    imgTbButtonsEl.forEach((b) => { b.tabIndex = 0; });
+    imgTbButtonsEl[0].focus({ preventScroll: true });
+    return true;
+  }
+  imgTb.addEventListener('keydown', (e) => {
+    if (e.target === imgTbInput || !imgTbKeyboard) return;
+    if (e.ctrlKey || e.metaKey) return; // Ctrl+S and the like stay the document's
+    // Nothing else may reach the document handlers: with a block selected
+    // they would read Enter as "open the source" and Tab as "next block".
+    e.stopPropagation();
+    if (e.key === 'Escape') { e.preventDefault(); hideImageToolbar(); return; }
+    const at = imgTbButtonsEl.indexOf(document.activeElement);
+    const step = e.key === 'ArrowRight' || (e.key === 'Tab' && !e.shiftKey) ? 1
+      : e.key === 'ArrowLeft' || (e.key === 'Tab' && e.shiftKey) ? -1 : 0;
+    if (step === 0) return;
+    e.preventDefault();
+    const n = imgTbButtonsEl.length;
+    imgTbButtonsEl[((at < 0 ? 0 : at) + step + n) % n].focus({ preventScroll: true });
+  });
+  // Focus leaving the toolbar for good (a click elsewhere) ends the keyboard
+  // mode. Decided after the event: moving focus between the buttons, or into
+  // the alt field, passes through a moment with none.
+  imgTb.addEventListener('focusout', () => {
+    if (!imgTbKeyboard) return;
+    setTimeout(() => {
+      if (imgTbKeyboard && !imgTbAlt && !imgTb.hidden && !imgTb.contains(document.activeElement)) hideImageToolbar();
+    }, 0);
+  });
+
   // Presses keep focus where it is; the alt input is the one thing that takes it.
   imgTb.addEventListener('mousedown', (e) => { if (e.target !== imgTbInput) e.preventDefault(); });
   document.addEventListener('mouseover', (ev) => {
     const t = ev.target;
-    if (!t || typeof t.closest !== 'function' || imgTbAlt) return;
+    if (!t || typeof t.closest !== 'function' || imgTbAlt || imgTbKeyboard) return;
     if (t.closest('.ed-imgtb')) { cancelImageToolbarHide(); return; }
     const blk = t.closest('.ed-block[data-block-type="paragraph"]');
     if (blk && isImageBlock(blk)) showImageToolbarFor(blk); else scheduleImageToolbarHide();
   }, true);
   document.documentElement.addEventListener('mouseleave', () => { scheduleImageToolbarHide(); });
+  // A2: while the alt field is open (or the toolbar was opened by keyboard) a
+  // scroll or resize moves the toolbar with its image instead of closing it;
+  // it goes only when the image has left the viewport, and the typed text is
+  // kept for the next 替代文字 on the same source. A hover toolbar still closes
+  // at once.
+  function repositionOrHideImageToolbar() {
+    if (!(imgTbAlt || imgTbKeyboard)) { hideImageToolbar(); return; }
+    const img = imgTbBlock && imgTbBlock.isConnected ? imgTbBlock.querySelector('img') : null;
+    const r = img ? img.getBoundingClientRect() : null;
+    if (r && r.bottom > 0 && r.top < document.documentElement.clientHeight) placeImageToolbar(imgTbBlock);
+    else hideImageToolbar({ keepDraft: true });
+  }
   document.addEventListener('scroll', (ev) => {
     if (ev.target === imgTbInput || imgTb.contains(ev.target)) return;
-    hideImageToolbar();
+    repositionOrHideImageToolbar();
   }, { passive: true, capture: true });
-  window.addEventListener('resize', () => { hideImageToolbar(); });
+  window.addEventListener('resize', () => { repositionOrHideImageToolbar(); });
 
   // ── v3.17.0 T5: the diagram panel — the source and a live preview (D15) ──
   //
@@ -26155,6 +27597,7 @@
   }
   function disposeDiagramPanel(s) {
     if (s.timer) { clearTimeout(s.timer); s.timer = null; }
+    if (s.historyTimer) { clearTimeout(s.historyTimer); s.historyTimer = null; }
     s.previewSeq++; // an answer still out lands nowhere
     s.listeners.abort();
     if (s.offTheme) { s.offTheme(); s.offTheme = null; }
@@ -26279,6 +27722,7 @@
       originalHtml: blockEl.innerHTML, darkAtOpen: diagramThemeIsDark(),
       timer: null, previewSeq: 0, inflight: null, lastResult: undefined, reentering: null, pressInside: false,
       listeners: new AbortController(), offTheme: null, editor: null,
+      history: null, historyTimer: null, composing: false,
     };
     s.editor = {
       blockEl,
@@ -26302,9 +27746,24 @@
     ta.focus({ preventScroll: true });
     if (o.seed) ta.setSelectionRange(o.seed.selStart, o.seed.selEnd);
     else ta.setSelectionRange(0, 0);
+    // v3.17.3 C7: the panel's own text history, the code edit's model. The
+    // Ctrl+S re-entry hands the closing panel's history to this one (what
+    // was typed before the save stays undoable); any other open starts one.
+    s.history = (o.seed && o.seed.history) || new codeEditLib.TextHistory({ text: ta.value, selStart: ta.selectionStart, selEnd: ta.selectionEnd });
+    if (o.seed && o.seed.history) pushDiagramHistory(s);
 
     const on = { signal: s.listeners.signal };
-    ta.addEventListener('input', () => { autoSize(ta); scheduleDiagramPreview(s); setDirty(); }, on);
+    ta.addEventListener('input', () => { autoSize(ta); scheduleDiagramPreview(s); scheduleDiagramHistory(s); setDirty(); }, on);
+    ta.addEventListener('compositionstart', () => { s.composing = true; }, on);
+    ta.addEventListener('compositionend', () => { s.composing = false; scheduleDiagramHistory(s); }, on);
+    // The browser's own undo (a menu, a gesture) steps the panel's history
+    // too, never the textarea's native stack (a history step sets the value
+    // and empties that).
+    ta.addEventListener('beforeinput', (e) => {
+      if (e.inputType !== 'historyUndo' && e.inputType !== 'historyRedo') return;
+      e.preventDefault();
+      stepDiagramHistory(s, e.inputType === 'historyUndo' ? -1 : 1);
+    }, on);
     panel.addEventListener('keydown', (e) => onDiagramPanelKeydown(s, e), on);
     // R36: a press inside never ends the panel. On anything but the source
     // and the preview it keeps focus where it is; a focusout with no
@@ -26358,18 +27817,28 @@
     else if (e.key === 'Enter' && mod) act = 'commit';
     else if (mod && !e.altKey && !e.shiftKey && (e.key === 's' || e.key === 'S')) act = 'save';
     else if (e.key === 'Tab' && !mod && !e.altKey && !e.shiftKey && e.target === s.ta) act = 'tab';
+    else if (mod && !e.altKey && !e.shiftKey && (e.key === 'z' || e.key === 'Z')) act = 'undo';
+    else if (mod && !e.altKey && ((!e.shiftKey && (e.key === 'y' || e.key === 'Y')) ||
+        (e.shiftKey && (e.key === 'z' || e.key === 'Z')))) act = 'redo';
     if (!act) return;
     e.preventDefault();
     e.stopPropagation();
-    if (act === 'tab') { insertIntoDiagramSource(s.ta, '  '); return; }
+    if (act === 'tab') {
+      // One step of its own, after the typing before it.
+      flushDiagramTyping(s);
+      insertIntoDiagramSource(s.ta, '  ');
+      flushDiagramTyping(s);
+      return;
+    }
+    if (act === 'undo' || act === 'redo') { stepDiagramHistory(s, act === 'undo' ? -1 : 1); return; }
     if (s.reentering) { s.reentering[act] = true; return; }
     if (s.inflight || liveDiagramPanel() !== s) return; // a commit is out: it ends the panel, or leaves it open on failure
     if (act === 'cancel') cancelDiagramPanel(s).catch(showUnexpectedFailure);
     else if (act === 'commit') commitDiagramPanel(s).catch(showUnexpectedFailure);
     else commitDiagramPanelAndReenter(s, { save: true }).catch(showUnexpectedFailure);
   }
-  // Through the browser's own insertText, so the textarea's native undo
-  // (Ctrl+Z inside it) takes the two spaces back too.
+  // Through the browser's own insertText (its input event schedules the
+  // preview); Ctrl+Z takes the two spaces back through the panel's history.
   function insertIntoDiagramSource(ta, text) {
     let ok = false;
     try { ok = document.execCommand('insertText', false, text); } catch (e) { ok = false; }
@@ -26379,6 +27848,45 @@
     }
   }
 
+  // v3.17.3 C1 / C7: the panel's text history, stepped by Ctrl+Z / Ctrl+Y in
+  // the panel and by the toolbar's 復原 / 重做 while it is open. A step at
+  // most once per idle tick of typing (CODE_EDIT_TICK_MS, the code edit's),
+  // never inside an IME composition. A step changes the panel's text only:
+  // the file is reached when the panel commits, as one document step.
+  function pushDiagramHistory(s) {
+    const ta = s.ta;
+    s.history.push({ text: ta.value, selStart: ta.selectionStart, selEnd: ta.selectionEnd });
+  }
+  function scheduleDiagramHistory(s) {
+    if (s.historyTimer) clearTimeout(s.historyTimer);
+    s.historyTimer = setTimeout(() => {
+      s.historyTimer = null;
+      if (liveDiagramPanel() !== s || s.composing) return;
+      pushDiagramHistory(s);
+    }, CODE_EDIT_TICK_MS);
+  }
+  function flushDiagramTyping(s) {
+    if (s.historyTimer) { clearTimeout(s.historyTimer); s.historyTimer = null; }
+    if (!s.composing) pushDiagramHistory(s);
+  }
+  function stepDiagramHistory(s, dir) {
+    flushDiagramTyping(s);
+    const snap = dir < 0 ? s.history.undo() : s.history.redo();
+    if (!snap) return; // nothing left: the document stack is never reached from here
+    const ta = s.ta;
+    ta.value = snap.text;
+    if (document.activeElement === ta) ta.setSelectionRange(snap.selStart, snap.selEnd);
+    autoSize(ta);
+    scheduleDiagramPreview(s);
+    setDirty(); // R47: the dot and the status follow the panel's text
+  }
+  // Whether the panel is open right now, with no side effect (unlike
+  // liveDiagramPanel(), which disposes a panel a render took away).
+  function diagramPanelIsOpen() {
+    const s = diagramPanelState;
+    return !!s && activeEditor === s.editor && s.panel.isConnected;
+  }
+
   function scheduleDiagramPreview(s) {
     if (s.timer) clearTimeout(s.timer);
     s.timer = setTimeout(() => { s.timer = null; runDiagramPreview(s); }, DIAGRAM_PREVIEW_MS);
@@ -26574,6 +28082,7 @@
     const ta = s.ta;
     const startLine = s.startLine;
     const sent = ta.value; // what this commit writes
+    flushDiagramTyping(s); // v3.17.3 C7: the typing before the save is a step of the history carried on
     const flags = { cancel: false, commit: false, save: false };
     s.reentering = flags;
     const hold = { keys: [], clickedAway: false, passTarget: ta };
@@ -26593,7 +28102,7 @@
     if (!target && ok && !hold.clickedAway && s.lastResult !== RENDER_SUPERSEDED) {
       const el = blockElAtLine(startLine);
       const seed = { value: ta.value, selStart: ta.selectionStart, selEnd: ta.selectionEnd,
-        previewHtml: s.preview.innerHTML };
+        previewHtml: s.preview.innerHTML, history: s.history };
       if (el && diagramPanelKindOf(el, s.kind) && await openDiagramPanel(el, { seed, kind: s.kind })) target = liveDiagramPanel();
     }
     if (ok && opts.save) saveAfterLastSave();
@@ -26643,7 +28152,7 @@
         dropped = true;
       }
     }
-    if (changed) { autoSize(ta); scheduleDiagramPreview(s); setDirty(); }
+    if (changed) { autoSize(ta); scheduleDiagramPreview(s); flushDiagramTyping(s); setDirty(); }
     if (dropped) showNotice(FLIGHT_DROPPED_MESSAGE);
     return leave;
   }
@@ -27313,7 +28822,7 @@
     const back = popped.length === offer.count &&
       lines.slice(b.startLine, b.startLine + n).join('\n') === offer.baseSource;
     if (back) setDirty();
-    const ok = back && await safeRerenderAll({
+    const ok = back && await historyRerender({
       startLine: b.startLine + 1, endLine: b.startLine + n, delta: lines.length - prevLines.length,
     });
     if (!ok) {
@@ -27351,7 +28860,7 @@
     if (ok) {
       setDirty();
       const b = blocks.find((x) => x.id === ro.offer.blockId);
-      ok = await safeRerenderAll(b ? { startLine: b.startLine + 1, endLine: b.startLine + 1,
+      ok = await historyRerender(b ? { startLine: b.startLine + 1, endLine: b.startLine + 1,
         delta: lines.length - prevLines.length } : undefined);
     }
     if (!ok) {