@quillmark/wasm 0.111.0 → 0.113.0

package/CHANGELOG.md

@@ -1,5 +1,1747 @@
 # Changelog
 
+## v0.113.0 - 2026-09-16
+
+Upgrade path: [0.112 → 0.113](docs/migrations/0.112-to-0.113.md).
+
+### The content model
+
+- fix(content): **a marker run that spells a thematic break breaks its line.**
+  Three nested empty bullet items emitted `- - - `, which CommonMark reads as a
+  thematic break rather than as three items, so the nesting was gone after one
+  pass; `> + + +` and any deeper run went the same way. Changing a bullet char is
+  the obvious way out and is not available — a different char starts a new list,
+  resetting `ordinal` on that item and every one after it, and the empty item can
+  share its list with a non-empty sibling. The item's content moves to the next
+  line instead (`-\n  - - `), which no marker char and no list identity depends
+  on. The check runs per level, so a run of any depth breaks into pieces of at
+  most two, and a line that never spelled a break emits the same bytes as before.
+  `delimiter_run()` takes `+` back, the token it was denied to keep this defect
+  from making that property flap. Closes #1809.
+- fix(content): **the projection's safety net verifies the marks a rendering
+  carries, not only its text.** `to_markdown` took the first spelling whose
+  emission re-imported with the text intact, and an ambiguous `***` run costs the
+  text in one shape and only the marks in another: `**a±**_b_**c**` lowered to
+  `**a±***b***c**`, which CommonMark re-segments into one `Strong` over all three
+  spans. Every character came back, so the net passed it — and bold moved onto
+  the `±b` the source did not bold, two spans became one, and the second emission
+  differed from the first. That last part is
+  `the_markdown_loop_settles_on_an_arbitrary_body` going red on main. The probe
+  now compares the re-imported marks against the ones the sweep was asked to
+  carry, and the whole search is keyed on that one predicate — the four spellings
+  first, then the drop-by-halves — so a rendering is taken only where it
+  re-imports as the content it rendered. Text is still the floor the search
+  cannot go below, `**`/`*` is still swept first, and a line that already
+  round-tripped emits the same bytes. Over 20M generated delimiter runs the
+  emissions needing a second pass to settle fall from 17 to 0, and the marks
+  that come back over text they did not cover fall with them, 17 to 0. Closes
+  #1807.
+- fix(content): **a mark whose delimiters collide with its neighbour's is
+  re-spelled, not dropped.** `to_markdown` spelled `Strong` `**` and `Emph` `*`
+  and nothing else, so a `Strong` ending in a literal `*` against an `Emph`
+  starting where it ends emitted a `***` run CommonMark re-segments rather than
+  pairs; the verify-and-drop net read the text drift that caused and dropped the
+  `Strong` to recover the text. `__a**__*b*` imported as `a**b` under
+  `Strong(0..3) Emph(3..4)` and exported as `a\*\**b*`, losing bold the round
+  trip was meant to carry, and `~~*a*~~` lost its `Emph` whenever the sweep put
+  `*` outside `~~`, where it has no non-punctuation to pair against. Markdown
+  spells both kinds a second way: the net now tries `__`/`_` before it drops
+  anything, and the asterisk family sorts innermost among marks over one span.
+  Every candidate is verified exactly as before, and `**`/`*` still leads, so a
+  line that already round-tripped emits the same bytes. Over 200k generated
+  delimiter runs the marks lost across export∘import fall from 104 to 14, the
+  remainder being the crossing tails `clip_asterisk_overlap` truncates by
+  design. Text was never at risk and does not move. Found reviewing #1801.
+- fix(content): **`Delta::map_pos` saturates its base cursor.** `mapPos` is the
+  one `Delta` door no `try_apply` bounds, and it summed a wire delta's
+  `retain`/`delete` counts with a plain `+`: on wasm32, where `usize` is
+  32-bit, `{ops:[{retain:3000000000},{retain:3000000000}]}` wrapped to a wrong
+  caret position in the published build and aborted the instance in the
+  checked one. `map_pos`, `is_deleted` and `inserted_spans` now walk the ops
+  with `saturating_add`, as `expected_base_len` already did: a run past
+  `usize::MAX` describes a base longer than any content, and a position lands
+  inside it as it would in a bounded one. Closes #1782.
+- refactor(content,wasm,python)!: **one canonical content form, a zero
+  `Container.instance` omitted.** Canonical JSON had two byte forms differing
+  only in whether a zero `instance` was written: storage omitted it, so a row
+  written before the field existed re-encodes byte for byte, and a second
+  encoder spelled it on every container so the published `ContentContainer`
+  type could require the field. Required bought no correctness — a checker
+  reports an omitted field, never the `0` stamped on two runs that welds them,
+  which is what `assignInstances` is for — and it cost a spelling a host had to
+  tell apart from the one storage holds. `serial::to_seam_value` goes;
+  `to_canonical_value` is the one encoder, and every `Content`-typed read
+  answers in it: `getContent{,At}`, `getStored` on a body, `importMarkdown`,
+  `rebase`, and the `Card` wire. TypeScript spells `instance?: number` on both
+  arms, and an absent key decodes to `0` as the spelled one did, so every write
+  takes either spelling and no stored byte moves. A host reading the key off a
+  read finds `undefined` where it found `0`: the break no type checker reports.
+  `emit`'s markdown projection of a content-valued field now matches one form
+  rather than two, so a value carrying a spelled zero stays a structural
+  mapping until it is conformed. Closes #1648.
+- feat(content,wasm)!: **the content vocabularies close.** A line `kind`,
+  container, mark `type`, island `type` or `loss` outside the built-ins was an
+  open set: it round-tripped opaque and projected as its nearest safe
+  neighbour. All five are closed, so a name outside them is
+  `ParseError::UnknownName { axis, name }` at every decoder and a stored row
+  holding one stops opening. Projecting an unknown `kind` as `para` would
+  re-encode the row and move canonical bytes on a read with no edit, which is
+  why refusing is the only honest reading. No first-party writer ever produced
+  another name, so the affected population is exactly the rows a host authored
+  one into through `overwrite`, `applyChange` or a card body. The mark axis
+  closes inside a table island's cells too, where the read is otherwise lenient
+  — `canon_cell` re-mints from what `parse_cell` returned, so a skipped name
+  would leave stored bytes behind on a read with no edit. A *malformed* cell
+  mark is still skipped; that split is about shape, not vocabulary. The three
+  `Unknown` carriers, `RESERVED_*` and the three `ReservedUnknown*` invariants
+  go; `Island::island_type` becomes the `IslandType` enum and `Loss` becomes
+  the enum `Fidelity` was. On the WASM surface the six unions lose their open
+  arm, so `line.kind === 'heading'` narrows `line.attrs` with no guard, and the
+  eleven content guards (`isTableIsland`, `isImageIsland`, `isLinkMark`,
+  `isAnchorMark`, `isHeadingLine`, `isCodeLine`, `isListItemContainer` and the
+  four `isUnknown*`) are deleted — each was one discriminant check the
+  narrowing now performs. The storage tag is unchanged: every byte the writer
+  emits is the same, and only the reader's accepted domain narrowed. Adding a
+  construct is a storage-version event from here on. Closes #1693.
+- refactor(content,wasm)!: **`Content::normalize` settles the lenient/strict
+  split alone.** Eleven `Invariant` arms named shapes the mint repairs — a
+  zero-width or newline-edged formatting mark, a `continues` flag on the first
+  line, across a container boundary or after a one-line block, a line kind its
+  text contradicts, the four table shapes, and a block island's slot sharing
+  its line — and every door mints before it validates, so each fired only on a
+  hand-built content. All of it goes: `validate` reports what normalization
+  cannot repair (a forbidden character with no substitute, two counts with no
+  rule saying which is right, a range or depth past a bound, a colliding id),
+  and `setKind` / `setContinues` land with the terminal normalize settling them
+  — a contradicted kind becomes `para`, an impossible `continues` clears, line
+  0 included. So `applyChange` resolves where it threw, and `Ok` stops meaning
+  the op landed as written: an editor mirroring ops into its own model reads
+  the content back. The one content-changing case is a heading retagged
+  `island` or `rule`, which is a paragraph afterward. `BadHeadingLevel` and the
+  block-island placement stay refused — the first has no principled rewrite,
+  the second is the authored lane's policy rather than a second reading of a
+  repair. `LineKindMismatch` leaves the crate, and so do
+  `ApplyError::LineKindMismatch`, `ContinuesAcrossContainers`,
+  `ContinuesSingleLineBlock` and `FirstLineContinues`;
+  `LineKind::takes_continuations` names the kinds a continuation is legal after
+  (`Para`, `Code`, `Unknown`), since export renders only the first line of a
+  heading, island or rule. Stored bytes are untouched, and the one reader
+  change is a loosening: a blob spelling `continues: true` on line 0 loads
+  cleared where it failed. Closes #1699.
+- feat(content)!: **a block-only island takes a line of its own in the model,
+  not only on the way out.** A `table`'s markdown is a block, so a slot spliced
+  into a paragraph exported as pipes mid-line — `a| h |\n| --- |\n| c |b` — and
+  re-imported as prose with the island gone. `Content::normalize` performs the
+  break the export used to perform at write time, so the model can no longer
+  hold a shape markdown cannot spell. `IslandOp::Insert` refuses an `at` that
+  is not an empty line, `IslandOp::Set` refuses retyping an inline island into
+  a block-only one (`ApplyError::BlockIslandNotAlone`), and `overwrite` refuses
+  the same placement through `serial::from_authored_value`. Storage stays
+  lenient: a stored blob in that shape loads already split with its marks
+  rebased, and `to_markdown` writes a paragraph, the table, and a paragraph, so
+  the island survives re-import. An accepted `LineOp::Join` that runs a slot
+  back into its prose is taken apart again by the mint. `normalize_markdown`
+  narrows to `pub(crate)`.
+- fix(content)!: **a link or image `url` carrying a line ending is refused
+  where it is authored, and percent-encoded where it is written.** CommonMark
+  admits no line ending in a destination, bare or angle-wrapped, so `"a\nb"`
+  exported as `[t](<a\nb>)`, which pulldown reads as an inline HTML tag: the
+  re-import came back `[t]()` with the mark gone, and an image the same way
+  with its island gone. An authored lane that *stores* a url now refuses one —
+  `MarkOp::Add` of a `link`, `IslandOp::Insert` and `IslandOp::Set` of an
+  `image`, and the whole-content doors (`overwrite`, `CardInput.body`) — the
+  way an unwritable code-fence `lang` is refused. `MarkOp::Remove` still takes
+  it, matching on kind equality against a mark the field already holds. Storage
+  stays lenient, and `to_markdown` writes the line ending as `%0A`/`%0D`.
+- fix(content): **an island alone on a line takes the line kind its type
+  projects.** An `image` slot alone on a `LineKind::Island` line and the same
+  slot on a `Para` line both wrote `![alt](url)`, which re-imports as `Para`,
+  and a `table` alone on a `Para` line wrote a pipe table, which re-imports as
+  `Island`: two normalized contents per document and one markdown, so any write
+  and read back flipped the kind. `IslandType::block_only` names which markup
+  is a block, and `normalize` writes the kind the round trip yields.
+- fix(content): **VT, FF, NEL, U+2028 and U+2029 in document text become a
+  space.** Typst's lexer reads all five as line breaks, so one mid-paragraph
+  reopens `at_start` and the characters behind it are read as a block marker —
+  `"intro\u{c}- item"` rendered a bullet — and two in a row split the
+  paragraph. No escape reaches them, a `\` before whitespace being Typst's own
+  linebreak. The spaced set is Typst's whole newline set less `\n`, named by
+  `normalize::is_line_separator`, refused by `validate`, and replaced at every
+  text ingress: `from_plaintext`, markdown import, an `Op::Insert` through
+  `apply_text_delta`, and a table cell's text. A space rather than a drop, both
+  being Unicode whitespace, so the words either side stay parted. Markdown-spec
+  §7 states it.
+- fix(content): **a paragraph emptied by HTML stripping leaves no line.**
+  `<span></span>` on its own imported as an empty `Para` line, which markdown
+  has no syntax to write, so `to_markdown` emitted a stray blank line and
+  re-import collapsed it. An empty heading, code block and container keep their
+  line, markdown being able to write those back.
+- fix(content): **a code span whose content touches its fence exports with the
+  CommonMark space pad.** Export emitted `fence + content + fence`, so an edge
+  backtick joined the fence run (text `` `a `` came back as ` ```a`` `) and a
+  span that begins and ends with a space lost one off each side on re-import. A
+  pad space now flanks the content in exactly those two cases, which import
+  strips back off; a span of nothing but spaces is exempt from the strip.
+- fix(content): **a mark flanking an unknown island's placeholder survives
+  export.** The verify-and-drop net re-imports the rendered line and expects
+  the line's own text back, island slot included, but a type this build has no
+  projection for renders as a comment placeholder that re-imports as nothing —
+  so the probe could never match and every `**` / `*` / `~~` on such a line was
+  dropped as unrepresentable. The expected text now omits the slots of islands
+  with no markdown projection, so the probe measures delimiter leakage alone.
+- fix(content): **`diff_import` carries unknown marks forward beside anchors.**
+  The rebase loop matched `MarkKind::Anchor` alone, so a full-document rewrite
+  through the stale-text writer lane dropped every open-set mark, even one over
+  text the rewrite left untouched. It rebases every non-formatting mark —
+  formatting is what the fresh import re-derives, and the rest lives in the
+  content but not in markdown.
+- fix(content): **a change bundle whose `retain`/`delete` counts sum past
+  `usize` is a base mismatch, not a panic.** `Delta::expected_base_len` summed
+  the counts unchecked, so `{"retain": 18446744073709551615}` aborted in debug
+  and wrapped in release, where the wrapped total let `apply` slice past the
+  base. The sum saturates past any real base, so `try_apply` and
+  `apply_field_change` return the `DeltaBaseMismatch` the contract already
+  names.
+- fix(content): **`change_bundle_from_value` reads camelCase keys only.** The
+  snake_case fallback served a Python content lane that does not exist.
+
+### Parsing and the card block
+
+- feat(core)!: **`---` front matter is CommonMark's, and the message names the
+  fence to write instead.** A `---` at document start paired with a later `---`
+  opened the root block. It is a thematic break and a setext underline again,
+  so a document fenced that way has no root block and fails `MissingQuill`. The
+  alias was accept-don't-emit-don't-advertise: no authoring page taught it,
+  `FORMAT_RULES` says the fence is exactly `~~~`, the blueprint emits `~~~`,
+  and `toMarkdown` rewrote a `---`-authored root to `~~~` on first re-emit.
+  What it cost was a rule that only half held — composable cards have no `---`
+  form — and the containment that took: a document-start rule, a matched-fences
+  rule, and a lookahead rejecting a `---` below the root block when a later
+  `---` paired with it over YAML-key-looking content. That lookahead read prose
+  it had no claim on. A thematic break, a paragraph opening `Note:`, and a
+  second break is ordinary markdown, and it was refused outright with a
+  composable-card error. The scanner now reads no `---` at all, so it claims
+  nothing a CommonMark renderer draws, and `missing_block_message` carries what
+  the tolerance was for: a document opening with `---` and declaring `$quill`
+  is told to replace the opening and closing `---` with `~~~`, which is the
+  edit. A `---` document *without* `$quill` keeps the generic message, which
+  names the fence and the key together rather than sending the author back for
+  a second turn. Refs #1698.
+- feat(core)!: **every column-zero `~~~` block is a card, whatever its info
+  string.** The opener's info string is no longer read. `~~~card-yaml` and
+  `~~~yaml` were accepted aliases and `~~~rust` opened an ordinary code block;
+  all of them open a card now. The spec already stated the widened rule in §3.2
+  and then exempted language info strings in the next sentence, so a tilde
+  escape hatch was half-promised and half-withheld — and already unavailable
+  for the two shapes anyone would reach for: a YAML block, claimed by the
+  `yaml` alias, and a nested backtick block, written with a bare `~~~`. Nothing
+  first-party emits a language-tagged tilde fence. A backtick fence is the
+  escape hatch, and the whole of it. The widening deletes what the exemption
+  needed: the accepted-alias list, the `RootFault::InfoString` diagnostic that
+  explained why `~~~metadata` opened no block, and `code_fence_info`, whose
+  last caller it was; `RootFault` collapses to the `UnclosedRoot` struct it now
+  is. CommonMark conformance is unchanged — `fence_conformance_tests` holds
+  every card block to a pulldown-cmark fenced span at the same offsets — so the
+  widening moves toward equality rather than away. The `body.example` blueprint
+  guard tightens with the parser it delegates to. `docs/cli/reference.md` and
+  `prose/canon/CLI.md` stop naming an alternative opener. Refs #1698.
+- fix(core)!: **`main:` parses under the same strict card-schema shape as a
+  card kind.** A `main:` that is not a mapping, an unknown key under it
+  (`feilds:`, `title:`), and a `main.fields` that is not a mapping all loaded
+  as a main card with zero fields and no diagnostic; each is now
+  `quill::invalid_card_schema`. `main` and `card_kinds.<name>` accept
+  `description`, `fields`, `ui` and `body` only, and a malformed `ui` or `body`
+  block under either reports `quill::invalid_ui` or `quill::invalid_body` with
+  the hint naming that block's keys, where a card kind drew the whole-card
+  refusal.
+- fix(core)!: **the §8 count caps report a count, not a byte size.** The
+  card-count and per-block field-count caps raised `parse::input_too_large`,
+  whose one message shape is `Input too large: {size} bytes (max: {max}
+  bytes)`, so 1001 fields read as 1001 bytes. Each cap has its own variant and
+  code: `ParseError::TooManyFields` / `parse::too_many_fields` and
+  `ParseError::TooManyCards` / `parse::too_many_cards`, both carrying `count`
+  and `max`. `parse::input_too_large` keeps the two byte caps.
+- change(core)!: **YAML nesting depth is the parser's to bound, and
+  `MAX_YAML_DEPTH` is gone.** The constant set `serde_saphyr`'s depth budget
+  and doubled as the bound on host values crossing into the document, so one
+  number spoke for two unrelated limits. YAML parsing runs on `serde_saphyr`'s
+  own budget, and the write surfaces (`store_field`, `store_ext`, the wire and
+  storage DTOs, the bindings' converters) bound values at `MAX_JSON_DEPTH`
+  (128), the depth storage already accepts — raising the accepted depth on
+  those paths from 100. `§8 Limits` no longer fixes a YAML nesting number.
+- refactor(core)!: **prescan's cleaned YAML is line-for-line with its source.**
+  A comment line was dropped from the string handed to the parser, so the two
+  numberings diverged and a `PreScan::source_lines` table existed to map a
+  reported position back. The line passes through — it is a comment to the
+  parser too — and the table, the `Cleaned` pair it rode in, and the
+  fall-back-to-the-last-line lookup go with it. Blanking the line instead is
+  what this does *not* do: a blank line is content under keep chomping, so
+  `bio: |+` followed by a comment would have gained a newline. One break: a
+  comment indented inside a multi-line plain scalar now ends it, as it does in
+  YAML, so `key: aaa` / `  # c` / `  bbb` raises a located `parse::yaml_error`
+  where it used to fold to `"aaa bbb"` — a value no YAML parser reads out of
+  that document.
+- refactor(core)!: **nested comments hang off the payload, not each item.**
+  `PayloadItem::Field` / `Meta` lose `nested_comments`; one list on `Payload`
+  carries them, at paths whose head segment names the owning entry. That is the
+  form prescan already produced and the storage DTO already stored, so the flat
+  → per-item → flat conversion at both ends is gone. `Payload` gains the public
+  `nested_comments()` and `rename_field`, which carries a field's comments with
+  its key; `items_mut` is withdrawn, having existed only for the rename that
+  now has a verb. The wire is untouched: `PayloadV0_92_0.nested_comments` was
+  already the flat sidecar.
+- fix(core): **an unclosed root `~~~` block is reported as unclosed.** A
+  document that opens with `~~~` and `$quill` but never closes the fence drew
+  the generic `parse::missing_quill` text, telling the author to open a block
+  they had already opened while the scanner's unclosed-fence signal was
+  dropped. The message names the opener's line, the field to close after, and —
+  for a `~~` run or an indented `~~~` — the line that failed to close it.
+- fix(core)!: **a card-yaml parse failure carries a document `Location`.**
+  `YamlErrorWithLocation` keeps the engine's line and column, translated
+  through the comment lines prescan drops and the leading whitespace `trim`
+  removes onto the document's own coordinates, and `to_diagnostic()` sets them
+  as the `Location` (`input.md`). The message names the block (`YAML error in
+  the root card-yaml block: …`) in place of the block-relative `at line N
+  (block K)` prefix, and `args` no longer carries `line`.
+- fix(core): **a card fence with CRLF line endings parses as its LF twin
+  does.** The prescan splits the fence body on `\n`, so every CRLF line reached
+  the matchers with a trailing `\r`: a bare `x: !must_fill` matched neither
+  spelling the fill-tag stripper accepts, so the marker was read as an unknown
+  tag — dropped with two warnings, a `null` value and an `x: null` emit — and a
+  lone `-` opening a sequence item was not one. The scan strips one trailing
+  `\r` per line up front.
+- fix(core): **`key: !must_fill` written inside a block scalar or a quoted
+  scalar is that scalar's text, and warns about nothing.** The
+  `parse::fill_marker_unsupported_position` check re-read every cleaned line
+  after the prescan, block-scalar bodies among them, and accepted any `:` plus
+  whitespace as the tag's left boundary. The prescan decides the warning per
+  line as it reads one, where a block-scalar body and a quoted value are known
+  for what they are; the four positions the marker genuinely cannot survive
+  still warn.
+- fix(core): **a `!must_fill` marker nested inside `$seed` or `$ext` warns
+  instead of vanishing.** A `$` metadata value is a plain tree with no fill
+  carrier, so a marker under one reached neither storage nor emit and the cell
+  it marked read back as `null`. Parse emits a
+  `parse::fill_marker_unsupported_position` warning naming the cell
+  (`$seed.note.from`). The value under the marker is kept; a marker on the `$`
+  key itself remains a parse error.
+- fix(core): **a field name is ASCII as written, not as it normalises.**
+  `is_valid_field_name` ran NFC before matching `[A-Za-z_][A-Za-z0-9_]*`, so
+  `store_field("\u{212A}elvin", …)` was accepted, emitted verbatim, and re-read
+  as a nested key: the document did not survive `parse(to_markdown())`. The
+  check reads the name's own characters, matching the raw bytes the parser's
+  key grammar accepts.
+- fix(core): **a new `$` entry lands after the preceding `$` line's inline
+  comment, not between the line and its comment.** `Payload::upsert_meta`
+  inserted one past the last lower-ranked `$` item, which is the index the
+  trailing comment occupies, so `$quill: q@1.0 # note` with no explicit `$kind`
+  emitted `$kind: main # note`. The four callers now leave the trailer on its
+  own key and `parse(to_markdown())` holds.
+- fix(core): **a comment between a bare `-` and the item's first key stays
+  inside the item.** The prescan records such a comment against the item, but
+  emit wrote it above the `- ` line, where it re-parses as a comment on the
+  sequence — a parse-emit-parse inequality settling only on the second emit. A
+  sequence item whose mapping carries an own-line comment before its first key
+  emits in the bare-dash form, so the first emit is the fixed point. A
+  blueprint's typed-table row takes that form too.
+- fix(core): **a field write clears a root `!must_fill` bit riding on the value
+  it is handed.** The payload item's own `fill` flag is the one carrier of a
+  root marker — emit, the wire and the storage DTO all read it there — while
+  `QuillValue::set_fill_at(&[])` marks the value tree's root, and a value
+  stored after that call kept both bits. `Payload` clears the tree's root bit
+  on insert, so a document compares equal to itself across the markdown and
+  storage round trips. Parse skips a nested-fill path naming only its own key,
+  the route reaching the same split from source.
+- fix(core): **`Card::store_fields` refuses a `!must_fill` marker targeting a
+  mapping, as `Card::store_field` does.** The batch checked the field-name
+  grammar and value depth only, so a marker on a nested object node was stored,
+  emitted with the marker dropped, and refused by the `@0.92.0` storage DTO on
+  reload. `edit::validate_fill_targets` runs per field in the same
+  all-or-nothing pass, so the offending name rides the batch's error vector as
+  `edit::fill_on_mapping`. The WASM `storeFields` inherits it.
+- fix(core): **a `ParseError` spells its English once.** `to_diagnostic()`
+  renders the variant's `Display` instead of a second copy of the same
+  sentence, and the copies had drifted: `InvalidStructure` displayed under an
+  `Invalid YAML structure: ` prefix the diagnostic dropped. A Rust caller
+  formatting `{err}` from `Document::parse` reads that variant without the
+  prefix, matching what every binding and the CLI have always shown.
+- fix(core): **body prose left inside a card block is told to close the block,
+  not to wrap itself in a block scalar.** A closing `~~~` placed after the
+  prose body fails YAML on the first prose line, and `simple key expected`
+  answered every such line with the wrapped-scalar advice: rewriting the memo
+  as `body: |` keeps the body inside the block and fails again. The hint reads
+  the flagged line the parser names and names the real fix — close the block
+  before the prose. A genuine plain scalar wrapped onto a second line keeps the
+  block-scalar hint.
+- fix(core): **a leading space before a top-level key gets its own hint.** One
+  stray space folds the line into the preceding plain scalar, and YAML raises
+  the same `mapping values are not allowed` an unquoted `:` inside a value
+  raises — so the hint sent the reader hunting for a colon that is not in the
+  block, and four models quoted the `subject:` above it instead. Where the
+  flagged line starts with a space, reads as `key:` or `key: value`, and
+  follows a column-zero key line, the hint names the space.
+
+### The binding surface
+
+- refactor(core,typst,wasm,python)!: **a diagnostic carries its cause in the
+  message.** `Diagnostic::source_chain` and the `with_source` builder that
+  filled it are gone, and with them JS `Diagnostic.sourceChain` and Python
+  `Diagnostic.source_chain`. One code ever filled the field:
+  `typst::world_creation`, whose boxed cause is a `String` whose `source()` is
+  `None`, so the chain was a one-element array holding the text its own message
+  already ends with — and `skip_serializing_if` omitted the field from every
+  other diagnostic. No formatter read it: `fmt_pretty` covers severity, message,
+  code, location and hint, so the CLI's output and Python's `str(diagnostic)`
+  are byte-identical. A Rust caller attaching a cause interpolates it into the
+  message, which is what `RenderError::coded` already does at the one call site.
+  Refs #1748.
+- build(wasm): **three artifacts to two: the `render` build carries both
+  backends.** The core split (no engine, ~0.5 MB) is real for a web editor and
+  stays guarded. A pdfform-only binary bought "a pdfform-only page skips 8 MB
+  of Typst", and no such page exists; the render artifact grows by the
+  `quillmark-pdfform` crate and a brotli decoder, `hayro` already shipping in
+  it under `typst-render`. The wasm `typst` and `pdfform` features collapse
+  into one `render` feature — a feature named for one backend that selects two
+  would be a fresh inaccuracy in place of the one #1749 records — and the
+  forty-three `#[cfg(any(feature = "typst", feature = "pdfform"))]` sites
+  become `#[cfg(feature = "render")]`. `build-wasm.sh` emits `pkg/core/` and
+  `pkg/render/`; `runtime.js` keeps one `DEFAULT_BACKENDS` entry per backend
+  id, each with its own `formats` manifest, sharing one memoized load, and the
+  `Engine` keys its module, engine and clone caches on the descriptor's `load`
+  thunk rather than the backend id, so two ids over one build hold one entry
+  each. Both drift guards stay, the pdfform one retargeted at the merged
+  build. Closes #1640.
+- feat(core)!: **`reader.get` answers in the values form, and `ReadValue` is
+  gone.** `get` returns the plain value: every content leaf in the field's type
+  tree as its codec's text (`richtext` markdown, `plaintext` literal),
+  descending `items` / `properties` / `variants`, so `reader.get("paragraphs")`
+  is `["Para **one**", …]` where an `array<richtext>` used to return the stored
+  content objects. A present-null reads `null` rather than `""`. A leaf that
+  does not decode raises `edit::field_decode` anchored at the element
+  (`main.paragraphs[1]`). A read never coerces: `qty: "3"` reads `"3"` here and
+  `3` only in `resolve`. `reader.getContent` and `reader.getContentAt` are
+  unchanged, and are where a leaf's anchors and island ids read back: the text
+  form carries neither.
+- feat(bindings)!: **the storage DTO verbs name their lane, not their
+  encoding.** `Document.toJson` / `fromJson` / `loadJson` become `toStored` /
+  `fromStored` / `loadStored`, and Python's `to_json` / `from_json` become
+  `to_stored` / `from_stored`. `storageVersionOf` and `currentStorageVersion`
+  are unchanged, already naming storage. "Stored" is the at-rest form
+  throughout, so the pair completes the family `getStored` started; the bare
+  `store` stays the field-write lane's verb. The old names are removed rather
+  than aliased. Stored blobs, the `schema` tag, and every byte these verbs
+  write are untouched.
+- feat(bindings)!: **`resolve` lives on the reader.** `quill.resolve(doc)`
+  becomes `quill.reader(doc).resolve()`: a verb that needs a schema lives on
+  the cursor. WASM-only, as before.
+- refactor(core,wasm,python,cli)!: **`Quill.metadata` loses the
+  `<backend>_<key>` mirror, and `quillmark info` loses `--json`.** A loaded
+  quill carried four identity fields verbatim plus every key under the backend
+  section flattened as `<backend>_<key>`, so `typst: { plate_file: plate.typ }`
+  surfaced as a `typst_plate_file` entry. Nothing read a mirrored key: the
+  Typst backend and the CLI read `QuillConfig::backend_config`, and both
+  bindings built their identity keys from the config and used the map only for
+  the leftovers. `quill.metadata` (JS and Python) carries exactly `name`,
+  `version`, `backend`, `author`, `description`, in that order — so a metadata
+  snapshot serializes stably across processes, where the extras rode core's
+  `HashMap` iteration order. In Rust, `Quill::metadata` and
+  `quillmark_core::STANDARD_METADATA_KEYS` are deleted. The `--json` flag's one
+  distinctive output was that mirror.
+- refactor(wasm,python)!: **five owner calls leave both bindings.** Each is a
+  call the host makes itself in a line or two from surface that stays:
+  `Document.tryFromJson` / `try_from_json` — never renamed with its lane, and
+  deleted rather than aliased, so `storageVersionOf(b) ? fromStored(b) : null`
+  is the read — `Document.makeCard` / `make_card` (a `CardInput`
+  object literal), `doc.setCardKind` / `set_card_kind` (`removeCard` +
+  `insertCard` at the same index),
+  `result.renderTimeMs` / `render_time_ms` (clock the call), and
+  `Document.formatDiagnostic` (the CLI and Python's `str(diagnostic)` still
+  render it). They go from **both** surfaces, so WASM remains the reference
+  surface Python mirrors.
+- refactor(wasm)!: **a foreign handle on a by-reference method is a bare
+  `Error`, and `runtime::foreign_handle` retires.** The prototype patches on
+  `Document.equals`, `Quill.validate` and `Quill.conform` are gone with the
+  `Symbol.for('@quillmark/wasm:handle-checked')` marker they needed:
+  wasm-bindgen's own `_assertClass` already refuses a foreign class wherever a
+  method declares a reference parameter, and it throws a bare `Error`, so
+  `isQuillmarkError` reads `false` there. The seams that cross as **data** keep
+  their check, nothing else catching them: the four writer/reader binds, every
+  `Engine` verb, and `LiveSession.update`. A value that is not one of this
+  copy's handles is `runtime::not_a_quill` / `runtime::not_a_document`, whose
+  hint names both cures including `npm ls @quillmark/wasm`. A consumer routing
+  on `runtime::foreign_handle` routes on the two `not_a_*` codes instead.
+- refactor(python)!: **`Writer` / `Reader` take a `card=` selector.**
+  `writer.card(i)` and `reader.card(i)` returned a cursor holding the index;
+  the index is a keyword on the verb, `None` selecting the main card.
+  `CardWriter` and `CardReader` go with the cursors.
+- refactor(core,wasm,python)!: **the `$ext` namespace verbs collapse into the
+  whole-map three.** `storeExtNamespace` / `removeExtNamespace` /
+  `getExtNamespace`, the Python pair, and the `Card::*` methods they delegated
+  to are deleted. `getExt` / `storeExt` / `removeExt` keep the whole surface,
+  `card` selector included: `$ext` is a map the engine never inspects, so a
+  namespace write is `{...getExt(addr), [ns]: v}` on the client and the read
+  shape is the write shape. The one behavior the spread does not carry is the
+  drop-when-empty — `removeExtNamespace` dropped `$ext` with its last namespace
+  where `storeExt({})` records an explicit `$ext: {}` — for which `removeExt`
+  is the call. Stored bytes, the Markdown round trip and the plate strip are
+  untouched.
+- fix(core,wasm,python)!: **a card built from a wire refuses under the code its
+  addressed mutator mints.** `insertCard` folded a malformed field name, a bad
+  `$quill` reference, a `!must_fill` on a mapping and a malformed item list
+  into one code-less refusal, so `diagnostics[0].code` was `undefined` in JS
+  and Python raised a bare `ValueError` — while `storeField` / `setQuillRef`
+  carried `edit::invalid_field_name`, `parse::invalid_quill_reference` and
+  `edit::fill_on_mapping` for the same violations. `WireError` carries the
+  `EditError` its addressed twin raises and both bindings stamp
+  `WireError::code()` on the diagnostic. A card dict Python cannot read as a
+  card at all is still a `ValueError`; one that deserializes and then violates
+  an invariant is a `QuillmarkError` under its code. The list-level violations
+  (a duplicate key, a field count past the §8 bound, a `$` entry twice, a
+  comment spanning lines) carry the new `edit::invalid_payload`.
+- fix(python)!: **every `edit::*` diagnostic anchors at the `DocPath` its verb
+  ran against.** `Diagnostic.path` had two spellings for one refusal:
+  `writer.set` minted none and `writer.set_all` the bare field name. The
+  converters thread the base anchor the WASM binding does, so an undeclared
+  name is `main.stray` from every main-card verb, `cards.<kind>[<i>].stray`
+  from a card cursor, and a structural out-of-range op is `cards[<i>]`. A
+  consumer comparing against a bare field name now matches nothing.
+- fix(python)!: **a negative index is an out-of-range index, not an
+  `OverflowError`.** Every index parameter was a `usize`, so `doc.card(-1)`,
+  `doc.move_card(-1, 0)` and `render(pages=[-1])` died in the boundary
+  conversion with a third exception type, outside the two the binding
+  documents. Indices are signed at the boundary. A negative one addresses
+  nothing — it is not the last card, and the binding does not index from the
+  end — so it takes the answer its site already gives an index past the end:
+  `edit::index_out_of_range`, `backend::page_index_out_of_bounds`, or `None`
+  where `remove_card` answers absence.
+- fix(python): **`OutputFormat` and `Severity` members are hashable.** The two
+  pyclass mirrors declared `eq` alone, which fills `tp_richcompare` and leaves
+  no `tp_hash`, so CPython stamped `__hash__ = None` and every variant was
+  rejected as a set member or a dict key. Both are frozen and hash by variant.
+- fix(python): **a card dict is `CardWire`'s serde projection rather than a
+  hand copy of it.** `card_to_pydict` serializes the wire and adapts the two
+  keys Python's surface owns: snake_case `payload_items`, and an explicit
+  `None` where an absent `$quill` / `$ext` / `$seed` leaves the wire key out.
+  Every key and value is what it was; the dict iterates in the wire's own
+  order.
+- perf(python): **reading `RenderResult.artifacts` copies no bytes.** The
+  getter rebuilt its list on every read, cloning each artifact's buffer, and
+  `Artifact.bytes` cloned that again, so a `save` followed by one `bytes` read
+  moved a multi-MB PDF three times. The `Artifact` and `Diagnostic` objects are
+  built once, with the result; `bytes` makes the one Rust→Python copy and
+  `save` writes without one.
+- fix(wasm): **a failed conversion at the typed boundary throws instead of
+  stranding the JS handle.** `RenderOptions`, `RenderResult`, `Diagnostic`,
+  `ChangeSet`, `ContentHit` and `FieldRegion` cross as `tsify::Ts<T>`, whose
+  handle the wasm-bindgen shim owns and frees; the deprecated `into_wasm_abi` /
+  `from_wasm_abi` impls they carried leaked it on the way out (tsify#65), and
+  took the module down with a trap rather than a catchable error when
+  serialization failed. The TypeScript surface is byte-identical, and the crate
+  compiles warning-free.
+- fix(wasm): **an unregistered backend rejects with `engine::backend_not_found`
+  like every other failure.** The four `Engine` verbs threw a bare `Error` for
+  a quill whose declared `backend:` has no loader, so `isQuillmarkError`
+  answered `false` and the README's own `catch` example re-threw it as a
+  foreign failure. The rejection carries one diagnostic under the code core and
+  the Python binding already raise, hinting the registered backend ids.
+- fix(wasm): **`Engine.render` returns the document's load warnings ahead of
+  the compile's own.** The engine renders a backend-memory clone built by
+  `Document.fromStored`, which carries no warnings, so a parse, `conform::*` or
+  `plate::unsupported_construct` diagnostic reached `RenderResult.warnings`
+  from no public surface. `Engine.render` snapshots `doc.warnings` beside the
+  storage DTO and fronts the result with it, the pipeline order ERROR.md
+  states. `LiveSession.render` carries the compile half alone.
+- fix(wasm)!: **a `MarkOp` spells its payload where the decoder reads it, off
+  one `ContentMarkKind`.** The `link` and `anchor` arms declared it as a named
+  sibling — `{ type: "link"; url }` — which is the spelling the authored lane
+  refuses as the retired `@0.93.0` encoding (`content json shape: legacy mark
+  payload`). The decoder reads a built-in's payload out of `attrs` and the
+  canonical encoder writes it there, so the type named the one shape
+  `applyChange` rejects and rejected the one it takes. It was survivable while
+  the union carried its open arm, `{ type: string; attrs: unknown }`, whose
+  shape happened to match the decoder: a correct op type-checked through the
+  wrong arm. Closing the vocabularies deleted that arm and left no spelling
+  that both compiles and runs. Nothing on the wire moves — the runtime accepted
+  `attrs` and only `attrs` throughout — so this reaches a consumer as a type
+  that stops refusing correct code. The drift was possible because the op
+  restated the payload: `ContentMarkKind` names the three arms once, exported
+  from the package root beside `ContentLineKind`; `ContentMark` is a range over
+  it and `MarkOp`'s `add` / `remove` are a `ContentMark` under an op, so an arm
+  added upstream reaches both by construction and `{ op: 'remove', ...mark }`
+  type-checks for a held mark. The type guard lifts a mark's payload by name as
+  it lifts a line's, beside an `@ts-expect-error` pair refusing the sibling, and
+  the Rust drift guard reads the mark vocabulary off `ContentMarkKind`.
+- fix(wasm,python): **`reader.getContentAt` / `get_content_at` stays.** The
+  owner-call sweep took it as a call the host makes in a line or two, but
+  neither read that remains is one: `reader.get` answers in the values form,
+  which is text, and an anchor has no markdown projection while an island's
+  `id` is re-minted by every importer, so the round-trip a nested content
+  editor performs loses both; `getStored` echoes bytes under `unknown` and
+  hands the codec dispatch back to the caller, which is the judgement the read
+  exists to make. The verb returns in its 0.112 shape — `path` a `PathStep[]`
+  walked through the field schema's `items` / `properties` / `variants` to the
+  leaf, absent for a path naming nothing stored — with Python's twin taking the
+  `card=` selector that replaced the `CardReader` cursor.
+
+### The engine seam and the backends
+
+- refactor(pdfform)!: **`quillmark-pdfform` is `quillmark-acroform`, backend id
+  included.** `quillmark-pdf` and `quillmark-pdfform` differed by four
+  characters and read as prefix-and-specialization, the reading #1749 records:
+  that the form crate was the spine's only consumer. The spine keeps its name,
+  a bare generic name reading as leaf infrastructure with many consumers, and
+  the backend takes a distinct one at every layer the old one was spelled:
+  crate, directory, `AcroformBackend` with `id()` of `"acroform"`, the
+  `quillmark` cargo feature, the `pdfform::*` diagnostic namespace (now
+  `acroform::*`, the suffixes unchanged), the WASM `DEFAULT_BACKENDS` key, the
+  docs page and the two fixture quills' `backend:`. No alias: an unmigrated
+  `backend: pdfform` fails at render with `engine::backend_not_found`, whose
+  hint lists the registered backends, and a half-migrated quill with a leftover
+  `pdfform:` section fails at load with `quill::unknown_section`. `pdf::*` is
+  untouched. Closes #1775.
+- refactor(typst)!: **`form-field` keeps `text` and `signature`.** `usaf_memo`
+  uses those two. Checkbox and choice were the only kinds needing a value
+  coercion, and both coercions were copies of the pdfform resolver's,
+  duplicated because the Typst backend must not depend on it: deleting the two
+  kinds deletes the duplicate, and `FieldKind`, the mirror of the spine's
+  `FieldType` it existed for, retires with them — the extractor reads
+  `(FieldType, Option<String>)` directly. A plate wanting an interactive
+  checkbox or dropdown is a form-backend quill: pdfform keeps both kinds on
+  the spine. `multiline` stays, one bool on `FieldType::Text` the spine keeps
+  either way. A plate passing `type: "checkbox"` or `type: "choice"` fails the
+  helper's type assert, and `options:` is no longer a parameter. Closes #1644.
+- refactor(core)!: **`.quillignore` is not read; the ignore set is the built-in
+  one.** A three-rule parser with a raw-string fallback — `dir/`, a literal
+  name, and a glob matched against both the whole path and the basename that
+  also matches the line it was written as — served a format one bundle in the
+  tree used. That bundle's file was a copy-pasted demo ("This demonstrates the
+  .quillignore functionality") restating the built-ins it would have inherited
+  by writing nothing. The bracket-as-literal reading in the glob
+  existed for `Cinzel[wght].ttf`, a name no `.quillignore` in this repo's
+  history spells. `QuillIgnore` is the fixed set alone now: `.git/`, `target/`
+  and `node_modules/` with their subtrees, anchored at the bundle root, and
+  `.gitignore` wherever it sits. `.quillignore` leaves that set with the format
+  — the loader has no reason to hide a file it no longer reads — so a bundle
+  carrying one walks it into the tree as an ordinary file, and a bundle that
+  relied on the file to exclude something ships that something. `QuillIgnore::new`
+  and `QuillIgnore::from_content` go; `default()` and `is_ignored` stay, on what
+  is now a unit struct. Refs #1641.
+- fix(typst)!: **a vendored package without `typst.toml` is skipped, with the
+  warning its siblings already get.** A `packages/<dir>/` carrying no manifest
+  had one synthesized — `@local/<dir>:0.1.0` — and loaded under it. That spelling
+  was undocumented, unfixtured and untested, and it split one package tree into
+  two behaviors: the synthesized path passed no entrypoint, so it alone skipped
+  the `typst::package_entrypoint_missing` check that the same files with a
+  two-line manifest get. A manifest-less directory now warns under
+  `typst::package_manifest`, the code its malformed-manifest and bad-version
+  siblings already carry, and is skipped. The migration is the file the fallback
+  was standing in for: `parse_package_toml` defaults `namespace` to `local`,
+  `version` to `0.1.0` and `entrypoint` to `lib.typ`, so `[package]` plus
+  `name = "<dir>"` reproduces the old spec exactly. `package_spec` and
+  `entrypoint` stop being `Option` on `load_package_files_from_quill`, whose two
+  call sites always passed one, and the infallible `"0.1.0".parse()` dressed as
+  fallible goes with them. Refs #1698.
+- refactor(core,wasm)!: **canvas preview is part of the backend contract, and
+  the pre-session probe goes.** `SessionHandle::page_size_pt` and `render_rgba`
+  lose their absent-reading defaults and become required, so a session paints
+  by construction rather than by opting in. Each return value carried two
+  meanings and now carries one: `None` and `Ok(None)` say the page is past
+  `page_count()`, where they also used to say the backend had no painter.
+  `update`, `regions` and `field_at` keep their defaults — this closes the
+  canvas door alone. With the door shut, the probe that guessed at it goes at
+  every layer: `Quillmark::supports_canvas`,
+  `quillmark_core::formats_support_canvas`, the WASM
+  `Engine.supportsCanvas(quill)` and `LiveSession.supportsCanvas` getters, and
+  the `canvas` key of a runtime `BackendDescriptor`, leaving a descriptor's
+  manifest as `formats` alone. It keyed on output formats — true iff the
+  backend emitted PNG or SVG — while paint is a `SessionHandle` seam a backend
+  overrides independently, so the two could disagree; every backend the
+  workspace ships paints, so it answered `true` in every build.
+  `LiveSession::supports_canvas()` reduced to `page_count() > 0`, which is what
+  a Rust caller writes instead. Both shipped backends already implement the
+  pair, so no rendered pixel moves. A compile with nothing to paint meets the
+  out-of-range refusal, `"paint: page index 0 out of range (pageCount=0)"`, in
+  place of a message naming a painter the backend has. Closes #1706.
+- refactor(pdfform)!: **the SVG and PNG output formats go; canvas paint
+  stays.** `supported_formats` reports `[Pdf]`, so a `render` asking for either
+  fails under `backend::format_not_supported`, and `quillmark render --format
+  png` on a pdfform quill does too. The two formats were views of the flattened
+  form consumed by nothing but their own test. `render_rgba` and the `hayro`
+  dependency stay, so a WASM consumer paints pdfform pages exactly as before:
+  paint is a `SessionHandle` seam, not an output format. `hayro-svg` goes with
+  the SVG artifact path, its only caller.
+- refactor(core,wasm,python)!: **the `producer` render option goes; the
+  `/Producer` stamp it overrode stays.** `RenderOptions::producer` and
+  `with_producer`, the WASM key and Python's `producer=` keyword are deleted.
+  No first-party caller set it, and the engine carried the string through four
+  crates and two bindings to reach a writer a host can reach directly. Every
+  rendered PDF still carries `Quillmark <version>`: the default sits in
+  `quillmark-pdf`'s `StampOptions::default()`, one `format!` over
+  `version.workspace = true` in place of a `default_producer()` in each
+  backend. `StampOptions::producer` becomes a plain `String`, so `stamp` always
+  appends its `/Info` revision where a producer-less call over an empty field
+  list returned the base bytes; both backends always passed a producer, so no
+  render changes.
+- refactor(all)!: **the crate-compatibility ceremony is withdrawn:
+  `#[non_exhaustive]`, the `Backend` seal, public `register_backend`, and the
+  SemVer promise `COMPATIBILITY.md` carried.** The attribute leaves the 86
+  items that held it, so a struct literal, functional update and exhaustive
+  destructuring compile out-of-crate again — `RenderOptions { ..,
+  ..Default::default() }` among them. Its one observable effect was the forced
+  `_` arm, which hides a variant a build has not learned instead of reporting
+  it: the WASM and Python `Severity` conversions folded an unmatched level into
+  `Error`, and both now match every variant. `Backend` loses its
+  `sealed::Sealed` supertrait; implementing the trait outside the workspace
+  stays impossible, because `Backend::open` returns a `LiveSession` only a
+  `#[doc(hidden)]` `SessionHandle` builds and `Quillmark::register_backend` is
+  private, leaving `Quillmark::new` as the whole registry.
+  `prose/canon/COMPATIBILITY.md` is deleted — a promise to crates.io consumers
+  that, per its own text, no CI job checked; its table of `pub` seams that
+  serve the workspace rather than a consumer moves into `ARCHITECTURE.md`'s
+  backend section.
+- fix(typst,pdfform)!: **`RenderOptions::pages` means one thing on every
+  backend, under `backend::*` codes.** The PDF-form backend ignored the option:
+  it rendered every page whatever was asked for, and an out-of-range index
+  passed silently. It refuses a selection now, PDF being its one format, and
+  both backends mint the two refusals from the shared constructors in
+  `quillmark_core::backend`, so the codes are
+  `backend::page_index_out_of_bounds` and
+  `backend::page_selection_not_supported` in place of the Typst-private
+  `typst::*` pair.
+- fix(typst,pdfform)!: **a raster nobody can allocate is refused, not
+  attempted.** `RenderOptions.ppi` and the `render_rgba` canvas scale reached
+  tiny-skia and hayro unchecked; both size their buffer from the value and
+  unwrap it, so `ppi: Infinity` or `1e9` panicked the process — in WASM a trap
+  that takes the engine instance with it — while NaN, zero and a negative
+  quietly rasterized a 1×1 image. Every raster path refuses under
+  `backend::invalid_raster_scale` a scale that is not finite and positive, or
+  that would put a page past `MAX_RASTER_PIXELS` (16384² px: a 1 GiB RGBA
+  buffer, and the area of the WASM painter's per-side clamp, so nothing that
+  clamp admits is refused). US Letter at the default 144 ppi is 138× under it.
+  `SessionHandle::render_rgba` and `LiveSession::render_rgba` return
+  `Result<Option<(u32, u32, Vec<u8>)>, RenderError>` to carry the refusal;
+  `Ok(None)` is still the out-of-range page.
+- fix(pdfform)!: **canvas geometry measures from the page's canvas box.** hayro
+  rasterizes `/CropBox` ∩ `/MediaBox` and draws that box's lower-left corner at
+  the raster's origin, while `page_size_pt` reported the `/MediaBox` extent and
+  `regions()` reported widget `/Rect`s in raw user space. An overlay over a
+  `pdfcrop`ped background (`/MediaBox [96 133 500 700]`) therefore sat 96 × 133
+  pt off its ink, and a `/CropBox` inside the MediaBox reported a page bigger
+  than its own raster. `page_size_pt` is the canvas box's extent, `regions()`
+  subtracts its lower-left corner, and `form.json`'s top-left rects flip
+  against it, so `pageSize`, `regions`, the point queries and the raster share
+  one origin. Values move only on a page whose canvas box does not start at
+  `(0, 0)`. The stamped PDF's widget `/Rect`s stay in user space.
+  `quillmark_pdf::page_media_boxes` is `page_canvas_boxes`, and it refuses a
+  canvas box under a point per side (`pdf::degenerate_page_box`) and a page box
+  that is not a direct array of numbers.
+- fix(pdfform)!: **flatten's own parse failure is `acroform::flatten_parse`.** A
+  page dict or `/Contents` the content-stream flattener cannot read raised
+  `pdf::flatten_parse`, naming the stamp spine for a failure of the backend's
+  own code. The backend's namespace renames later in this same cycle, so the
+  code ships as `acroform::flatten_parse`, not the `pdfform::` spelling the
+  commit landed. `pdf::bad_rect` stays the spine's and is minted in one place,
+  `FieldSpec::assert_finite_rect`, which the stamp and flatten paths both call.
+- feat(typst,pdfform,cli)!: **`pdfform::form_schema_version` retires, and the
+  CLI loses three flags.** A `form@0.1.0` file still fails to load, now as an
+  unrecognised tag under `acroform::invalid_form_json` (the namespace renames
+  later in this cycle). `render --verbose` is
+  deleted, so `--quiet` states what it suppresses on its own; `schema -o` and
+  `blueprint -o` are deleted, both commands writing to stdout where `>` does
+  the rest. `render -o` is unchanged. `validate` reads `plate_file` from the
+  loaded quill rather than the filesystem, so a plate the load excludes fails
+  validation, which is what rendering it already did.
+- change(typst): **an image in a content field draws nothing and warns.** What
+  a content image's `url` names is undecided — a document is quill-free but for
+  `$quill`, which selects a *range* of versions, and declares everything else
+  it references — so the Typst backend lowers an `image` island to nothing
+  rather than binding one reading of the string. A quill asset stays the
+  plate's to draw (`#image("assets/logo.svg")`), unchanged. The refusal is
+  legible where it used to be a Typst file-not-found error about a generated
+  file the author never wrote: one **`backend::declined_construct`** warning
+  per content field, `args` `{backend, construct, count}` and the field's
+  `DocPath` in `path`, minted by the new `quillmark_core::declined_construct`
+  so it cannot drift from quill-declared `plate::unsupported_construct` — the
+  sixth warning family, and the first a backend *observes* rather than a quill
+  declares. **A consumer routing on diagnostic codes gains a warning family**
+  and needs an arm for it. Storage is untouched: an `image` island still
+  parses, stores, round-trips to markdown and reaches an editor with its `{url,
+  alt}` props.
+- fix(typst): **a compile diagnostic carries a code from a closed set.** The
+  code was the message up to its first `:`, so a missing asset minted
+  `typst::file not found (searched at assets/logo.png)` — the author's path
+  inside what consumers route on, one code per input — and a URL truncated
+  mid-value to `typst::file not found (searched at https`. Most Typst messages
+  hold no `:` at all, so the whole sentence became the code. The mapping
+  classifies: `typst::file_not_found`, `typst::unknown_variable`,
+  `typst::type_error`, and `typst::compile` for every message the set does not
+  name, warnings included. Typst's sentence, and the path it searched, stay in
+  `message`.
+- fix(typst): **a `form-field` widget's rect is the box it prints in, whatever
+  the layout context.** The helper emitted its `<__qm_field__>` metadata beside
+  the box rather than inside it, and a tag's own position is the line's
+  baseline inline and the flow cursor's left edge in a block: an inline widget
+  reported a rect one box-height low, and one under `#align(center, ..)`
+  reported the left margin. The tag rides in the box body, whose origin is the
+  box's top-left in every layout context, so `session.regions()`, `fieldAt` and
+  the stamped AcroForm `/Rect` all land on the widget. A plate that compensated
+  for the offset shifts by that much.
+- fix(typst): **`escape_markup` lowers every character Typst reads as a newline
+  to a space.** A content that reached the emitter without passing the ingress
+  — hand-built, or decoded from storage — could still carry `\r`, VT, FF, NEL,
+  U+2028 or U+2029, and the emitter wrote it through: the text behind it parsed
+  as a heading, list or term marker the document never wrote. One character to
+  one byte, so the per-character span scan stays exact.
+- fix(typst): the font loader drops its `woff`/`woff2` extension arms, which
+  parsed nothing, and the data codegen drops its skip of a `__meta__` key
+  nothing produces.
+- refactor(typst): **a compile's form fields cross to the PDF spine as one
+  derivation.** `Compiled` carries `field_specs: Vec<FieldSpec>` built with the
+  compile: `widget_regions` is `regions_of` over it and `render_document_pages`
+  stamps it directly, where each PDF render had rebuilt the specs from the
+  placements, page-height scan included. A placement naming a page outside the
+  document fails the compile alongside the extraction errors it sits with,
+  instead of emptying the session's regions and surfacing at render.
+- fix(core): **the default `field_at` hands a tie to the later-painted
+  placement.** It ranked `regions()` with `min_by`, which keeps the first of
+  equal distances, so two placements on one rect resolved to the one underneath
+  — against the documented contract and against the Typst backend, which
+  overrides `field_at` with later-wins. The default walks `regions()` in
+  reverse, so a pdfform quill whose widgets overlap answers with the
+  last-stamped one.
+- refactor(core,typst,pdfform): **the default PPI is stated once, as
+  `RenderOptions::DEFAULT_PPI`.** Each raster backend carried its own
+  `DEFAULT_PPI = 144.0` const, one of them documented as mirroring a core
+  constant that did not exist. `RenderOptions::ppi_or_default()` resolves the
+  option against that constant and both backends call it. Additive on the core
+  API; the resolved value is unchanged.
+
+### The PDF spine
+
+- refactor(pdf,acroform)!: **a stamped widget draws its own value, so the second
+  PDF goes.** A widget carried `/NeedAppearances` and no appearance stream, so
+  the value reached only a viewer that synthesizes one and a flat rasterizer
+  drew an empty box. The form backend worked around that for its canvas by
+  building a whole second document — `flatten.rs` and `typography.rs`, 850 lines
+  — that baked each value into the page content streams, which meant resolving
+  inherited `/Resources`, inlining an indirect `/Font` dict, picking a resource
+  name free in the page's own, and splicing a `/Contents` that might name an
+  array object. The stamp now writes one `/AP` `/N` Form XObject per drawn
+  value, over a `/BBox` the size of the field box and its own one-entry
+  `/Resources`: the page is not touched, so none of that surgery has anything to
+  resolve. One document is the deliverable and the raster both, the preview is
+  the file, and a Typst `form-field` carrying a `value:` bakes one too. `/V`
+  stays the source of truth — the stream draws WinAnsi, from the left edge, and
+  the `/BBox` clips it — and `/NeedAppearances` still hands a synthesizing
+  viewer the whole value. With no second path to share them, `quillmark-pdf`'s
+  two `#[doc(hidden)] pub` modules are private and `PdfUpdate::begin` stops
+  taking a producer it was always given. Closes #1645.
+- fix(pdf): **a stamped checkbox's `/DA` names ZapfDingbats.** `stamp` wrote a
+  checkbox's `/MK /CA (4)` caption and no `/DA`, so the widget inherited the
+  form-level `/Helv 0 Tf 0 g` and nothing registered the face the glyph lives
+  in: a viewer synthesizing the appearance under `/NeedAppearances` drew the
+  digit `4`, while the canvas raster drew the check mark through a real
+  ZapfDingbats resource. The widget now carries `/DA (/ZaDb 0 Tf 0 g)`, and
+  `/DR /Font` registers `/ZaDb` whenever a checkbox is present; `spec.font`
+  stays inert on a checkbox. The face, its resource name and the glyph are
+  `quillmark_pdf::{CHECK_FONT, CHECK_FONT_RESOURCE, CHECK_GLYPH}`, which the
+  acroform flatten path now reads rather than restating. Closes #1779.
+- fix(pdf): **one predicate for the checkbox on-state.** `stamp` read any
+  `Some` value as checked and `flatten` only `Some("Yes")`, so a
+  `FieldSpec::value` the contract excludes — `value` is public — stamped
+  `/V /Yes` on a widget the raster drew blank. `FieldSpec::is_checked` is the
+  one reading, the strict one, and both paths call it. Closes #1780.
+- fix(acroform): **a value carrying a newline binds to a multiline widget.**
+  `bind` decided `MULTILINE` from the schema type, so a richtext of two
+  paragraphs, a `String` block scalar, or any value whose projection keeps a
+  `\n` reached the stamped widget single-line unless `ui.multiline` said
+  otherwise, while the flattened raster stacked the lines: the author saw the
+  value in the preview and one line of it in the file. `resolve::field_spec`
+  now promotes a `Text` widget to multiline when the value it resolved holds a
+  `\n`, reading the same string the raster draws. An array's widget stays
+  multiline unconditionally, value or none, since a signer types its elements
+  one per line. Closes #1781.
+- refactor(pdfform): **a checkbox reads a bool.** `is_truthy` accepted
+  `"yes"`, `"on"`, `"y"`, `"checked"`, `"1"` and any nonzero number beside
+  `true`. Nothing reaches it: a `checkbox` widget binds only to a `boolean`
+  schema field, and `resolve` runs against `compile_data`, where
+  `conform_value` has already turned a bool, a `"true"`/`"false"` spelling and
+  a number into a JSON bool — and refused everything else as
+  `CoercionError::uncoercible` before any widget resolves. So the vocabulary
+  was not a tolerance but a second, *wider* one behind a door the first never
+  opens: `"yes"` checks the box here and fails the compile upstream. The module
+  binds against `compile_data` precisely so coercion is inherited rather than
+  re-implemented, which is the line `is_truthy` crossed. `matches!(raw,
+  Value::Bool(true))` is the whole rule now. No reachable behavior changes.
+- fix(pdf): **a stamped trailer carries one `/Info`, whatever shape the base's
+  `/Info` had.** The producer stamp allocated a fresh information dictionary
+  whenever the trailer's `/Info` did not parse as an indirect reference, while
+  the trailer writer copied the old value forward regardless, so a direct-dict
+  `/Info << /Title (x) >>` came out as two `/Info` keys in one dict — undefined
+  per spec, parser-dependent in practice. The fresh reference supersedes the
+  old value, and a direct dict's entries seed the object it names, so `/Title`
+  and the rest survive the stamp.
+- fix(pdf): **the object index skips literal strings, `%`-comments and stream
+  bodies, so `N G obj` bytes carried as content cannot shadow the real
+  object.** The scan accepted any `<id> <gen> obj` at a token boundary and a
+  later occurrence overwrites an earlier one, so a header spelled inside a
+  string value (`/Subject (see 4 0 obj)`) or inside raw stream data displaced
+  the real object's offset. `find_endobj_end` skips stream bodies too: `endobj`
+  bytes in stream data truncated the object body.
+- fix(pdf): **a dict ending in a hex string parses to its real `>>`.** The
+  scanner stepped over literal strings and `%`-comments but read a hex string
+  as ordinary bytes, so the string's own `>` abutting the dict's `>>` closed
+  the dict one byte early: `<< /T <41>>>` read as ` /T <41`, and a `/Producer`
+  stamp rewrote the `/Info` with an unterminated `<…` — a title lost to any
+  reader. `skip_string_or_comment` steps a `<` that no `<` follows to just past
+  its `>`, which the dict, array and `endobj` scans all inherit. The trigger is
+  real: pdf-writer's compact mode, which krilla and typst-pdf use, writes a
+  non-ASCII `/Title` or `/Author` exactly this way.
+- fix(pdf): **an inheritable page attribute resolves along the page's own
+  ancestor chain, not the root `/Pages` node alone.** `/Rotate` and `/MediaBox`
+  were read from the page dict and then from the root, so a base whose
+  intermediate `/Pages` node carries `/Rotate 90` passed the rotation guard and
+  every stamped widget landed a quarter turn off, and a page inheriting its
+  `/MediaBox` from an intermediate node was flipped against the root's page
+  height. The `/Kids` walk carries each page's ancestor ids, nearest first, and
+  both readers consult the page dict then that chain (ISO 32000-1 §7.7.3.4).
+- fix(pdf): **a `/Rotate` the reader cannot read as an integer refuses the
+  stamp.** `assert_unrotated_pages` parsed the raw value and treated a failure
+  as an absence, so `/Rotate 7 0 R` — legal for any dict value — climbed past
+  the page and fell to the default zero, stamping every widget in unrotated
+  user space onto a page the viewer turns. The first *present* value along the
+  ancestor chain binds: a direct integer is checked as before
+  (`pdf::rotated_page`), anything else is `pdf::parse`.
+- fix(pdf): **a base PDF whose trailer `/Size` sits above `i32::MAX` is refused
+  rather than panicking mid-stamp.** `alloc_id` bounded only `u32` overflow, so
+  a `/Size` in `2^31 ..= 2^32-2` handed out ids that cast to a negative `i32`
+  and pdf-writer's `Ref::new` panicked — a crafted `form.pdf` opened cleanly
+  and then took down the process, and with it a WASM module. `alloc_id` stops
+  at `i32::MAX`, and every id that becomes a reference goes through a checked
+  `to_ref`, which also covers the base page ids that never pass through
+  `alloc_id`.
+- fix(pdfform): **flatten keeps the background's resources and its own
+  `/Contents`.** `/Resources` is inheritable, so writing a fresh one onto a
+  page that carried none shadowed the ancestor's dict and unbound every name
+  the background stream selects; the effective dict is resolved up `/Parent`,
+  inlined onto the page and extended there. The drawn fonts take names free in
+  that dict (`Helv2` where `Helv` is taken), since a second binding for a name
+  the background uses rebinds it under a last-wins parser. A `/Contents`
+  reference naming an *array* object expands to its elements instead of being
+  wrapped.
+- fix(pdfform): **a flattened value asserts black fill and the default text
+  state before it draws.** The appended stream opened with `q` and set only
+  `Tf`, and a page's `/Contents` array is one stream, so a background's
+  unpaired `0.9 g` or `3 Tr` — a shaded field box, a scanned form's invisible
+  OCR layer — carried into the drawn value and rastered it near-white or blank,
+  with no diagnostic. Both writers open with `0 g 0 Tr 0 Tc 0 Tw 100 Tz 0 Ts`,
+  the state the stamped `/DA` starts from. Canvas paint only: the AcroForm PDF
+  deliverable is stamped, not flattened.
+- refactor(pdf): **one ancestor chain per page.** `PdfUpdate::resolve_pages`
+  returns `Vec<Page>` rather than page ids: each `Page` carries its `/Pages`
+  ancestors from the `/Kids` walk and resolves any inheritable attribute
+  through `Page::inherited_attribute`. Flatten reads `/Resources` through it
+  instead of climbing `/Parent` on its own, so rotation, media box and
+  resources answer from the same chain under the same cycle and depth guards.
+
+### Schema, validation and the resolved view
+
+- fix(core)!: **a quill declaring more fields than a card carries is refused at
+  load.** `MAX_FIELD_COUNT` (1000) bounds one card-yaml block and every
+  incremental field write charges it, but `Quill::seed_document` and
+  `QuillConfig::blueprint` build a card from its schema wholesale: a `Quill.yaml`
+  declaring 1001 fields under `main:` or under one `card_kinds.<name>:` loaded
+  clean, and the failure landed at an exit: emitted markdown the parser refuses,
+  and a card storage refuses. The load counts each card's declared fields and
+  reports `quill::too_many_fields` naming the card, so the defect reaches the quill
+  author in the artifact that holds it and both schema-driven constructions are
+  total over every loaded quill. The count is per card and over declared fields
+  alone: a nested `properties` map, an array's `items` and a `variants:` cell set
+  ride inside the one field declaring them. Closes #1792.
+- fix(core)!: **a field write past the §8 field count is refused at the write.**
+  `Card::store_field` validated a field's name and its value's depth and left the
+  card's field count to the parser and the two storage doors, so a program could
+  build a card past `MAX_FIELD_COUNT` (1000) through `storeField` / `storeFill` /
+  `storeFields`, the typed `set` / `set_all` / `addCard`, or `revise` /
+  `overwrite` on an absent field — and learn of it only at `toMarkdown`,
+  `toStored`, or the card wire, each of which refused what the API had taken.
+  Every field write funnels through one `Payload::insert` that holds the count,
+  so an append past the cap is `edit::invalid_payload` carrying
+  `PayloadViolation::TooManyFields` — the code the wire already mints for this
+  violation — anchored at the card that is full. A replace is not a growth and
+  still lands. The batches charge the count over the whole batch and report one
+  diagnostic per name in the overflowing tail, applying none of themselves.
+  Closes #1750.
+- refactor(core)!: **an enum's domain rides the type token.** `FieldType::Enum`
+  carries `values`, and `FieldSchema::enum_values` is gone. The domain and the
+  token had to agree, an agreement the loader enforced and the type could not,
+  so every consumer keyed on the carrier and left a `FieldType::Enum` arm behind
+  as unreachable residue — three of them, each answering "no domain" differently:
+  the transform schema projected `{type: string}`, an open domain contradicting
+  the token; validation skipped the membership check; pdfform refused to bind.
+  One rule replaces them, special-cased nowhere: a domain admits its members and
+  the blank, so an empty one admits only the blank. `FieldSchema::domain()`
+  answers it for the three branches that enter through `variants:` holding no
+  token. No quill loads differently and no stored or wire byte moves: `values:`
+  is still the one spelling, still required non-empty on `type: enum`, still a
+  load error elsewhere, and `Serialize` re-emits it from the payload in the slot
+  it already occupied.
+- feat(core,wasm,python)!: **a quill carries the load's advisory diagnostics,
+  so they reach a binding host at last.** `Quill::warnings()` is new, mirrored
+  as `quill.warnings` in WASM and Python, and it answers whatever
+  `QuillConfig::from_yaml_with_warnings` collected. Every construction door
+  keeps them, which retires the two that existed only because the field was
+  missing: `Quill::from_tree_with_warnings` and
+  `quillmark::quill_from_path_with_warnings` are gone, and `from_tree` /
+  `quill_from_path` are the whole surface. Closes #1625: `Quill::from_tree` was
+  the door every binding took and the one that dropped them, so
+  `quill::implicit_group` and `quill::body_example_unused` were visible only to
+  the CLI's `validate`.
+- feat(core)!: **five retired `Quill.yaml` keys lose their tailored migration
+  message, and an implicit group is a load error.** `must_fill`, `enum`,
+  `ui.order`, the `richtext(inline)` type token and `markdown` were retired
+  across 0.94, 0.104 and 0.108, each with a hand-written sentence naming its
+  replacement. All five still fail to load, now under
+  `quill::field_parse_error` with serde's unknown-key text and no hint.
+  Separately, a `ui.group` on a card with no `ui.groups` registry is
+  `quill::implicit_group` at **error** severity, the promotion that warning's
+  own text scheduled. Note for a WASM or Python host: that warning never
+  reached you (#1625), so the error is the first notice. Declare the registry.
+- fix(core)!: **`Quill::validate` refuses every value the render floor
+  refuses.** Validation judged a floor refusal by the authored value's own
+  shape, and two shapes read well-typed there: a content object that is not
+  canonical content on a `richtext` or `plaintext` field (`{prose: older}`),
+  and an integer past `i64` on an `integer` field. Both audited clean while
+  `compile_data` and `dry_run` refused them, so the `validate`/`dry_run`
+  pairing an editor runs on gave two verdicts. A leaf the floor cannot conform
+  is a `validation::type_mismatch` at the field's path, unless a shape check
+  already names the refusal (`validation::not_inline`, `validation::not_plain`,
+  `validation::format_violation`); a container's refusal stays the element's or
+  property's, at its own path. A numeric literal past `i64` reports `actual:
+  number`, the type that does carry it, and such a literal in a `default:` or
+  `example:` is a load error.
+- fix(core): **a type mismatch names the field's own declared type, so `date`,
+  `datetime` and `enum` report themselves.** The validator collapsed the three
+  onto `string`, so `due: 20260101` against `type: date` read "schema declares
+  `string`" — a type the schema does not declare, with an exit that discards
+  the field's format. The declared type has one source, `FieldType::as_str`,
+  and `validation::type_mismatch` carries the name in `args.expected`.
+- fix(core): **a `$seed` overlay cell is validated as the document value it
+  is.** `validate` judged each cell as a Quill.yaml schema literal, a context
+  that refuses the container spelling of a variant-bearing enum and reads a
+  present-null as a typed value, so `classification: { value: CUI, note: hello
+  }` and `author: null` each drew a `validation::type_mismatch` warning while
+  `seed_card` committed both. An overlay cell takes the same pass a card's own
+  fields take. Overlays stay advisory and never gate render.
+- fix(core): **a seeded variant commits its cells without a discriminant to
+  name their world.** `seed_card` needed the overlay or an `example:` to name a
+  member and dropped the whole field otherwise, so a `$seed` entry was honored
+  for a card's plain fields and silently discarded for its variant-bearing one.
+  The world walked is the render floor's own selection — overlay › `example:` ›
+  `default:` › blank — and the container commits whenever a cell has something
+  to commit. `value` is written only where the overlay or an `example:` named
+  the member, so a `default:` stays deferred to the floor.
+- fix(core): **`$seed` writes only on the card carrying `$kind: main`.**
+  `store_seed_overlay` is inherent on `Card` and `card_mut` / `cards_mut` hand
+  out `&mut Card`, so a root-only `$seed` reached a placed composable card
+  after the positional gate on `push_card` / `insert_card` had run, producing a
+  document that emits markdown the parser refuses and fails its own serde round
+  trip. The card answers this about itself, so both mutable doors are covered
+  at once.
+- fix(core): **`Quill::resolve` keeps a mis-shaped container value raw rather
+  than blanking it under the document's own label.** A seed the render coercion
+  cannot conform — `rows: abc` on an `array`, `addr: 5` on a typed dictionary —
+  was rebuilt from the schema anyway, so the row showed an empty container
+  still tagged `authored`. The container arms compose an absent or
+  already-shaped seed only, and anything else falls through to the keep-raw
+  path `conform_card_render` documents. The render gate refuses the shape, so
+  the plate is unchanged.
+- fix(core): **a variant container the document wrote reads `authored`
+  whichever rung filled its discriminant.** `resolve()` lifted a present
+  container off the blank rung only, so `classification: {}` reported `default`
+  where the schema declared one and `authored` where it did not — the reported
+  rung turning on the schema rather than the document. A present container is
+  `authored`; a present-null still reads as absent and keeps the discriminant's
+  rung.
+- fix(core): **a blank `main.description` emits no description line in the
+  blueprint.** The main card tested the raw string for emptiness and collapsed
+  whitespace afterwards, so `main: { description: "   " }` landed as a bare `#
+  ` above the first field. The collapse runs first, and a description that
+  collapses to nothing falls through to `quill.description`.
+- fix(core): **a nested richtext `example:` reaches the blueprint as its `#
+  e.g.` hint.** A richtext cell never inlines its example, and the per-property
+  builder for typed-dict properties and typed-table rows gated the hint on
+  `default:` alone, so a defaultless richtext property's `example:` appeared in
+  neither the cell nor a hint. Both gates are one helper, as BLUEPRINT.md §
+  Typed dictionaries states.
+
+### The CLI
+
+- fix(cli): **`render` parses a `MARKDOWN_FILE` through the bound door, so
+  `conform::*` and `plate::unsupported_construct` warnings reach stderr.** The
+  command called `Document::parse`, the transport door, which runs neither the
+  conform walk nor the declined-construct walk: a `usaf_memo` body carrying a
+  `***` rendered with an empty stderr where every other surface warns. It calls
+  `Quill::parse` instead. Rendered bytes are the same — the coercion pass
+  already ran in `compile_data` — and a `$quill` naming another quill refuses
+  at parse rather than at compile, with the same diagnostics and the same exit
+  1.
+- fix(cli): **`validate` states each failure once.** A failing run printed its
+  own summary and then a second copy through the error it returned, which
+  `main` labelled `[ERROR] Invalid argument:` — including on a load failure,
+  which is a quill config failure and not an argument the caller got wrong. The
+  command returns `CliError::Reported` once it has written the per-diagnostic
+  lines and the summary. Exit status stays 1 on every path.
+- fix(cli): **`-f PDF` writes `example.pdf`.** `--format` parses
+  case-insensitively, but the derived output filename, the `example.<fmt>`
+  fallback and the multi-page `--stdout` refusal interpolated the flag as
+  typed. All three read the parsed format's lowercase id.
+- docs(cli): **the exit-code table separates a usage error from a refusal.**
+  The CLI reference and the crate README both promised `1` on any error, while
+  `clap` exits `2` on an invocation it cannot parse — an unknown flag, a
+  missing argument, an unknown subcommand — before any command runs. `1` is the
+  command running and refusing. `--help` and `--version` exit `0`. A smoke test
+  pins the `2`.
+
+### The Rust surface
+
+- refactor(core,quillmark)!: **every `quillmark-core` item is named at the module
+  that defines it.** The crate declared its thirteen modules `pub` and
+  re-exported 77 of their items at the root, so `quillmark_core::Document` and
+  `quillmark_core::document::Document` both resolved and first-party callers used
+  both; neither spelling was the one a reader could rely on seeing. The root
+  re-exports go and the modules stay public, which leaves Rust's own rule as the
+  whole of it: an item is reachable where it is defined. `Content` and
+  `Normalized` keep their root spelling, the root being the only path core offers
+  those two `quillmark-content` types. `quillmark::orchestration` goes the same
+  way, leaving `Quillmark` named once at the facade root. Every removed path is
+  an unresolved import, so the compiler names each of the 328 call sites; the
+  `quillmark` facade re-exports the same list from the module-qualified core
+  paths, so a consumer on the facade has nothing to do and no binding surface
+  moves. `quillmark-pdf` already carried the one-path shape and needed no change.
+  Closes #1791.
+- feat(core,quillmark): **`Normalized` and `ImportError` are nameable from core
+  and the facade.** `quillmark_content::model::Normalized` is what `Card::body`
+  returns, what `overwrite_body` / `overwrite_field` take on `Card` and
+  `CardMut`, what all four `get_content` / `get_content_at` answer in, and what
+  `dto::CanonicalContent` wraps; `quillmark_content::import::ImportError` is the
+  payload of `EditError::Import`. No crate on that path re-exported either, so a
+  consumer holding only `quillmark-core`, or only the facade, could bind what
+  those verbs return but not write the type, and could not destructure the
+  import refusal to read its depth. `Normalized` now sits beside the `Content`
+  re-export it completes and `ImportError` beside `EditError`, both reach the
+  facade, and `tests/facade_surface.rs` names them through the content lane.
+  What `quillmark-content` carries *inside* the types core forwards — `Mark`,
+  `Line`, `Island` and the enums they name — stays that crate's own surface.
+  Closes #1790.
+- refactor(content)!: **every `quillmark-content` item is named at the module
+  that defines it.** The crate declared its ten modules `pub` and re-exported 34
+  of their items at the root, so `quillmark_content::Delta` and
+  `quillmark_content::delta::Delta` both resolved and first-party callers used
+  both; neither spelling was the one a reader could rely on seeing. The root
+  re-exports go and the modules stay public, which leaves Rust's own rule as the
+  whole of it: an item is reachable where it is defined. `MAX_NESTING_DEPTH` and
+  `MAX_JSON_DEPTH` keep their root spelling, the crate root being where they are
+  defined. Every removed path is an unresolved import, so the compiler names each
+  site; the names `quillmark-core` re-exports keep their core spellings, so a
+  consumer on core or on the `quillmark` facade has nothing to do, and no binding
+  surface moves. Closes #1755.
+- refactor(core): **`ParseError::code` is the one variant-to-code match.**
+  `code()` joins the three siblings that already carry the same
+  `fn code(&self) -> &'static str` — `EditError`, `ValidationError`,
+  `WireError` — and `to_diagnostic` reads it rather than spelling a second
+  nine-arm table beside `args()`. What is left there is a two-arm decoration
+  match over the only variants carrying a hint or a location. Refs #1748.
+- refactor(core)!: **the raw-plate test seam is `#[doc(hidden)]`, not a cargo
+  feature.** `internal-test-seam` gated one method,
+  `LiveSession::update_data`, and the crate's `[features]` table held nothing
+  else; both go, and the method compiles into every build. A cargo feature is
+  public surface itself — crates.io and docs.rs advertise it — so the gate moved
+  the opt-in from a source read to a `Cargo.toml` line rather than removing it,
+  and the callable-vs-not difference it bought is already given away next door:
+  `LiveSession::new` and `SessionHandle` are `#[doc(hidden)] pub` in every
+  build, and a session assembled through them reaches the same unchecked
+  `update`. The typst backend's dev-dependency on core carried the feature and
+  nothing else, so it goes too; `[dependencies]` already names core, which is
+  what its acceptance tests link. Refs #1748.
+- fix(core)!: **a placed card is reached as a `CardMut`, not a `&mut Card`.**
+  `main_mut` / `card_mut` / `cards_mut` handed out `&mut Card`, so a whole-card
+  assignment wrote past every gate that polices placement:
+  `*doc.card_mut(0).unwrap() = doc.main().clone()` put `$quill` and `$seed` on a
+  composable card that `push_card` refuses, and `*doc.main_mut() =
+  Card::new("note")?` took `$quill` off the root, which `quill_reference`
+  `expect`s present — a release panic on the next bound door. `main_mut` and
+  `card_mut` return `CardMut`, which forwards every `&mut self` verb `Card`
+  carries and `Deref`s for the reads with no `DerefMut`, so a chained call
+  compiles unchanged and the assignment does not compile at all. `cards_mut` is
+  withdrawn: `move_card` / `remove_card` / `insert_card` are the slice ops and
+  `cards` / `card` the reads. No binding surface exposed a `&mut Card`.
+  Closes #1750.
+- refactor(core): **a quill reference parses its selector token directly.**
+  `QuillReference::from_str` split `name@selector` and then re-prefixed the
+  half it had just split off — `VersionSelector::from_str(&format!("@{}",
+  part))` — so the selector parser carried a `written` flag to tell the typo
+  `memo@` from the absent selector in `memo`, a distinction only the caller
+  ever had in hand. `VersionSelector::from_token` parses the unprefixed token
+  and refuses the empty one, `from_str` is the written spelling over it, and
+  the allocation per parse goes. Parsed values, `Display` output and error
+  strings are unchanged, which is what the untouched selector tests assert.
+- feat(core)!: **five `quillmark-core` document verbs with no caller are
+  gone.** `Document::to_plate_json` was the schema-free spelling of the
+  crate-internal `to_plate_json_gated` every render already takes, so the plate
+  export leaves the public Rust surface; no binding ever carried it.
+  `Document::card_kinds` had one caller, a test. `impl IntoIterator for
+  &Payload` duplicated `Payload::iter`. `MetaKey::ALL` and
+  `MetaKey::is_root_only` enumerated a two-member set to find `Seed`.
+  `PathStepWire` and the `CommentPathSegment` alias were a second and third
+  name for `PathSegment`. The bytes do not move.
+- feat(core,content)!: **unread accessors leave `quillmark-core` and
+  `quillmark-content`.** `YamlError::line` / `column` / `hint` had no caller
+  outside one test; a consumer reads the position off `to_diagnostic`.
+  `RenderedRegion::contains` had none outside its own, and `field_at` never
+  shared it — it ranks by `distance` under a tolerance. `print_errors` is gone;
+  its one caller, the CLI, carries the two-line loop. `normalize_document`
+  returns a `Document` rather than a `Result` it never filled. `Delta::apply`,
+  which panicked on a delta built against a longer revision, folds into the
+  checked `try_apply`; `ChangeBundle::from_delta` had two callers, both tests.
+  Two additions come with them: `RenderError::coded_hint`, the coded-plus-hint
+  shape four `backend.rs` refusals built by hand, and `region::nearest_region`,
+  the tolerant search `SessionHandle::field_at` and the Typst backend each
+  carried a copy of.
+- refactor(core): **`QuillValue` holds its JSON, not a mirror of it.** The
+  value carried a private `Node`/`Kind` tree annotating every node with one
+  `fill` bit, plus a seeded `serde_json::Value` cache of the same data — so
+  `from_json` deep-cloned the whole document to record markers almost none of
+  it carries, and `get` cloned a subtree twice to read one child. No consumer
+  wanted the tree: emit, both wire formats, seeding, compose and conform all
+  ask for a flat path list, which is what `Seeded` already wrote by hand and
+  what the DTO's `nested_fills` already stores. `QuillValue` is that pair — the
+  JSON beside a duplicate-free `Vec<Vec<PathSegment>>` — so the two node
+  walkers collapse to one `json_at`, and `OnceLock` and the hand-written
+  `Clone` / `PartialEq` go with them. The public surface is unchanged;
+  `set_fill_at` still refuses a path that addresses nothing, and records a
+  marker where a walk of the JSON meets it, so `fill_paths` reads in
+  declaration order and the `nested_fills` a stored document carries are
+  byte-for-byte what 0.112 wrote.
+- refactor(core): **every surface that refuses a non-content richtext value
+  spells one sentence.** `Codec::decode_field` builds the shape-mismatch
+  message and names the shape that arrived (`expected a richtext content object
+  or a markdown string, got a number`); the wire `$body` reader and the
+  richtext write coercion route through it. `Card::store_ext` bounds `$ext`
+  depth through `value::depth_check_meta_map`, the check the wire and the
+  storage DTO run. Every diagnostic code is unchanged.
+- refactor(core): **`FieldViolation` spells its own message, once.** The parse,
+  wire and storage boundaries each re-spelled the three field-invariant
+  reasons, and the wording had drifted apart. `Display` gives the reason alone
+  and `FieldViolation::message(key)` names the key inline, which all three
+  boundaries wrap. The parse path's dead `FillOnMapping` arm goes with the
+  match it lived in.
+- refactor(core): **the prescan's frame stack carries no `kind`.** `Frame.kind`
+  and `FrameKind` were written at every push and read nowhere but the write
+  that filled them.
+- refactor(content): **code-block import filters its text through
+  `Inline::push_text`.** `push_code_line` differed from it only in dropping a
+  `\n` where `push_text` spaces one, and its segments come from a
+  `split('\n')`, so the two agree on every input it receives.
+- refactor(quillmark): **`Quillmark::render` resolves the backend once.** It
+  called `supported_formats` and `open`, each resolving the quill's backend
+  separately. Same diagnostics in the same order.
+- refactor(core/quill): `is_valid_quill_name` drops its exemption for the
+  literal `__default__`, a name no quill, fixture, test or doc in the tree
+  carries.
+
+### Docs and tests
+
+- docs(content): **`ISLAND_SLOT` says who removes a stray one.** The constant
+  called a slot with no island an invariant violation and stopped there, which
+  read as the codecs contradicting the model when they drop one on import. They
+  are establishing the invariant, and they take `\r`, the bidi controls and the
+  line separators out of the same input without a word either. Closes #1808.
+- test(content): **the literal codec's stray-slot drop is stated.**
+  `from_plaintext` filters `ISLAND_SLOT` out of its input and nothing failed if
+  the filter went: `into_normalized` normalizes but does not validate, and the
+  mint does not repair a stray slot, so the codec would have handed out a
+  `Normalized` that `validate` refuses. The markdown door's half of the contract
+  landed with #1812; this is the other one. Closes #1810.
+- test(core,content,typst,pdf): **each property suite lives beside the seam it
+  states, and `quillmark-fuzz` is gone.** Seven targets over boundaries owned by
+  four crates sat in one `publish = false` member outside `default-members`, so
+  a bare `cargo test` ran none of them, and `quillmark_typst::emit` stayed a
+  `#[doc(hidden)] pub` module for a single out-of-crate import. Each is now a
+  `properties` module beside its owner's unit tests: coercion under
+  `quill/tests/`, the resting form under `quill/conform/tests/`, `Document`'s
+  JSON and markdown doors under `document/tests/`, the content decode lanes in
+  `content/tests/properties.rs`, the escapers inside `emit.rs`'s own test module
+  — where they share the `resolve` oracle they had been carrying a second copy
+  of — and the stamp spine's byte reads in `quillmark-pdf/tests/`. `emit` is
+  private, and the saved regression seeds move to the paths proptest derives
+  from the new sources. Closes #1684.
+- test(core,typst,content): **the property targets that could not fail are
+  stated so they can.** `fuzz_emit_roundtrip_arbitrary` drew `\PC{0,1000}` and
+  round-tripped what parsed, but `Document::parse` refuses any source without a
+  `$quill` root block: 0 of 2000 draws reached the assertion. The body is now
+  drawn under a spelled root block, where all 3000 do, and the property is that
+  the loop settles — richtext's markdown is a lossy projection, so a first pass
+  may move marks a second pass leaves alone; the shaped generators keep the
+  identity. `fuzz_escape_string_injection_safety` scanned escaped output for
+  three literal substrings its own generator draws once in ~10^15 cases, and
+  would have failed a correct escaper if it ever had: it and its raw-quote twin
+  are one property that parses the literal back with Typst and asserts the
+  authored characters. The `CardWire` sweep gains the spelled envelope that the
+  storage sweep already had, so every case reaches `Card::try_from` and the
+  generator-reach guard it needed is gone. Deleted outright: the wide-payload
+  loop (`spec_conformance_probe` pins the cap, and now the width it admits) and
+  the three `1..20`-deep markdown loops, which approach no boundary —
+  `MAX_NESTING_DEPTH` is 100, and content pins that.
+- docs(canon): **the stamp spine names both of its consumers.**
+  `ARCHITECTURE.md` described `quillmark-pdf` as leaf infrastructure consumed
+  by `quillmark-pdfform`. The Typst backend consumes it unconditionally — the
+  fields a plate's `form-field` calls place go through the same `stamp` — and
+  nothing under `crates/backends/typst/src/` is feature-gated, so a reader
+  following canon concluded a Typst quill's form fields come from the pdfform
+  backend, and settling #1640 took a read of three manifests. The sentence
+  now names the layer and both consumers, meeting at `&[FieldSpec]` and never
+  each other. Closes #1749.
+- ci(release): **the version arithmetic and changelog baseline are tested
+  scripts.** `release-prepare.yml`'s `Compute next version` block runs only when
+  a maintainer dispatches it, and one release candidate exists in the
+  repository's history, so a defect in its `-rc.N` branches would surface at the
+  release that needed them. The block moves to `scripts/next-version.sh`, taking
+  the dispatch inputs verbatim so the workflow step holds no conditional of its
+  own, and the changelog baseline's pre-release skip moves to
+  `scripts/last-release-tag.sh`, reading a tag list on stdin so a test feeds it
+  fixtures rather than a repository. `scripts/release-prepare.test.sh` covers
+  twenty cases in ci.yml's lint job beside the canon spine lint: an
+  override taken verbatim and one already carrying `-rc.N` left unsuffixed,
+  iteration counting `rc.9` to `rc.10` rather than concatenating, promotion
+  dropping the suffix at any N while ignoring `bump`, a minor bump zeroing the
+  patch, and a pre-release tag passed over for the final beneath it. Covering it
+  found the defect it was written for: a `bump` outside `patch` and `minor`, and
+  a `CURRENT` no branch can shape — a `0.93.1-beta.1` an earlier free-text
+  override left behind, whose arithmetic fails to stderr without failing the
+  shell — each left the version empty and exited 0, and the workflow
+  interpolated that empty string into `cargo release version`, the release
+  branch name, the tag and the changelog heading. A version the arithmetic
+  cannot compute is a refusal now. A 160-combination sweep of the original block
+  against the script shows no other difference. Closes #1767.
+- build(wasm): **the package build reads its version without jq.** `jq` was a
+  hard prerequisite of `build-wasm.sh` for one string: the version out of `cargo
+  metadata`. `cargo pkgid` carries the number the crate inherits from
+  `version.workspace`, and stripping past the last `#`, `@` or `:` reads every
+  pkgid spelling cargo has used, since a semver holds none of the three. The
+  guard is a semver match, so an unparseable pkgid fails the build rather than
+  stamping a partial string; `--release-stamp` still stamps verbatim, which is
+  what `release.yml` compares against the tag before publishing. The
+  `pkg/.gitignore` the script wrote goes — the root `.gitignore` already ignores
+  `pkg/`, and `package.template.json`'s `files` allowlist is what decides the
+  published set — and so does the brotli line in the size report, a second
+  compressor for a second number nothing acts on which printed only where it
+  happened to be installed. The core artifact's one remaining gzip pass feeds
+  both the report line and the size budget, which were compressing the same
+  8.7 MB twice. Closes #1766.
+- test(core): **`quillmark:blank_title` rides the transform schema, and only
+  it.** The keyword labels the blank that leads an enum's wire-valid domain and
+  had no test anywhere, so a rename or a drop shipped silently. The label and
+  the blank are asserted as one object, the label being meaningless without the
+  blank it names: a field carrying `ui.blank_title` emits both, a field without
+  it emits the domain and no key at all. Whole-object equality, so an
+  unconditional key emitting `""` reads as a failure rather than passing a
+  presence check. The declaration view keeps emitting `values:` verbatim —
+  injecting the blank there would emit `values: ["", …]`, which
+  `quill::enum_blank_member` rejects, so a quill round-tripping through that
+  view would stop loading. Closes #1765.
+- test(wasm): **the typed write and resolve suites run on the gated surface.**
+  `runtime/runtime.js` patches `writer` and `reader` onto the core build's
+  `Quill`, and `basic.test.js` drives the typst backend build — a different
+  class over different memory, where those verbs do not exist. That is why its
+  typed-commit and resolve suites reached for the `_`-prefixed `_commitField`
+  and `_resolve`: the front door was not there to reach. Both move to
+  `runtime.test.js`, where the gated surface is what a consumer holds, and no
+  underscored call remains in either file. Five assertions `runtime.test.js`
+  already made through `writer.set` and `writer.card(i).set` go. Ten had no
+  public twin and carry over: `edit::field_coercion_failed` and
+  `edit::field_not_inline`, which appeared nowhere else in the suite; the
+  `DocPath` a refused write anchors to; `setAll`'s all-or-nothing abort at both
+  the unknown-name and the coercion rung; `CardWriter.setAll`; and resolve's
+  declaration-order rows, its `default` and `blank` rungs, and `body` as a
+  sibling of `fields`. Six tests filed under the typed-commit title never
+  touched that ABI — they drive `applyChange` and `mapMarks` — and are retitled
+  where they sit. The foreign-module fixture copies the core build into an
+  `mkdtemp` directory and removes it in `afterAll`, where it wrote `pkg/dup-core`
+  and cleared it at the *next* run's start: a unique path per run cannot collide
+  with a concurrent one, and a leak lands in the OS temp directory rather than
+  in a build directory. Closes #1764.
+- test(quillmark): **the quiver sweeps share one walker and one loaded quiver.**
+  `quillmark_fixtures::quill_names` is the single list of fixture quills,
+  counting a directory when `quills_path` resolves it to a bundle carrying
+  `Quill.yaml` — the versioned layout every fixture uses, which neither of the
+  two bare `is_dir()` walkers knew about. The seed sweep joins the
+  empty-document and blueprint sweeps in `quiver_test.rs` over one `LazyLock`
+  quiver, so each quill loads once for all three rather than once per sweep and
+  the three run in parallel inside one binary: fifteen loads become five, two
+  engines become one, and the sweeps finish in 272 ms where the two binaries
+  took 678 ms. All three documents stay, none subsuming another — the blueprint
+  commits every `default:` and marks every defaultless cell `!must_fill`, the
+  seed commits every `example:` and omits every defaulted field, and only the
+  empty document carries no composable card. Closes #1763.
+- docs(bindings,migrations): **the parity table records differences; the
+  migration index records steps.** `BINDINGS.md`'s table drops the six rows
+  whose class was `identical`, which now read as one line above it, and three
+  rows stop restating the model the section states 90 lines up. What the table
+  holds is one row per forced difference. The migration index cuts each row to
+  the step's headline break, from 3,729 words of table cells to 594 for the
+  whole page: a chooser, not a fifth copy of each guide beside the commit, the
+  changelog and the guide itself. The one storage-format move across the
+  thirteen steps (0.111 → 0.112) is stated once in the preamble. Closes #1701.
+- docs: **the twenty pre-0.100 migration guides leave the published site.**
+  `wasm-0.77-to-0.80.md` through `0.99-to-0.100.md` and the `0.92-to-0.102.md`
+  span guide go, with their rows in the Migration overview: 5,519 lines routing
+  a consumer onto `RenderSession`, `` ```card `` fences, `QUILL:` frontmatter,
+  `$id` and `!fill`, none of which any release since 0.100 carries in any form.
+  What keeps a pre-0.100 stored blob loading is the reader in
+  `crates/core/src/document/dto.rs`, specified in
+  `prose/canon/DOCUMENT_STORAGE.md`; no guide was ever load-bearing for it.
+  `mkdocs.yml` states the nav exclusion as `/migrations/*.md`, one line in
+  place of the 33 a release had to extend.
+- docs(core): **`ERROR.md`'s args table covers the three `validation::seed_*`
+  codes it claimed.** The table is the `code` + `args` consumer contract, and
+  `diagnostic_args_match_canon` holds it to the minted set — but
+  `seed_unknown_kind`, `seed_overlay_shape` and `seed_unknown_field` were
+  missing from both, so the two agreed by omitting the same three. The rows are
+  minted from the overlay walk itself, on a document that trips all three.
+- docs(core,wasm): **`PREVIEW.md` points at the two surfaces it was copying.**
+  § "The seam" claimed every `SessionHandle` method past `render` and
+  `page_count` defaults to *absent* and that a backend's capabilities are
+  exactly the defaults it overrode. `field_at` breaks both: its default
+  hit-tests whatever `regions()` returns, so overriding `regions` alone buys a
+  working `field_at`. The section says what the seam is and leaves the
+  per-method contract to `crates/core/src/session.rs`. § "TypeScript surface"
+  loses its 62-line transcription of `runtime.d.ts`, which carries more
+  per-member contract than the copy did and is the file `npm run typecheck`
+  checks.
+- docs(content,core): **the authored lane is `overwrite` and the op wire.**
+  Canon and the 0.112 guide also named `install`, gone since 0.102, and
+  `CardInput.body`, which has never rejected anything the storage lane takes.
+  The card wire decodes storage-lane (`wire::body_from_wire` through
+  `Codec::decode_field`) and owes that: every `Card` a read hands back is typed
+  a valid `CardInput`, and a read emits a stored-only tolerance verbatim.
+  `card_wire_body_decodes_storage_lane` pins the door's lane, which had drifted
+  across canon, a released guide and four code comments with nothing catching
+  it.
+- fix(docs): **the 57 comments and doc claims that contradicted the code now
+  state it.** The user-visible ones: the Typst backend never searched system
+  fonts, so its docs stop promising `#set text(font: "Arial")` and name what a
+  world loads (`assets/fonts/*`, `packages/**`, the embedded Figtree fallback);
+  the quickstart teaches `quill.parse`, the bound door, rather than the
+  transport door; `@quillmark/wasm` has no `/runtime` subpath, and the seven
+  places that named one now spell the package's sole export.
+- docs(wasm,typst,core): **the live session's edit verb is `update` in prose
+  too.** The `@quillmark/wasm` README and the `LiveSession` rustdoc named an
+  `apply(doc)` the class does not carry, so a consumer following them reached
+  `session.apply is not a function`. The README also called `pageCount` and
+  `pageSize(page)` stable for the session's lifetime, which a committed
+  `update` invalidates: they read the current compile, the new count is
+  `ChangeSet.pageCount`, and every page in `ChangeSet.dirtyPages` needs its
+  `pageSize` re-read.
+- docs: **two copies that were copies, not two ends of a subject.**
+  `prose/README.md` divides canon and `docs/` by audience and says neither
+  restates the other. § "Addressing cards for re-render" was in both, code
+  block included; canon keeps the rule and points at the page that carries the
+  recipe. The text-type 2×2 table was in `creating-quills.md` and
+  `quill-yaml-reference.md`, with the tutorial already linking at the
+  reference; the tutorial keeps the two questions that pick a type.
+- docs(canon): **the crate compatibility position, and the third reading of an
+  unknown content name.** `ARCHITECTURE.md` § "Crate Structure" carries what the
+  withdrawn `COMPATIBILITY.md` left unstated: seven crates publish to crates.io
+  and promise no API stability before 1.0. Cargo reads a `0.x` minor bump as a
+  major and the workspace bumps nearly every release, so there is no compatible
+  release for `#[non_exhaustive]`, a sealed `Backend` or a `semver-checks` gate
+  to hold — all three are the 1.0 tag's decisions, and a removal, a rename or a
+  dependency's type in a public signature escapes all three regardless.
+  `ERROR.md`'s YAML boundary rests on that promise. `DOCUMENT_STORAGE.md`
+  § "Content vocabularies" weighed projecting an unknown name and dropping it,
+  and now weighs carrying it opaquely while refusing only to project it: that
+  holds the bytes and costs totality.
+- test(fixtures): **`classic_resume` and `cmu_letter` leave the fixture tree.**
+  2.7 MB of the 4.3 MB was their fonts. No test named `cmu_letter`;
+  `classic_resume` was named by one three-line gate that also runs on `taro`
+  and `usaf_memo`, and by the usage line of `print_blueprint`. What they
+  exercised beyond the other five is covered without them: `body.enabled:
+  false` by `sample_form` and `richtext_form`, a templated `ui.title` by
+  `core/src/quill/tests.rs`, an object-typed schema by `address_grammar.rs` and
+  `default_values_test.rs`. The `quillmark-fixtures` crate is `publish =
+  false`, so nothing outside the workspace read them.
+- test(wasm): **the `run_in_browser` test file goes; what it looked like it
+  covered is covered by suites that run.** `tests/wasm_bindings.rs` held nine
+  `#[wasm_bindgen_test]` cases and no runner — nothing under `.github/`,
+  `scripts/` or `.cargo/` names wasm-pack or a browser harness, and `cargo test
+  --workspace` compiles the file and runs zero tests out of it. Every assertion
+  it made is made by a suite that does run. One was uncovered — `seedCard` on
+  an undeclared kind answering `undefined` rather than throwing — and
+  `core.test.js` now asserts it. `wasm-bindgen-test` leaves the
+  dev-dependencies with the file.
+- fix(fuzz): **the wide-payload property requires the parse to succeed and to
+  keep every field.** `fuzz_decompose_large_payload` swallowed a parse `Err`
+  and asserted `payload().len() <= size`, a bound `Payload::len` cannot exceed,
+  so a parse that refused the input or dropped every field passed. It expects
+  the parse and pins `len() == size`.
+
+
+## v0.112.0 - 2026-09-01
+
+- feat(content)!: **every vocabulary member spells its payload in `attrs`.** The
+  canonical content had two spellings for one thing: a built-in put its payload
+  in named siblings (`{"kind":"heading","level":1}`), an unknown put it in one
+  opaque bag, and which a document used depended on whether the build that wrote
+  it happened to know the name. Promoting a name from unknown to built-in was
+  therefore an encoding change, and five mechanisms existed to bridge the split.
+  Now `Heading{level}` ⇄ `attrs.level`, `Code{lang}` ⇄ `attrs.lang`, `Link{url}`
+  ⇄ `attrs.url`, `Anchor{id}` ⇄ `attrs.id`, and `ListItem`'s
+  `ordered`/`start`/`ordinal` ⇄ the same three under `attrs`, with the envelope
+  keys (`kind`/`type`/`container`, `containers`, `continues`, `start`/`end`,
+  `instance`) staying siblings and an empty bag omitted. The Rust types are
+  unchanged — typed in memory, uniform on the wire. `fold_legacy_attrs`, the
+  `reject_*_attrs` family, `MarkKind::ord` and its placement rule, and
+  `RESERVED_*`'s wire role are all deleted; the canonical mark tie-break becomes
+  `MarkKind::sort_key`, the `(type, attrs)` pair the wire carries, which two
+  builds compute identically whether or not either knows the member. **Stored
+  documents need no migration**: the decoder reads the old spelling wherever the
+  `attrs` bag is absent. That is the load-bearing half — a `richtext` field
+  rests as a content object inside an opaque payload value carrying no schema
+  tag, so most stored content reaches no migration and a walk cannot safely find
+  it (`$ext` is arbitrary host data by contract). The fallback is frozen: unlike
+  the fold, a promotion neither grows it nor inherits it. The **break is at the
+  seam**: a host reading `line.level` / `line.lang` / `mark.url` / `mark.id` or a
+  list item's shape reads them under `attrs` (the TS narrowing types move too, so
+  `typecheck` reports it), and the authored lane — `overwrite`, `install`,
+  `CardInput.body`, and the op wire — *rejects* the old spelling rather than
+  reading it, so a stale write throws instead of landing somewhere it did not
+  aim. A foreign bag beside a built-in becomes legal in exchange, dropping unread
+  as it always did in effect. Canonical bytes move (`attrs` on built-ins, and
+  coincident marks reorder on the new tie-break), so **content hashes recompute
+  once**; generated Typst nests coincident wraps the other way for identical
+  glyphs, and `exportMarkdown` nests them the same way (`**~~x~~**` becomes
+  `~~**x**~~`, parsing back to the same content), so goldens and any hash over
+  either projection move too. A consumer holding bare seam JSON outside a
+  stored document gets a hard break, having no tag to dispatch on. The storage
+  tag becomes `quillmark/document@0.112.0`; `@0.93.0` rows migrate forward on
+  read. See [0.111 → 0.112](docs/migrations/0.111-to-0.112.md).
+- feat(core)!: **`fieldAt` and `positionAt` take a pointer tolerance, and
+  resolve to the nearest ink rather than the first containing it.** A glyph's
+  box is its run's ink height by its own advance, so a text column answers over
+  a fraction of the area it occupies: the boxes of one line abut, but the
+  leading between two lines is inside the paragraph and on no glyph. An 11pt
+  paragraph is live over about two thirds of its own height at default leading
+  and under half of it double-spaced, which is the whole of why clicking the
+  preview to place a caret misses. Both queries now take `tol` in PDF points
+  (`tolPt`, optional, on the WASM seam) and answer with the nearest placement
+  within it, a radius in both axes. The caller derives it from the scale it drew
+  the page at, slack being a property of the pointer rather than of the
+  document: a tolerance fixed in points shrinks under the cursor exactly as the
+  target does. Ranking by distance rather than growing each rect is what keeps
+  the answer the nearer item's — outset boxes overlap, and a first match over
+  them decides by paint order — and makes the tolerance a pure widening:
+  containment is distance zero, so no point that resolves exactly changes answer
+  however high `tol` goes, and later-painted still wins a tie.
+  `RenderedRegion::distance` is the measure, and `contains` is now stated in
+  terms of it. The break is the added argument on
+  `SessionHandle::{field_at,position_at}` and their `LiveSession` forwarders,
+  which a type checker reports; `0.0` is the previous behaviour exactly. The
+  WASM argument is optional and defaults to `0`, so no JS caller changes.
+- fix(content): **markdown export escapes what markdown strips at a line's
+  edges.** A line's leading and trailing space/tab crossed verbatim, so
+  `from_markdown(to_markdown(rt))` dropped it — and where the leading run
+  opened an indented code block, or hid a `- ` / `# ` / `> ` / `N. ` marker
+  from the position-0 escapes, the re-import rewrote the line's kind and
+  containers with it: `"    foo"` returned as `"foo"` under `Code`, and
+  `"   - item"` as `"item"` inside a `ListItem` nobody wrote. Neither takes
+  adversarial input, since `apply_text_delta` and `from_plaintext` both mint
+  edge whitespace: a `Codec::Plaintext` field holding an indented sample was
+  corrupted by `Document::to_markdown`. The verify-and-drop net could not catch
+  it, being gated on flanking marks — a mark-free line never reaches it, and
+  the `,…,` probe wrapping the lines that do blocks every leading-block
+  construct by design, so it reads such a line as safe while the `**` ships
+  into the text. Space and tab at an edge now cross as character references
+  (`&#32;` / `&#9;`), markdown having no backslash escape for whitespace. A
+  literal `&` still escapes, so text authored as `&#32;` returns as itself. An
+  image `alt` is the one edge run a reference cannot carry — the parser trims
+  alt after decoding it — and joins the module's documented codec limits.
+  Emitted markdown moves for content holding an edge run.
+- fix(content): **a `=` run on a continuation line stays text.** It underlined
+  the paragraph line above it into a setext heading, taking the hard break's
+  `\` into the text with it: `"abc\n==="` returned as an H1 reading `"abc\"`.
+  `\=` joins the block starters escaped at position 0.
+- fix(content): **an unknown island's type cannot leave its placeholder.**
+  `emit_island` wrote `island_type` — an open wire string no lane constrains —
+  raw into `<!-- island:… -->`, where a `-->` closes the comment early and a
+  line break ends the HTML block, either way leaking the rest as content text.
+  At column zero that opens whatever the rest spells, a `~~~` card fence
+  included, which the document layer reads as another card. The type crosses
+  with `<` / `>` as entities and control characters as spaces; nothing reads it
+  back out of markdown.
+- fix(content): **an inline unknown island keeps its line whole.**
+  `fix_html_comment_fences` inserted a newline after any `-->` carrying text
+  behind it, but only a comment opening a line — at most three spaces of indent
+  — starts an HTML block. One reached mid-line is inline HTML and swallows
+  nothing, so an inline island turned `ab` into `"a b"`. The repair fires for
+  the block-opening case alone.
+- fix(core): **the payload ingresses refuse what no parse can produce.** The
+  wire `TryFrom`, the storage DTO and `push_card` / `insert_card` each admitted
+  a payload whose markdown does not read back: a duplicate field key, more
+  fields than `MAX_FIELD_COUNT`, a repeated `$` entry, a comment whose text
+  spans lines, and a composable card carrying `$quill` or `$seed`. The comment
+  is the one that fails quietly — `#` opens a single line, so a text of
+  `"hi\ninjected: pwned"` emits bare YAML after the first line and re-reads as
+  a field nobody wrote. The rest emit markdown the parser rejects, and a
+  composable `$quill` also trips the `debug_assert` in `from_main_and_cards`,
+  which the rebuild behind `compile_data` runs: a render panicked on a debug
+  build where it owed an error. `PayloadViolation` carries the verdict —
+  `FieldViolation`'s seam one level up, reading the item list rather than one
+  item — which the wire maps to `WireError::InvalidPayload` and the DTO to
+  `StorageError::Malformed`, so both boundaries share one message. The
+  `$quill` / `$seed` half is positional, since a `CardWire` is equally how the
+  main card is read back, so it sits at placement beside the `$kind` gate as
+  `EditError::RootOnlyEntry` (`edit::root_only_entry`). The DTO refuses a root
+  `$kind` other than `main` and synthesises an absent one, as the parser does.
+  Additive: `validate_payload`, `PayloadViolation`, `MetaKey::ALL`. Both error
+  enums are `#[non_exhaustive]`, so no compiling caller changes, and no
+  document the format calls readable is refused.
+- fix(cli): **`render -f svg` / `-f png` writes every page.** The Typst backend
+  emits one artifact per page and the command wrote `artifacts.first()`,
+  discarding the rest with no warning, so a multi-page document produced a
+  single-page file that looked complete. A multi-page render now writes one
+  numbered file per page: `out.svg` becomes `out-1.svg`, `out-2.svg`, ….  Page
+  one is numbered too, so no unnumbered file claims to be the whole document.
+  `--stdout` carries one artifact and refuses a multi-page render.
+- fix(core): **a `!must_fill` marker on a mapping is refused at every ingress,
+  not just at parse.** `Card::store_fill`, the `CardWire` boundary and the
+  `@0.92.0` storage DTO took `fill: true` against an object and emitted
+  `x: a: 1`, which `Document::parse` then refuses — breaking the emit round
+  trip. The rule the parser enforces now sits beside the other field invariants
+  as `edit::validate_fill_targets`, raising `edit::fill_on_mapping`. A canonical
+  content object stays legal: emit projects it to its markdown scalar first,
+  which is the shape `!must_fill` emits against.
+- fix(core): **a comment after a nested key that needs quoting keeps its
+  position.** A comment's position is its index among its mapping's children,
+  and the prescan matched only a bare `[A-Za-z_][A-Za-z0-9_]*` nested key. So
+  `"a b": 1`, which the emitter writes itself, was not counted, and every comment
+  after it in that mapping round-tripped one slot early. The prescan reads a
+  nested key in both spellings the emitter writes at depth: quoted, and plain
+  with characters the bare form excludes.
+- fix(pdfform): **an array-bound text widget is multiline.** `resolve::coerce_text`
+  joins an array's elements with newlines unconditionally while the widget took
+  `multiline` from `ui`, defaulting to false: a viewer collapsed the `/V` at its
+  first line while the flattened SVG/PNG stacked every line, so the interactive
+  PDF and the raster disagreed.
+- fix(core): **a version segment is plain digits, and a `$quill` `@` carries a
+  selector.** `u32::from_str` accepts a leading `+`, so `memo@+2.+1` parsed as
+  `Minor(2, 1)` and `version: "+1.0"` loaded, though `quill_ref_hint` promises
+  digits and neither spelling re-`Display`s to itself; and `memo@` yielded an
+  empty selector silently read as `latest`. An absent selector still means
+  latest.
+- fix(core): **an unquoted numeric `version:` keeps its fraction.** The loader
+  accepts a YAML number by intent but converted it through `f64::to_string`,
+  which drops the fraction: `version: 1.0` became `"1"` and failed validation
+  with a hint naming the `'1.0'` the author had written. An unquoted `1.10` is
+  the YAML number `1.1` before the loader sees it, so VERSIONING.md's quote-it
+  rule now names that rather than the `x.0` case.
+- fix(python): **a value with no JSON form raises instead of storing its
+  `repr`.** `py_to_json_at` fell through to `str()`, so a tuple stored
+  `"('a', 'b')"`, a `bytes` stored `"b'...'"` and a `set` stored `"{'x'}"` —
+  silently, surfacing as garbage at render or read-back. `datetime.date`,
+  `datetime.datetime` and `datetime.time` keep the stringified form the
+  fallback existed for; everything else is a `ValueError`, which is what the
+  WASM lane already refuses.
+- fix(python): **the type stub declares `Diagnostic.args`**, the localization
+  channel the class exposes. Under a type checker `diag.args` was an attribute
+  error on a `@final` class.
+- docs(python): **the error contract names both classes the binding raises.**
+  `errors.rs` claimed every raised exception is `QuillmarkError` carrying
+  diagnostics, while an argument the binding cannot convert raises `ValueError`
+  — the behavior the binding's own tests pin. Engine refusals carry diagnostics;
+  an unconvertible argument raises `ValueError` before the engine is called.
+  Stated in the module doc and in the error-handling guide.
+- fix(wasm): **`new Document(ref)` refuses an invalid reference with the code
+  and hint `setQuillRef` attaches.** The same input was classified two ways by
+  one binding: `parse::invalid_quill_reference` plus the canonical grammar hint,
+  or a bare message. Both doors mint it through one helper now.
+- fix(typst): **a literal `;` after emitted inline markup survives to the
+  page.** Typst's markup parser reads a semicolon directly after an embedded
+  code expression as that expression's terminator and renders nothing, so
+  ``Use `--force`; otherwise`` lowered to `#raw("--force"); otherwise` and
+  dropped the character. `continues_expr` guarded `(` and `.ident` for the same
+  reason; it guards `;` now, and the emitter writes the same `\` before it.
+- fix(typst): **document text reaches the page as the characters it holds, not
+  Typst's substitutions for them.** `escape_markup` escaped `~`, whose lexer
+  shorthand is a non-breaking space, and left the rest of that class active:
+  `pages 3--5` rendered an en dash, `wait...` an ellipsis, `-5` a minus sign,
+  and `-?` an invisible soft hyphen, taking both authored characters off the
+  page. A mark decided it too, since Typst reads the text behind one as a fresh
+  token: `x-5` stayed literal but `**x**-5` lowered to `#strong[x]-5`, a minus
+  sign the content never held. Each shorthand's head is escaped now, which is
+  enough — what one leaves behind is too short to re-form it. **Smart quotes
+  stay.** `'` and `"` are an element with a set rule, not a lexer shorthand, so
+  a quill picks its own typography with `#set smartquote(enabled: false)`; the
+  emitter escaping them would settle that for every quill with no way back.
+  Documents holding a dash pair, an ellipsis or a signed number render
+  differently.
+- fix(typst): **an island that renders as nothing no longer joins the text
+  either side of it.** An island type this build does not know, and an empty
+  table island, emit no markup, so the two text runs their slot separated abut
+  in the output — where the escapers, which run per text run, see one side of
+  the join at a time. `a/`, such an island, `/b` wrote `a//b`: a Typst comment
+  that swallowed the rest of the paragraph. The emitter guards that seam with
+  the same `\` it writes at a line anchor and an expression tail.
+- fix(typst): **the caret one past a field's last character resolves to the last
+  glyph, not the paragraph's first.** `Scan::locate` admits the end position but
+  `forward_pos` matched runs half-open, so the most common caret position while
+  typing fell through to the segment's generated start. A position no run
+  contains now resolves against the nearest preceding run.
+- fix(typst): **a vendored package whose manifest declares a non-semver
+  `version` or an unusable `entrypoint` path warns instead of failing the
+  session.** Both aborted `QuillWorld::new` even when the plate never imports
+  that package, where an unparseable manifest, an unusable asset path, and a
+  missing entrypoint already warn and carry on. A non-semver `version` skips the
+  package; an unusable `entrypoint` path keeps the files already loaded and
+  skips only the check that the entrypoint is among them.
+- fix(wasm): **`RenderResult` crosses a diagnostic's `args` as the
+  `Record<string, unknown>` it declares.** It returns through tsify's ABI, whose
+  default serializer emits a `Map` for a map-typed field, where every
+  hand-serialized diagnostic path passes `serialize_maps_as_objects(true)`.
+  `RenderResult.warnings` puts the document's parse warnings ahead of the
+  render's own, and a `plate::unsupported_construct` parse warning carries
+  `args`: a quill declining a construct its body still holds renders
+  successfully, and `args.construct` read back `undefined`. `RenderResult` and
+  `Diagnostic` declare `hashmap_as_object`, and a `const` assertion holds each
+  to it.
+- fix(content): **a table island whose `aligns` or a row is not an array
+  normalizes to one the store can reload.** `normalize_table_props` repaired a
+  non-array `header` but fell through for the other two, while `table_shape_error`
+  read them as width 0 — so an island op carrying `{"aligns": "bogus"}` was
+  accepted and serialized, and the exact bytes then failed to reopen with
+  `TableAlignsMismatch`. Normalizing a table now makes its shape check pass, as
+  `KnownIslandType::normalize_props` promises.
+- fix(content): **a code block's `lang` is reduced to an identifier on the
+  storage lane and refused on the authored one.** `sanitize_lang` ran on import
+  only, so the storage decode and the `setKind` op wire took any string and
+  `emit_code` wrote it onto the fence header verbatim: a `lang` of
+  `"rust\ninjected line"` exported a content line the document never had, and a
+  backtick made the fence illegal. The storage decode sanitizes, so a blob
+  written that way still opens; the authored wire raises a shape error, since
+  the host is writing now and the repair would be silent.
+- fix(core): **a variant-bearing enum refuses a non-string `default:` at load,
+  as a plain enum already does.** The scalar branch applied the render floor's
+  leniency to a schema literal, so `default: 1` against `values: ["1"]` loaded
+  clean and then selected nothing: `selected_member`, `resolve_variant_sourced`
+  and the absent-discriminant fallback all read the default through `as_str`, so
+  the field compiled to the blank world instead.
+- fix(core): **a seeded variant container commits at its resting form.**
+  `seed_parts` runs every other field through the strict write, but
+  `seed_variant` pushed its assembled container straight through, so a `$seed`
+  overlay for a richtext cell rested as raw markdown and the next `conform`
+  rewrote bytes on a document nobody edited — the divergence the shared write
+  exists to prevent.
+
 ## v0.111.0 - 2026-08-30
 
 - feat(wasm): **`mapMarks(content, bundle)` answers where a `ChangeBundle`'s