@richscripts/richtexteditor 2.6.3 → 2.7.0

package/richtexteditor/plugins/all_plugins.js

@@ -21718,7 +21718,17 @@ function RTE_Plugin_Comments() {
 
         var id = "cmt-" + Date.now() + "-" + Math.floor(Math.random() * 10000);
         var user = getCurrentUser();
-        var anchor = options.anchor;
+        var anchor = options.anchor || options.range || null;
+        // Accept a plain DOM Range (or Range-like) as the anchor: it has the
+        // container/offset fields but no `.text`, so until 2026-09-02 the common
+        // call add({ anchor: range }) silently recorded the comment WITHOUT a
+        // highlight. Derive the text from the range instead.
+        if (anchor && anchor.startContainer && anchor.endContainer && !anchor.text) {
+            var derived = "";
+            try { derived = typeof anchor.toString === "function" ? String(anchor.toString()) : ""; } catch (e) { derived = ""; }
+            if (!derived) { try { derived = anchor.cloneContents ? (anchor.cloneContents().textContent || "") : ""; } catch (e2) { derived = ""; } }
+            anchor = { startContainer: anchor.startContainer, startOffset: anchor.startOffset, endContainer: anchor.endContainer, endOffset: anchor.endOffset, text: derived };
+        }
         var wrappedText = "";
 
         if (anchor && anchor.startContainer && anchor.endContainer && anchor.text) {
@@ -23437,17 +23447,12 @@ function RTE_Plugin_DocumentImport() {
             openPicker({});
         });
 
-        if (editor.slashCommands && typeof editor.slashCommands.register === "function") {
-            try {
-                editor.slashCommands.register({
-                    id: "import-document",
-                    title: "Import document",
-                    description: "Open a Markdown, HTML, text, or Word (.doc) file into the editor",
-                    keywords: ["import", "open", "file", "word", "markdown", "upload"],
-                    action: function () { openPicker({}); }
-                });
-            } catch (e) {}
-        }
+        // NOTE: do NOT call editor.slashCommands.register() from here. Plugins
+        // initialise in bundle (alphabetical) order and this file sorts before
+        // "slashcommand", so editor.slashCommands does not exist yet and the guarded
+        // call silently did nothing - the "import-document" slash entry never appeared for any
+        // customer until 2026-09-02. The entry now lives in slashcommand.js, gated on
+        // typeof editor.openImportDialog === "function" (same pattern as exportToPdf).
     };
 
     function kindFromName(name) {
@@ -24515,6 +24520,19 @@ function RTE_Plugin_DocumentImport() {
                 // matches the old behaviour rather than inventing <ol>s.
                 info.ordered = !!fmt && fmt !== "bullet" && fmt !== "none";
             }
+            // Word paragraph indentation. Nothing read this before 2026-09-04,
+            // so every indented paragraph in every imported .docx arrived
+            // flush left and the indentation was lost silently.
+            // w:left is in twips; 15 twips = 1px.
+            var ind = firstChildEl(ppr, "ind");
+            if (ind) {
+                var lft = ind.getAttributeNS(W, "left") || ind.getAttribute("w:left") || "";
+                var tw = parseInt(lft, 10);
+                // 720 twips alongside the Quote style is the blockquote's own
+                // indent, already carried by the blockquote element itself.
+                if (tw > 0 && !(info.quote && tw === 720))
+                    info.indentPx = Math.round(tw / 15);
+            }
             var jc = firstChildEl(ppr, "jc");
             if (jc) {
                 var a = jc.getAttributeNS(W, "val") || jc.getAttribute("w:val") || "";
@@ -24581,10 +24599,20 @@ function RTE_Plugin_DocumentImport() {
                     continue;
                 }
                 closeListsTo(0);
-                if (st.heading) out.push("<h" + st.heading + ">" + (inner || "") + "</h" + st.heading + ">");
+                if (st.heading) {
+                    // Headings carry w:ind too; without this an indented
+                    // heading imported flush left.
+                    var hs = st.indentPx ? ' style="margin-left:' + st.indentPx + 'px"' : "";
+                    out.push("<h" + st.heading + hs + ">" + (inner || "") + "</h" + st.heading + ">");
+                }
                 else if (st.quote) out.push("<blockquote>" + (inner || "<br>") + "</blockquote>");
                 else {
-                    var style = st.align ? ' style="text-align:' + st.align + '"' : "";
+                    var decl = [];
+                    if (st.align) decl.push("text-align:" + st.align);
+                    // indentUseMargin defaults to margin, and margin is what
+                    // w:ind means, so import writes margin-left to match.
+                    if (st.indentPx) decl.push("margin-left:" + st.indentPx + "px");
+                    var style = decl.length ? ' style="' + decl.join(";") + '"' : "";
                     // A paragraph that contained ONLY a text box has no text of
                     // its own; emitting an empty <p> before the box adds a blank
                     // line that was never in the document.
@@ -25607,6 +25635,31 @@ function RTE_Plugin_DocxExport() {
         var revSeq = { n: 1 };
         var base = { bold: false, italic: false, underline: false, strike: false, sizeHalfPoints: 0, color: null, highlight: null, vertAlign: null, mono: false };
 
+
+        // A block indented in the editor carries margin-left (or padding-left,
+        // per indentUseMargin). Word expresses the same thing as w:ind, in
+        // TWIPS. Before 2026-09-04 indentation reached Word only when it was
+        // spelled <blockquote>, which dragged the Quote style along with it -
+        // so indented body text arrived italic and accent-coloured.
+        // 1px = 0.75pt and 1pt = 20 twips, hence px * 15.
+        function indentTwips(node) {
+            if (!node || !node.style) return 0;
+            var raw = node.style.marginLeft || node.style.paddingLeft || "";
+            var m = /^\s*(-?[\d.]+)\s*([a-z%]*)\s*$/i.exec(raw);
+            if (!m) return 0;
+            var n = parseFloat(m[1]);
+            if (!n || n <= 0) return 0;
+            var unit = (m[2] || "px").toLowerCase();
+            var px = unit === "px" ? n
+                : unit === "pt" ? n * (4 / 3)
+                : unit === "in" ? n * 96
+                : unit === "cm" ? n * 37.795
+                : unit === "mm" ? n * 3.7795
+                : (unit === "em" || unit === "rem") ? n * 16
+                : 0;
+            return Math.round(px * 15);
+        }
+
         function para(node, style, opts) {
             opts = opts || {};
             var pr = "";
@@ -25615,6 +25668,12 @@ function RTE_Plugin_DocxExport() {
             if (opts.pre) pr += '<w:pStyle w:val="Code"/>';
             if (opts.numId) pr += "<w:numPr><w:ilvl w:val=\"" + (opts.level || 0) + "\"/><w:numId w:val=\"" + opts.numId + "\"/></w:numPr>";
             if (opts.pageBreakBefore) pr += "<w:pageBreakBefore/>";
+            // Independent of the Quote style: a real blockquote already got
+            // its w:ind above, so only emit this for everything else.
+            if (!opts.quote) {
+                var indTw = indentTwips(node);
+                if (indTw > 0) pr += '<w:ind w:left="' + indTw + '"/>';
+            }
             var align = node && node.style ? node.style.textAlign : "";
             if (align === "center" || align === "right") pr += '<w:jc w:val="' + align + '"/>';
             else if (align === "justify") pr += '<w:jc w:val="both"/>';
@@ -29256,6 +29315,277 @@ function RTE_Plugin_ImportStyles() {
     }
 }
 
+if (!window.RTE_DefaultConfig) window.RTE_DefaultConfig = {};
+
+// 2026-09-04 Inline code — CKEditor 5's "Code" feature (`<code>`), the one
+// basic-style it ships that this editor had no command for. Markdown `x` was
+// the only way to produce inline code here, which meant there was no way to
+// REMOVE it and no toolbar affordance at all.
+//
+// The command is "inlinecode", NOT "code". "code" is already taken by the
+// HTML-source-view toggle in the core (__Is_Cmd_Active case "code" ->
+// ___Is_CodeMode()), so registering "code" here would have collided with source
+// view. keyboarda11y.js has carried "inlinecode" in its TOGGLE_CMD list all
+// along, with a comment that it matched nothing in this build; a core
+// __Is_Cmd_Active case added alongside this plugin is what makes it match, so
+// the button reports aria-pressed and not just a highlight.
+//
+// Design notes:
+//   - Toggling is done by SPLITTING the <code> element around the selection
+//     rather than by lifting text nodes out of it. Splitting preserves nested
+//     inline markup: un-coding the middle of <code>a <em>b</em> c</code> keeps
+//     the <em>. Lifting text nodes would have dropped it.
+//   - A collapsed selection acts on the word under the caret. That is the same
+//     choice changecase.js makes, and for the same reason: it makes the command
+//     usable from a keyboard shortcut without selecting first. The alternative -
+//     inserting an empty <code> and putting the caret inside - is the caret trap
+//     documented in the footnotes work, so it is deliberately not done.
+//   - Never nests inside <pre> or an existing <code>: both already mean
+//     "preformatted", and nesting produces markup no serializer round-trips.
+//   - Emits a bare <code> element and no rte-* class. That keeps the styling in
+//     the content stylesheet where authors can override it, and keeps the plugin
+//     out of check-css-contract.mjs, which only scans the four theme sheets.
+RTE_DefaultConfig.plugin_inlinecode = RTE_Plugin_InlineCode;
+
+if (!RTE_DefaultConfig.text_inlinecode) RTE_DefaultConfig.text_inlinecode = "Inline code";
+
+if (!RTE_DefaultConfig.svgCode_inlinecode) {
+    RTE_DefaultConfig.svgCode_inlinecode = '<svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="7 8 3 12 7 16"/><polyline points="17 8 21 12 17 16"/></svg>';
+}
+
+function RTE_Plugin_InlineCode() {
+    var obj = this;
+    var config, editor;
+
+    obj.PluginName = "InlineCode";
+
+    obj.InitConfig = function (argconfig) { config = argconfig; };
+
+    obj.InitEditor = function (argeditor) {
+        editor = argeditor;
+
+        editor.attachEvent("exec_command_inlinecode", function (state) {
+            state.returnValue = true;
+            obj.Toggle();
+        });
+
+        // Public API, matching the shape the other toggle plugins expose.
+        editor.toggleInlineCode = function () { return obj.Toggle(); };
+        editor.isInlineCode = function () { return obj.IsActive(); };
+    };
+
+    function getDoc() { try { return editor.getDocument(); } catch (e) { return null; } }
+    function getEditable() { try { return editor.getEditable(); } catch (e) { return null; } }
+
+    function getRange(doc) {
+        var sel = doc && doc.getSelection ? doc.getSelection() : null;
+        if (!sel || !sel.rangeCount) return null;
+        return sel.getRangeAt(0);
+    }
+
+    // Nearest <code> ancestor that is still inside the editable area.
+    function codeAncestor(node, editable) {
+        while (node && node !== editable) {
+            if (node.nodeType === 1 && node.nodeName === "CODE") return node;
+            node = node.parentNode;
+        }
+        return null;
+    }
+
+    function inPre(node, editable) {
+        while (node && node !== editable) {
+            if (node.nodeType === 1 && node.nodeName === "PRE") return true;
+            node = node.parentNode;
+        }
+        return false;
+    }
+
+    obj.IsActive = function () {
+        var doc = getDoc(), editable = getEditable();
+        if (!doc || !editable) return false;
+        var range = getRange(doc);
+        if (!range) return false;
+        return !!codeAncestor(range.startContainer, editable);
+    };
+
+    // ---- selection helpers -----------------------------------------------
+
+    // Expand a collapsed caret to the word under it. Returns false when the
+    // caret is not sitting in a word, in which case the command does nothing
+    // rather than creating an empty element.
+    function expandToWord(range) {
+        var node = range.startContainer;
+        if (!node || node.nodeType !== 3) return false;
+        var text = node.data || "";
+        var offset = range.startOffset;
+        var start = offset, end = offset;
+        while (start > 0 && /\S/.test(text.charAt(start - 1))) start--;
+        while (end < text.length && /\S/.test(text.charAt(end))) end++;
+        if (start === end) return false;
+        range.setStart(node, start);
+        range.setEnd(node, end);
+        return true;
+    }
+
+    // Every text node the range actually covers. Boundary text nodes are split
+    // first so a partially-selected node is not treated as fully selected.
+    function selectedTextNodes(doc, range, editable) {
+        if (range.startContainer.nodeType === 3 && range.startOffset > 0) {
+            var s = range.startContainer;
+            if (range.startOffset < s.data.length) {
+                var rest = s.splitText(range.startOffset);
+                var endSame = (range.endContainer === s);
+                var endOff = range.endOffset;
+                range.setStart(rest, 0);
+                if (endSame) range.setEnd(rest, endOff - s.data.length);
+            }
+        }
+        if (range.endContainer.nodeType === 3 && range.endOffset < range.endContainer.data.length && range.endOffset > 0) {
+            range.endContainer.splitText(range.endOffset);
+        }
+
+        var out = [];
+        var walker = doc.createTreeWalker(editable, 4 /* SHOW_TEXT */, null, false);
+        var n;
+        while ((n = walker.nextNode())) {
+            if (!n.data) continue;
+            if (range.intersectsNode ? range.intersectsNode(n) : true) {
+                // intersectsNode is true for merely-touching nodes, so confirm
+                // the node is genuinely within the boundaries.
+                var r = doc.createRange();
+                r.selectNodeContents(n);
+                if (range.compareBoundaryPoints(Range.END_TO_START, r) < 0 &&
+                    range.compareBoundaryPoints(Range.START_TO_END, r) > 0) {
+                    out.push(n);
+                }
+            }
+        }
+        return out;
+    }
+
+    // ---- apply / remove ---------------------------------------------------
+
+    // Split `code` around the selection and unwrap only the overlapping part,
+    // so partial removal keeps the untouched halves coded.
+    function unwrapPart(doc, code, range) {
+        var parent = code.parentNode;
+        if (!parent) return;
+
+        var startsInside = code.contains(range.startContainer);
+        var endsInside = code.contains(range.endContainer);
+
+        // Tail first: extracting it cannot disturb the head's boundaries.
+        var after = doc.createRange();
+        if (endsInside) after.setStart(range.endContainer, range.endOffset);
+        else after.setStart(code, code.childNodes.length);
+        after.setEnd(code, code.childNodes.length);
+        var afterFrag = after.extractContents();
+
+        var before = doc.createRange();
+        before.setStart(code, 0);
+        if (startsInside) before.setEnd(range.startContainer, range.startOffset);
+        else before.setEnd(code, 0);
+        var beforeFrag = before.extractContents();
+
+        if (beforeFrag && beforeFrag.textContent !== "") {
+            var head = doc.createElement("code");
+            head.appendChild(beforeFrag);
+            parent.insertBefore(head, code);
+        }
+
+        // What is left in `code` is exactly the selected part: unwrap it.
+        while (code.firstChild) parent.insertBefore(code.firstChild, code);
+
+        if (afterFrag && afterFrag.textContent !== "") {
+            var tail = doc.createElement("code");
+            tail.appendChild(afterFrag);
+            parent.insertBefore(tail, code);
+        }
+
+        parent.removeChild(code);
+    }
+
+    function wrapNodes(doc, nodes, editable) {
+        // Group contiguous siblings so a run of text under one parent becomes a
+        // single <code>, not one per text node.
+        var group = [], groups = [];
+        for (var i = 0; i < nodes.length; i++) {
+            var n = nodes[i];
+            if (inPre(n, editable) || codeAncestor(n, editable)) continue;
+            if (group.length && group[group.length - 1].parentNode === n.parentNode &&
+                group[group.length - 1].nextSibling === n) {
+                group.push(n);
+            } else {
+                if (group.length) groups.push(group);
+                group = [n];
+            }
+        }
+        if (group.length) groups.push(group);
+
+        for (var g = 0; g < groups.length; g++) {
+            var run = groups[g];
+            // Whitespace-only runs would produce a <code> containing nothing but
+            // a space, which is invisible formatting debris.
+            var joined = "";
+            for (var k = 0; k < run.length; k++) joined += run[k].data;
+            if (!/\S/.test(joined)) continue;
+
+            var code = doc.createElement("code");
+            run[0].parentNode.insertBefore(code, run[0]);
+            for (var j = 0; j < run.length; j++) code.appendChild(run[j]);
+        }
+    }
+
+    // Adjacent <code><code> pairs read as one to the user but serialize as two.
+    function mergeAdjacent(editable) {
+        var all = editable.querySelectorAll("code");
+        for (var i = 0; i < all.length; i++) {
+            var code = all[i];
+            var next = code.nextSibling;
+            while (next && next.nodeType === 1 && next.nodeName === "CODE") {
+                while (next.firstChild) code.appendChild(next.firstChild);
+                next.parentNode.removeChild(next);
+                next = code.nextSibling;
+            }
+        }
+    }
+
+    obj.Toggle = function () {
+        var doc = getDoc(), editable = getEditable();
+        if (!doc || !editable) return false;
+        var range = getRange(doc);
+        if (!range) return false;
+        if (!editable.contains(range.startContainer)) return false;
+
+        if (range.collapsed && !expandToWord(range)) return false;
+
+        var nodes = selectedTextNodes(doc, range, editable);
+        if (!nodes.length) return false;
+
+        // Remove when every selected text node is already coded; otherwise apply.
+        var allCoded = true;
+        for (var i = 0; i < nodes.length; i++) {
+            if (!/\S/.test(nodes[i].data)) continue;
+            if (!codeAncestor(nodes[i], editable)) { allCoded = false; break; }
+        }
+
+        if (allCoded) {
+            var codes = [], seen = [];
+            for (var n = 0; n < nodes.length; n++) {
+                var c = codeAncestor(nodes[n], editable);
+                if (c && seen.indexOf(c) < 0) { seen.push(c); codes.push(c); }
+            }
+            for (var x = 0; x < codes.length; x++) unwrapPart(doc, codes[x], range);
+        } else {
+            wrapNodes(doc, nodes, editable);
+            mergeAdjacent(editable);
+        }
+
+        try { editor.updateToolbarStatus && editor.updateToolbarStatus(); } catch (e) { }
+        return true;
+    };
+}
+
 
 if (!RTE_DefaultConfig.svgCode_insertcode) {
 	RTE_DefaultConfig.svgCode_insertcode = '<svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.8" stroke-linecap="round" stroke-linejoin="round"><polyline points="8 7 3 12 8 17"/><polyline points="16 7 21 12 16 17"/><line x1="14" y1="5" x2="10" y2="19"/></svg>';
@@ -29588,7 +29918,7 @@ function RTE_Plugin_InsertCode() {
 			sel_lang.options.add(new Option(aliases, brush));
 
 
-			var b = sessionStorage.getItem("rte-insertcode-lang")
+			var b = null; try { b = sessionStorage.getItem("rte-insertcode-lang"); } catch (e) { } // storage throws in sandboxed / opaque-origin embeds
 			if (b) sel_lang.value = b;
 		}
 
@@ -29608,7 +29938,7 @@ function RTE_Plugin_InsertCode() {
 		btn.onclick = function () {
 			dialoginner.close();
 
-			sessionStorage.setItem("rte-insertcode-lang", sel_lang.value)
+			try { sessionStorage.setItem("rte-insertcode-lang", sel_lang.value); } catch (e) { }
 
 			if (sel_lang.value != "") {
 				var b = dp.sh.Brushes[sel_lang.value];
@@ -35445,6 +35775,28 @@ function RTE_Plugin_PdfExport() {
         var self = this;
         var base = { bold: false, italic: false, underline: false, strike: false, size: this.baseSize, color: [0, 0, 0], mono: false, link: null };
 
+    // A block indented in the editor carries margin-left (or padding-left, per
+    // indentUseMargin). Before 2026-09-04 the PDF honoured an indent only when
+    // it was spelled <blockquote>, because that was the only way the editor
+    // could express one. Points, since that is the PDF's unit: 1px = 0.75pt.
+    function cssIndentPt(node) {
+        if (!node || !node.style) return 0;
+        var raw = node.style.marginLeft || node.style.paddingLeft || "";
+        var m = /^\s*(-?[\d.]+)\s*([a-z%]*)\s*$/i.exec(raw);
+        if (!m) return 0;
+        var n = parseFloat(m[1]);
+        if (!n || n <= 0) return 0;
+        var unit = (m[2] || "px").toLowerCase();
+        var px = unit === "px" ? n
+            : unit === "pt" ? n * (4 / 3)
+            : unit === "in" ? n * 96
+            : unit === "cm" ? n * 37.795
+            : unit === "mm" ? n * 3.7795
+            : (unit === "em" || unit === "rem") ? n * 16
+            : 0;
+        return px * 0.75;
+    }
+
         function block(node, style, indent, listMarker, listId, listOrdered) {
             var tag = node.tagName.toLowerCase();
             var s = styleOf(node, style);
@@ -35517,8 +35869,9 @@ function RTE_Plugin_PdfExport() {
                     continue;
                 }
                 if (isBlockTag(tag)) {
-                    if (hasBlockChildren(c)) { walk(c, styleOf(c, style), indent + (tag === "blockquote" ? self.baseSize * 1.5 : 0)); continue; }
-                    block(c, style, indent + (tag === "blockquote" ? self.baseSize * 1.5 : 0), null);
+                    var own = (tag === "blockquote" ? self.baseSize * 1.5 : 0) + cssIndentPt(c);
+                    if (hasBlockChildren(c)) { walk(c, styleOf(c, style), indent + own); continue; }
+                    block(c, style, indent + own, null);
                     continue;
                 }
                 // Inline content sitting directly under a container.
@@ -36441,17 +36794,12 @@ function RTE_Plugin_ReadabilityStats() {
             openDialog();
         });
 
-        if (editor.slashCommands && typeof editor.slashCommands.register === "function") {
-            try {
-                editor.slashCommands.register({
-                    id: "readability-stats",
-                    title: "Readability statistics",
-                    description: "Flesch reading ease, grade level, and reading time",
-                    keywords: ["readability", "flesch", "grade", "reading", "stats", "score"],
-                    action: function () { openDialog(); }
-                });
-            } catch (e) {}
-        }
+        // NOTE: do NOT call editor.slashCommands.register() from here. Plugins
+        // initialise in bundle (alphabetical) order and this file sorts before
+        // "slashcommand", so editor.slashCommands does not exist yet and the guarded
+        // call silently did nothing - the "readability-stats" slash entry never appeared for any
+        // customer until 2026-09-02. The entry now lives in slashcommand.js, gated on
+        // typeof editor.getReadabilityStats === "function" (same pattern as exportToPdf).
     };
 
     function currentText() {
@@ -37877,8 +38225,9 @@ if (!window.RTE_DefaultConfig) window.RTE_DefaultConfig = {};
 //   config.sanitizerAllowStyleTags = true    // keep <style> in content
 //   config.sanitizerAllowIframes = false     // drop <iframe> outright
 //   config.sanitizerAllowedIframeHosts = ["www.youtube.com"]
-//   config.sanitizerAllowTags = ["custom-el"]
-//   config.sanitizerAllowAttributes = ["my-attr"]
+//   config.sanitizerAllowTags = ["custom-el", "x-*", /^ui-/]
+//   config.sanitizerAllowAttributes = ["my-attr", "data-cms-*"]
+//        exact names, "*" wildcards, or RegExp -- see buildMatcher()
 RTE_DefaultConfig.plugin_sanitizer = RTE_Plugin_Sanitizer;
 if (typeof RTE_DefaultConfig.contentSanitizer === "undefined") RTE_DefaultConfig.contentSanitizer = true;
 
@@ -38065,12 +38414,63 @@ function RTE_Plugin_Sanitizer() {
         return false;
     }
 
+    // Build a name matcher from a config list. Entries may be:
+    //   "my-widget"   an exact name
+    //   "my-*"        a wildcard, where * matches any run of characters
+    //   /^my-/        a RegExp
+    // The wildcard form is what makes this a workable answer to CKEditor's General
+    // HTML Support: without it an integrator has to enumerate every tag and
+    // attribute a CMS might emit, by name, which nobody does -- so the content gets
+    // unwrapped instead and the integrator concludes the editor destroys it.
+    //
+    // A pattern widens what is KEPT, never what is executed: on* handlers,
+    // javascript: URLs, <script> and iframe[srcdoc] are all handled before this is
+    // consulted, so allowing a tag or attribute by pattern cannot re-open those.
+    //
+    // Wildcards are matched by hand rather than compiled to a RegExp, so a config
+    // value can never be a regex-injection vector and no escaping table has to be
+    // kept correct.
+    function buildMatcher(list) {
+        var literal = {};
+        var globs = [];
+        var regexps = [];
+        (list || []).forEach(function (entry) {
+            if (entry instanceof RegExp) { regexps.push(entry); return; }
+            var t = String(entry).toLowerCase();
+            if (t.indexOf("*") === -1) { literal[t] = true; return; }
+            globs.push(t.split("*"));
+        });
+        function globMatches(parts, name) {
+            // parts came from splitting on "*": they must appear in order, the first
+            // anchored at the start and the last at the end.
+            var first = parts[0];
+            if (name.lastIndexOf(first, 0) !== 0) return false;
+            var last = parts[parts.length - 1];
+            if (last) {
+                if (name.length < last.length) return false;
+                if (name.indexOf(last, name.length - last.length) === -1) return false;
+            }
+            var pos = first.length;
+            for (var i = 1; i < parts.length; i++) {
+                if (!parts[i]) continue;
+                var at = name.indexOf(parts[i], pos);
+                if (at === -1) return false;
+                pos = at + parts[i].length;
+            }
+            return true;
+        }
+        return function (name) {
+            if (literal[name]) return true;
+            for (var i = 0; i < globs.length; i++) if (globMatches(globs[i], name)) return true;
+            for (var j = 0; j < regexps.length; j++) if (regexps[j].test(name)) return true;
+            return false;
+        };
+    }
+
     // --------------------------------------------------------------- engine
     function sanitizeNode(root, report) {
-        var allowExtra = {};
-        (config.sanitizerAllowTags || []).forEach(function (t) { allowExtra[String(t).toLowerCase()] = true; });
-        var attrExtra = {};
-        (config.sanitizerAllowAttributes || []).forEach(function (a) { attrExtra[String(a).toLowerCase()] = true; });
+        var allowExtra = buildMatcher(config.sanitizerAllowTags);
+        var attrExtra = buildMatcher(config.sanitizerAllowAttributes);
         var allowStyleTag = config.sanitizerAllowStyleTags === true;
 
         // Collect first: removing nodes while walking a live list skips siblings.
@@ -38079,7 +38479,7 @@ function RTE_Plugin_Sanitizer() {
             for (var i = 0; i < n.childNodes.length; i++) {
                 var c = n.childNodes[i];
                 if (c.nodeType === 1) { all.push(c); collect(c); }
-                else if (c.nodeType === 8) all.push(c);   // comments can hide markup
+                else if (c.nodeType === 8) all.push(c);   // checked, see commentEscapes()
             }
         })(root);
 
@@ -38087,7 +38487,33 @@ function RTE_Plugin_Sanitizer() {
             var el = all[i];
             if (!el.parentNode) continue;                 // already removed with an ancestor
 
-            if (el.nodeType === 8) { el.parentNode.removeChild(el); continue; }
+            if (el.nodeType === 8) {
+                // Comments used to be removed wholesale, on the stated grounds that
+                // "comments can hide markup". That reason does not survive testing:
+                // serialise <!--<script>alert(1)</script>--> and re-parse it and the
+                // script is inert -- a well-formed comment is just text.
+                //
+                // What IS unsafe is a narrow, enumerable set of comment DATA that
+                // cannot survive serialisation, because the serialiser writes the
+                // data verbatim between <!-- and -->. Re-parsing then ends the
+                // comment early and the remainder becomes live markup:
+                //
+                //   "--> <img src=x onerror=...>"  -> <!----> <img ...>-->   ESCAPES
+                //   "--!> <img ...>"               -> <!----!> <img ...>-->  ESCAPES
+                //   "> <img ...>"                  -> <!--> <img ...>-->     ESCAPES
+                //   "-> <img ...>"                 -> <!---> <img ...>-->    ESCAPES
+                //
+                // That is the WHATWG serialisation constraint, not a heuristic, so
+                // it can be enumerated rather than guessed at. Everything else is
+                // kept, which is what lets a CMS round-trip its own markers and lets
+                // an email template keep its Outlook conditional comments -- the
+                // mechanism emailtoolkit.js needs and could not previously rely on.
+                if (commentEscapes(el.data)) {
+                    note(report.removedTags, "#comment");
+                    el.parentNode.removeChild(el);
+                }
+                continue;
+            }
 
             var tag = (el.localName || el.nodeName || "").toLowerCase();
 
@@ -38115,7 +38541,7 @@ function RTE_Plugin_Sanitizer() {
                 note(report.removedTags, tag);
                 el.parentNode.removeChild(el);
                 continue;
-            } else if (!ALLOWED_TAGS[tag] && !allowExtra[tag]) {
+            } else if (!ALLOWED_TAGS[tag] && !allowExtra(tag)) {
                 // Unknown element: unwrap rather than delete, so the words a
                 // user typed inside a stray tag are not silently lost.
                 note(report.removedTags, tag);
@@ -38144,7 +38570,7 @@ function RTE_Plugin_Sanitizer() {
                     if (!isSafeUrl(value, tag, name)) { note(report.removedAttributes, tag + "[" + name + "]"); el.removeAttribute(attrs[k].name); }
                     continue;
                 }
-                if (!ALLOWED_ATTRS[name] && !attrExtra[name]) {
+                if (!ALLOWED_ATTRS[name] && !attrExtra(name)) {
                     note(report.removedAttributes, name);
                     el.removeAttribute(attrs[k].name);
                 }
@@ -38257,6 +38683,44 @@ function RTE_Plugin_Sanitizer() {
     // Measured: the payload ran locally AND replicated to the peer with its
     // onerror attribute intact.
     //
+    // THREAT MODEL -- read this before tightening or loosening the rule below.
+    //
+    // An escaping comment CANNOT BE AUTHORED AS AN HTML STRING. Feed
+    // `<!--x--> <img src=q onerror=...>-->` to setHTMLCode and the parser yields
+    // comment("x") + text + a normal <img> element, which the element/attribute
+    // filters already handle. The ONLY way to obtain a comment node whose data
+    // escapes is programmatic DOM construction -- document.createComment(), or a
+    // sync layer building nodes directly.
+    //
+    // That is why the guard lives on the DOM-level paths (the sanitise pass and the
+    // live-DOM MutationObserver) and why the string paths need nothing extra. Both
+    // string directions were measured: sender getHTMLCode, receiver setHTMLCode, and
+    // the receiver's live DOM all yield zero executable attributes, because
+    // wrapSerializers() and wrapSetters() filter on the way out and on the way in.
+    //
+    // The previous rule here deleted EVERY comment, justified only by the remark
+    // "comments can hide markup". That is false -- serialise
+    // <!--<script>alert(1)</script>--> and re-parse it and the script is inert -- and
+    // it cost the product CMS round-tripping and Outlook conditional comments (the
+    // mechanism emailtoolkit.js needs) for as long as nobody re-checked it. An
+    // unexplained restriction outlives its reason, so this one is written down.
+    //
+    // A comment's data is written verbatim between <!-- and -->, so data that
+    // contains a terminator (or opens with one) breaks out of the comment when the
+    // serialised output is re-parsed, turning the remainder into live markup.
+    // Module scope on purpose: both the sanitiser pass and the live-DOM
+    // MutationObserver below need it, and they must agree exactly on what is unsafe.
+    // Deliberately conservative -- it rejects rather than rewrites, because silently
+    // editing someone's comment text is its own kind of surprise.
+    function commentEscapes(data) {
+        var d = String(data == null ? "" : data);
+        if (d.indexOf("-->") !== -1) return true;
+        if (d.indexOf("--!>") !== -1) return true;
+        if (d.charAt(0) === ">") return true;
+        if (d.charAt(0) === "-" && d.charAt(1) === ">") return true;
+        return false;
+    }
+
     // A MutationObserver is the only place to catch every arrival path — sync,
     // drop, a third-party plugin, host-page code. It is honest to say this
     // narrows the window rather than closing it completely: the observer runs
@@ -38307,6 +38771,16 @@ function RTE_Plugin_Sanitizer() {
                 }
                 for (var a = 0; a < rec.addedNodes.length; a++) {
                     var node = rec.addedNodes[a];
+                    // Comments are preserved now, so an injected comment whose data
+                    // escapes on re-parse has to wake the sanitiser. This loop used
+                    // to skip every non-element node, which was safe only while
+                    // comments were being deleted unconditionally. The CRDT sync
+                    // path is exactly how a node arrives here without passing the
+                    // input filter -- that is the path that produced the stored XSS.
+                    if (node.nodeType === 8) {
+                        if (commentEscapes(node.data)) { suspect = true; break; }
+                        continue;
+                    }
                     if (node.nodeType !== 1) continue;      // typing inserts text: free
                     if (looksDangerous(node)) { suspect = true; break; }
                 }
@@ -38495,7 +38969,17 @@ function RTE_Plugin_ShadowDom() {
         var id = String(node.id || "");
         if (/^rte[-_]|^__rte/.test(id)) return true;
         var href = node.href || "";
-        if (!href) return false;
+        if (!href) {
+            // An inline <style> with no id and no href is what bundlers (Vite,
+            // webpack style-loader) inject for an imported theme. Recognise it by
+            // its content, or a shadow-root editor is unstyled (39,726 px toolbar,
+            // Times New Roman) exactly as before this plugin existed. 2026-09-02.
+            if (node.tagName === "STYLE") {
+                var css = node.textContent || "";
+                return /[.]richtexteditor|rte-toolbar|rte-editor|rte-dialog|[.]rte-a11y/.test(css);
+            }
+            return false;
+        }
         var base = assetBase();
         if (base && href.indexOf(base) === 0) return true;
         // Fall back to the file names this product actually ships, so an
@@ -38643,7 +39127,7 @@ function RTE_Plugin_SlashCommand() {
         editor.slashCommands = {
             register: registerCommand,
             remove: removeCommand,
-            list: function () { return commands.slice(); },
+            list: function () { refreshDefaults(); return commands.slice(); },
             open: function () { openPopup(true); },
             close: closePopup,
             isOpen: function () { return !!popupEl; }
@@ -38655,6 +39139,15 @@ function RTE_Plugin_SlashCommand() {
                 registerCommand(config.slashCommands[i]);
             }
         }
+        // Plugins initialise synchronously in bundle (alphabetical) order, so at
+        // this point every plugin sorting AFTER "slashcommand" (tabletools,
+        // textdirection, watermark, tableofcontents, typewriter, ...) has not
+        // defined its editor.* API yet and the typeof gates in
+        // buildDefaultCommands() were false: nine entries (sort asc/desc, rtl/
+        // ltr/autodir, watermark, toc, typewriter, focusmode) were missing for
+        // every customer until 2026-09-02. Rebuild once the constructor has
+        // finished (setTimeout 0 runs after all plugin inits) and again on open.
+        setTimeout(refreshDefaults, 0);
 
         injectStyles();
 
@@ -38677,7 +39170,26 @@ function RTE_Plugin_SlashCommand() {
         else commands.push(normalizeCommand(def));
     }
 
+    var removedIds = {};
+    // Rebuild the gated default entries (their typeof checks may only be true
+    // now) while keeping every custom registration and honouring remove().
+    function refreshDefaults() {
+        if (!editor) return;
+        var custom = [];
+        for (var i = 0; i < commands.length; i++) if (!commands[i]._default) custom.push(commands[i]);
+        var defaults = buildDefaultCommands();
+        var next = [];
+        for (var d = 0; d < defaults.length; d++) {
+            var id = defaults[d].id;
+            if (removedIds[id]) continue;
+            var overridden = false;
+            for (var c = 0; c < custom.length; c++) if (custom[c].id === id) { overridden = true; break; }
+            if (!overridden) next.push(defaults[d]);
+        }
+        commands = next.concat(custom);
+    }
     function removeCommand(id) {
+        removedIds[id] = true;
         var idx = findCommandIndex(id);
         if (idx >= 0) commands.splice(idx, 1);
     }
@@ -38687,12 +39199,25 @@ function RTE_Plugin_SlashCommand() {
         return -1;
     }
 
+    // Localization with an English fallback for EVERY entry (defaults, plugin
+    // register() calls, AI actions, config.slashCommands): the lang packs set
+    // config.text_<key>; __GetLangText returns the raw KEY when one is missing,
+    // so resolve only when a translation exists. Keys: text_slash_<id> (title),
+    // text_slash_<id>_desc (description), text_slash_section_<section>.
+    function L(key, fallback) {
+        try {
+            var k = String(key).toLowerCase().replace(/[^a-z0-9_]/g, "_");
+            if (config && config["text_" + k] && editor && typeof editor.getLangText === "function") return editor.getLangText(k);
+        } catch (e) { }
+        return fallback;
+    }
     function normalizeCommand(def) {
+        var section = def.section || "Blocks";
         return {
             id: def.id,
-            section: def.section || "Blocks",
-            title: def.title || def.id,
-            description: def.description || "",
+            section: L("slash_section_" + section, section),
+            title: L("slash_" + def.id, def.title || def.id),
+            description: L("slash_" + def.id + "_desc", def.description || ""),
             keywords: (def.keywords || []).slice(),
             icon: def.icon || "",
             iconSvg: def.iconSvg || "",
@@ -38743,11 +39268,13 @@ function RTE_Plugin_SlashCommand() {
         var list = [];
 
         function push(section, id, title, description, keywords, iconSvg, run) {
-            list.push(normalizeCommand({
+            var cmd = normalizeCommand({ // normalizeCommand localizes title/description/section
                 id: id, section: section, title: title,
                 description: description, keywords: keywords,
                 iconSvg: iconSvg, run: run
-            }));
+            });
+            cmd._default = true;
+            list.push(cmd);
         }
 
         push("Blocks", "heading1", "Heading 1", "Large section heading", ["h1", "title"], iconHeading("1"),
@@ -38963,7 +39490,8 @@ function RTE_Plugin_SlashCommand() {
         // Gated on the API rather than registered by the plugin itself: plugins
         // initialise in bundle order, so anything sorting before "slashcommand"
         // would call slashCommands.register() before it exists and vanish from
-        // this menu without any error. This check runs when the menu opens.
+        // this menu without any error. These checks are re-run by refreshDefaults()
+        // after all plugins have initialised and again each time the menu opens.
         if (typeof editor.exportToPdf === "function") {
             push("Tools", "exportpdf", "Export to PDF", "Real text, not a screenshot — selectable, searchable and screen-reader friendly", ["pdf", "export", "download", "save", "print", "text", "accessible", "searchable"], iconPdfText(),
                 function () { editor.exportToPdf(); });
@@ -38972,6 +39500,32 @@ function RTE_Plugin_SlashCommand() {
             push("Tools", "exportdocx", "Export to Word (.docx)", "A real OOXML document, built in the browser with no upload", ["word", "docx", "ooxml", "export", "download", "save", "office"], iconWordFile(),
                 function () { editor.exportToDocx(); });
         }
+        // documentimport.js and readabilitystats.js sort before this file, so they
+        // cannot register at init (editor.slashCommands does not exist yet); their
+        // guarded calls silently did nothing and these two entries were missing for
+        // every customer until 2026-09-02. Declared here, gated on the plugin API.
+        if (typeof editor.openImportDialog === "function") {
+            push("Tools", "import-document", "Import document", "Open a Markdown, HTML, text, or Word file into the editor", ["import", "open", "file", "word", "docx", "markdown", "upload"], iconWordFile(),
+                function () { editor.openImportDialog({}); });
+        }
+        if (typeof editor.getReadabilityStats === "function") {
+            push("Tools", "readability-stats", "Readability statistics", "Flesch reading ease, grade level, and reading time", ["readability", "flesch", "grade", "reading", "stats", "score"], iconSpell(),
+                function () { editor.execCommand("readability"); });
+        }
+        // Marketed features that had NO toolbar button and NO slash entry (reachable
+        // only via the API) until 2026-09-02. All gated on the owning plugin.
+        if (typeof editor.insertCrossReference === "function") {
+            push("Insert", "crossreference", "Cross-reference", "Insert a live reference to a heading, figure, table, or bookmark", ["cross", "reference", "xref", "see", "figure", "heading"], iconXref(),
+                function () { editor.execCommand("insertcrossreference"); });
+        }
+        if (editor.restrictedEditing) {
+            push("Tools", "restrictedediting", "Restricted editing", "Lock the document and mark only the regions others may edit", ["restrict", "lock", "protect", "editable", "region", "permission"], iconPen(),
+                function () { editor.execCommand("restrictedediting"); });
+        }
+        if (editor.dictation) {
+            push("Tools", "dictation", "Dictation", "Speak and have your words typed into the document", ["dictate", "speech", "voice", "microphone", "talk"], iconReadAloud(),
+                function () { editor.execCommand("dictation"); });
+        }
         if (typeof editor.copyAsMarkdown === "function") {
             push("Tools", "copymarkdown", "Copy as Markdown", "Copy the whole document to the clipboard as Markdown", ["markdown", "md", "copy", "clipboard", "export"], iconMarkdown(),
                 function () { editor.copyAsMarkdown(); });
@@ -39103,6 +39657,7 @@ function RTE_Plugin_SlashCommand() {
     }
 
     function openPopup(manual) {
+        refreshDefaults();
         closePopup();
         var sel = editor.getSelection();
         if (!sel || sel.rangeCount === 0) return;
@@ -42819,7 +43374,9 @@ function RTE_Plugin_WordExport() {
             "table { border-collapse: collapse; }\r\n" +
             "td, th { border: 1px solid #999; padding: 4px 8px; }\r\n" +
             "img { max-width: 100%; height: auto; }\r\n" +
-            "blockquote { border-left: 3px solid #ccc; margin-left: 0; padding-left: 12px; color: #444; }\r\n" +
+            // margin-left was zeroed here, which also flattened any indentation
+            // expressed as a margin. Keep the quote bar, keep the offset.
+            "blockquote { border-left: 3px solid #ccc; padding-left: 12px; color: #444; }\r\n" +
             "pre { font-family: Consolas, 'Courier New', monospace; background: #f4f4f4; padding: 8px; }\r\n" +
             "</style>\r\n" +
             "</head>\r\n" +
@@ -43018,9 +43575,42 @@ function RTE_Plugin_YjsCollab() {
         // and the review ledger bridge.
         if (session.textSyncMode === "crdt") {
             try {
+                // 2026-09-02: the engine bundles its OWN Yjs and builds nodes with it.
+                // A doc built by the host's Yjs (npm/esm "yjs" + y-websocket - the
+                // documented path) is a FOREIGN instance: inserting engine-built nodes
+                // into it throws "Unexpected content type in insert operation" and text
+                // never syncs, while presence still works and the status still said
+                // "crdt". Yjs updates are instance-independent bytes, so bind the
+                // engine to an inner doc built with ITS Yjs and bridge updates both
+                // ways: host->inner with the engine's applyUpdate, inner->host with the
+                // host's module (options.Y or window.Y). Without the host module the
+                // outbound leg cannot be applied safely, so fail LOUDLY instead.
+                var engineY = window.RichTextEditorCrdt.Y || null;
+                var hostY = options.Y || (typeof window !== "undefined" ? window.Y : null) || null;
+                var bindDoc = doc;
+                var foreign = !!(engineY && engineY.Doc && !(doc instanceof engineY.Doc));
+                if (foreign) {
+                    if (!hostY || typeof hostY.applyUpdate !== "function" || typeof hostY.encodeStateAsUpdate !== "function") {
+                        throw new Error("yjscollab: the Y.Doc was created by a different Yjs instance than crdt-engine.js bundles. Pass your Yjs module to attach({ Y }) (or build the doc with window.RichTextEditorCrdt.Y) so text can be bridged.");
+                    }
+                    var BRIDGE = { bridge: "rte-yjs-bridge" };
+                    var inner = new engineY.Doc();
+                    engineY.applyUpdate(inner, hostY.encodeStateAsUpdate(doc), BRIDGE);
+                    var LOCAL = window.RichTextEditorCrdt.LOCAL_ORIGIN;
+                    // A host-doc write the plugin tagged as LOCAL (ledger entries) must not
+                    // make the engine re-render the editable (see flush race in the engine).
+                    var hostToInner = function (update, origin) { if (origin === BRIDGE) return; try { engineY.applyUpdate(inner, update, (LOCAL && origin === LOCAL) ? LOCAL : BRIDGE); } catch (e) { if (window.console) console.error("yjscollab bridge host->inner:", e); } };
+                    var innerToHost = function (update, origin) { if (origin === BRIDGE) return; try { hostY.applyUpdate(doc, update, BRIDGE); } catch (e) { if (window.console) console.error("yjscollab bridge inner->host:", e); } };
+                    doc.on("update", hostToInner);
+                    inner.on("update", innerToHost);
+                    session.cleanup.push(function () { try { doc.off("update", hostToInner); } catch (e) { } try { inner.off("update", innerToHost); } catch (e) { } try { inner.destroy(); } catch (e) { } });
+                    session.yjsBridge = true;
+                    bindDoc = inner;
+                    if (window.console && console.info) console.info("yjscollab: bridging a foreign Yjs doc into the CRDT engine (updates relayed both ways).");
+                }
                 session.crdtBinding = window.RichTextEditorCrdt.attachCrdtBinding({
                     editable: editor.getEditable(),
-                    ydoc: doc,
+                    ydoc: bindDoc,
                     provider: provider,
                     awareness: provider.awareness,
                     fragmentName: options.fragmentName || "default",
@@ -43033,6 +43623,24 @@ function RTE_Plugin_YjsCollab() {
                     try { session.crdtBinding && session.crdtBinding.dispose(); }
                     catch (ignore) { }
                 });
+                // Per-author undo. The engine ships a Y.UndoManager scoped to LOCAL_ORIGIN
+                // (undo.ts) but nothing attached it, so Ctrl+Z ran the core DOM-snapshot
+                // undo and reverted OTHER people's edits on every peer (2026-09-02). Route
+                // undo/redo to the engine while crdt mode is active.
+                try {
+                    if (typeof window.RichTextEditorCrdt.attachUndoManager === "function" && session.crdtBinding && session.crdtBinding.fragment) {
+                        session.undoManager = window.RichTextEditorCrdt.attachUndoManager({ fragment: session.crdtBinding.fragment });
+                        var undoHook = function (state) { if (!session || !session.undoManager) return; state.returnValue = true; state.stopBubble = true; try { session.undoManager.undo(); } catch (e) { } };
+                        var redoHook = function (state) { if (!session || !session.undoManager) return; state.returnValue = true; state.stopBubble = true; try { session.undoManager.redo(); } catch (e) { } };
+                        editor.attachEvent("exec_command_undo", undoHook);
+                        editor.attachEvent("exec_command_redo", redoHook);
+                        session.cleanup.push(function () {
+                            try { if (typeof editor.detachEvent === "function") { editor.detachEvent("exec_command_undo", undoHook); editor.detachEvent("exec_command_redo", redoHook); } } catch (e) { }
+                            try { session.undoManager && session.undoManager.destroy(); } catch (e) { }
+                            session.undoManager = null;
+                        });
+                    }
+                } catch (undoErr) { if (window.console) console.warn("yjscollab: undo manager not attached:", undoErr); }
             } catch (err) {
                 session.fallbackReason = "crdt-attach-failed";
                 session.crdtError = err;
@@ -43065,7 +43673,7 @@ function RTE_Plugin_YjsCollab() {
         }
         return {
             attached: true,
-            textSyncMode: session.textSyncMode,
+            textSyncMode: session.textSyncMode, yjsBridge: !!session.yjsBridge,
             requestedTextSync: session.requestedTextSync,
             fallbackReason: session.fallbackReason || null,
             peerCount: getRemotePeers().length
@@ -43310,6 +43918,52 @@ function RTE_Plugin_YjsCollab() {
             lastKnownHtml = localInitial;
         }
 
+        // --- IME composition gate (legacy snapshot mode) ---------------------
+        // setEditorHtml() replaces the whole document. Doing that while an IME
+        // is composing swaps the live text node out from under it, so the
+        // commit lands at a stale offset and the raw buffer survives: composing
+        // "shi" and committing a character while a collaborator typed produced
+        // "Xbasesh<char>i" on BOTH peers (2026-09-03 — the same corruption the
+        // crdt binding had, on the deprecated-but-supported path v2.0 customers
+        // still run). Hold the repaint until the composition commits.
+        var composing = false;
+        var pendingRemoteHtml = null;
+        var compositionDoc = (editor.getDocument && editor.getDocument()) || null;
+        if (compositionDoc) {
+            var onCompStart = function () { composing = true; };
+            var onCompEnd = function () {
+                if (!composing) return;
+                composing = false;
+                setTimeout(function () {
+                    if (pendingRemoteHtml !== null) {
+                    // Deliberately NOT repainting: that would discard the
+                    // character the IME just committed. Adopt the remote text as
+                    // the diff baseline instead, so the local push that follows
+                    // is computed against what the peers actually hold. Legacy
+                    // mode is documented last-write-wins on same-paragraph
+                    // conflicts, so the local commit winning is correct here —
+                    // corrupted text was not.
+                        lastKnownHtml = pendingRemoteHtml;
+                        pendingRemoteHtml = null;
+                    }
+                    // Push explicitly. The commit's DOM mutation is delivered to
+                    // the MutationObserver BEFORE compositionend fires, so it was
+                    // dropped by the `composing` guard — without this the
+                    // committed character never reaches the peers at all
+                    // (measured: A "base<char>", B "base").
+                    onEditorMutation();
+                }, 0);
+            };
+            // Bound on the DOCUMENT, not the body: some skins remount the body
+            // (see attachMutationObserver below) and composition events bubble.
+            compositionDoc.addEventListener("compositionstart", onCompStart, true);
+            compositionDoc.addEventListener("compositionend", onCompEnd, true);
+            session.cleanup.push(function () {
+                compositionDoc.removeEventListener("compositionstart", onCompStart, true);
+                compositionDoc.removeEventListener("compositionend", onCompEnd, true);
+            });
+        }
+
         // Y.Text → editor.
         var onTextChange = function (event, transaction) {
             if (pushing) return;
@@ -43317,6 +43971,7 @@ function RTE_Plugin_YjsCollab() {
             if (transaction && transaction.local) return;
             var fresh = session.textMap.toString();
             if (fresh === lastKnownHtml) return;
+            if (composing) { pendingRemoteHtml = fresh; return; }
             setEditorHtml(fresh);
             lastKnownHtml = fresh;
             // 2026-05-28 setEditorHtml writes into editable.innerHTML; if that
@@ -43331,6 +43986,9 @@ function RTE_Plugin_YjsCollab() {
         // Editor DOM → Y.Text. Debounced so bursts collapse to one CRDT diff.
         var onEditorMutation = function () {
             if (applying) return;
+            // Intermediate IME buffers are not real edits; the commit fires its
+            // own mutation. Pushing them also races the composition gate above.
+            if (composing) return;
             if (pendingPushTimer) return;
             // 2026-05-28 Re-attach observer if the body was remounted since last
             // mutation. Cheap no-op when body is unchanged.
@@ -43418,17 +44076,17 @@ function RTE_Plugin_YjsCollab() {
 
         ledger.add = function (entry) {
             var result = originalAdd.call(ledger, entry);
-            if (result && !echoGuard) session.ledgerMap.set(result.id, cloneEntry(result));
+            if (result && !echoGuard) ledgerWrite(function () { session.ledgerMap.set(result.id, cloneEntry(result)); });
             return result;
         };
         ledger.update = function (id, patch) {
             var result = originalUpdate.call(ledger, id, patch);
-            if (result && !echoGuard) session.ledgerMap.set(result.id, cloneEntry(result));
+            if (result && !echoGuard) ledgerWrite(function () { session.ledgerMap.set(result.id, cloneEntry(result)); });
             return result;
         };
         ledger.remove = function (id) {
             var result = originalRemove.call(ledger, id);
-            if (result && !echoGuard) session.ledgerMap.delete(id);
+            if (result && !echoGuard) ledgerWrite(function () { session.ledgerMap.delete(id); });
             return result;
         };
 
@@ -43462,6 +44120,16 @@ function RTE_Plugin_YjsCollab() {
         });
     }
 
+    // Ledger writes are the plugin's own (non-text) Y.Doc transactions. In crdt
+    // mode they are tagged with the engine's LOCAL_ORIGIN so the engine does not
+    // re-render the editable for them - a re-render between a DOM mutation and
+    // the observer flush discarded that mutation (2026-09-02: comment anchors
+    // vanished the instant the ledger entry was written).
+    function ledgerWrite(fn) {
+        var origin = (session && session.textSyncMode === "crdt" && window.RichTextEditorCrdt) ? window.RichTextEditorCrdt.LOCAL_ORIGIN : null;
+        if (origin && session && session.doc && typeof session.doc.transact === "function") { session.doc.transact(fn, origin); }
+        else { fn(); }
+    }
     function seedLedgerFromRemote() {
         if (!editor.reviewLedger || !session.ledgerMap) return;
         echoGuard = true;