@voithos-labs/aragonite 0.10.4 → 0.10.7

package/dist/testing/container-conformance.js

@@ -1,67 +1,75 @@
 /**
- * G4.3 — container conformance kit, published at `@voithos-labs/aragonite/testing`. Register your kind, then
- * point the kit at it with fixtures plus a coverage matrix declaring per invariant whether it
- * asserts or is excused (never a silent skip; a thin reason fails the run). Which answer a
- * container owes each cell is in the plugin guide's "Conformance-testing a container". Asserted
- * checks drive the real per-kind action path, stopping at the nested-action default and at a DOM.
+ * The container conformance kit, published at `@voithos-labs/aragonite/testing`. Register your
+ * kind, then run the kit with fixtures and a coverage table saying, per invariant, whether the cell
+ * asserts or is excused; a thin excuse fails the run. What each cell expects:
+ * `docs/guide/plugin-testing.md` § The container checkup.
  */
-import { splitLines, trailingLineEnding } from '../core/lines';
+import { documentLineEnding, splitLines, trailingLineEnding } from '../core/lines';
 import { parse } from '../core/parser';
+import { ancestorsOf } from '../core/paths';
 import { createContainerEditActions } from '../editor-actions/container-edit';
 import { createUndoController } from '../editor-actions/commit/undo-controller';
-import { createListContext } from '../editor-actions/list-context';
 import { createStandardNestedActions } from '../editor-actions/nested/nested-actions';
 import { createNestedFocus } from '../editor-actions/nested/nested-focus';
-import { createTableMutationsContext } from '../editor-actions/table-context';
 import { firstChildUnwrapStrategies, middleChildUnwrapStrategies } from '../editor-actions/unwrap-strategies';
 import { isDirectiveKind } from '../core/directive/registry';
-import { isBlockOpenerRegistered } from '../schema/block-openers';
-import { getBlockKindDescriptor } from '../schema/block-kind-descriptor';
+import { defaultGrammarView, isBlockOpenerRegistered } from '../schema/block-openers';
+import { kitReading } from './kit-reading';
+import { getBlockKindDescriptor, isGridDescriptor } from '../schema/block-kind-descriptor';
 import { rebuildContainerRawIfContainer } from '../schema/container-raw';
 import { createSharingState } from '../tree-operations/sharing';
-import { rebuildUnsharedAncestry } from '../tree-operations/chain-rebuild';
+import { rebuildUnsharedAncestry, rebuildUnsharedChain } from '../tree-operations/chain-rebuild';
+import { walkUnsharing } from '../tree-operations/unshare';
 import { assertParseConverged } from './parse-convergence';
-import { createHeadlessActions, mountBlockListState, recordingFocus, stubBlockEdit, stubStickyColumn } from './headless-actions';
-import { assert, assertExemptionDocumented, assertIndices, assertIs, assertRebuildIsParseCanonical, assertReasonDocumented, fail, findFirstOfKind, firstChildOfKind, nodeAtPath, pathPassesThroughKind } from './conformance-core';
-/**
- * The kit's cells as data, so every sweep runs the same set: {@link runContainerConformance} and
- * the registry-derived built-in sweep both iterate this rather than listing cells by hand, which
- * is what makes cell N+1 unmissable at either caller.
- */
+import { mountBlockListState } from './headless-block-list.svelte';
+import { createHeadlessActions, recordingFocus, stubBlockEdit, stubCaretMemory } from './headless-actions';
+import { assert, assertIndices, assertIs, assertRebuildIsParseCanonical, assertReasonDocumented, fail, findFirstOfKind, nodeAtPath, pathPassesThroughKind, runCells, subjectNode, subjectPath } from './conformance-core';
+/** The kit's cells as data, so {@link runContainerConformance} and the built-in sweep run the
+ *  same set; `titleRow` and `declarations` declare no coverage and always run. */
 export const CONTAINER_CONFORMANCE_CELLS = [
     {
         cell: 'localIndex',
-        coverage: (profile) => profile.localIndex,
-        run: (kind, profile) => getBlockKindDescriptor(kind).containerContract === 'grid'
-            ? checkGridLocalIndexAddressing()
-            : checkStripLocalIndexAddressing(profile)
+        coverage: ({ profile }) => profile.localIndex,
+        run: ({ kind, profile }) => isGridDescriptor(getBlockKindDescriptor(kind))
+            ? driverOf(kind, profile, 'gridLocalIndex', 'a grid op')()
+            : checkStripLocalIndexAddressing(kind, profile)
+    },
+    {
+        cell: 'ancestry',
+        coverage: ({ profile }) => profile.ancestry,
+        run: ({ kind, profile }) => checkInnermostFirstAncestry(kind, profile)
     },
-    { cell: 'ancestry', coverage: (profile) => profile.ancestry, run: checkInnermostFirstAncestry },
     {
         cell: 'multiScope',
-        coverage: (profile) => profile.multiScope,
-        run: checkOneUndoPerMultiScope
+        coverage: ({ profile }) => profile.multiScope,
+        run: ({ kind, profile }) => driverOf(kind, profile, 'multiScope', 'an op spanning two scopes')()
     },
     {
         cell: 'focusBubble',
-        coverage: (profile) => profile.focusBubble,
-        run: checkFocusBubbleTermination
+        coverage: ({ profile }) => profile.focusBubble,
+        run: ({ kind, profile }) => checkFocusBubbleTermination(kind, profile)
     },
     {
         cell: 'terminatorCollision',
-        coverage: (profile) => profile.terminatorCollision,
-        run: checkTerminatorCollision
+        coverage: ({ profile }) => profile.terminatorCollision,
+        run: ({ kind, profile }) => checkTerminatorCollision(kind, profile),
+        falsify: ({ kind }) => refuseExcusedCollision(kind)
     },
-    { cell: 'declarations', coverage: () => ({ mode: 'assert' }), run: checkDeclarationSanity }
+    {
+        cell: 'titleRow',
+        run: ({ kind }) => checkTitleRowFeedsNoMetadata(kind)
+    },
+    {
+        cell: 'declarations',
+        run: ({ kind, profile }) => checkDeclarationSanity(kind, profile)
+    }
 ];
-/** The cells whose coverage a profile declares — `declarations` is the kit's, not the author's. */
-const BEHAVIORAL_CELLS = CONTAINER_CONFORMANCE_CELLS.filter((c) => c.cell !== 'declarations');
 /**
- * A profile owes at least one asserting behavioral cell. `declarations` is excluded on purpose:
- * it asserts for every kind, so counting it would let an all-excused profile clear the floor.
+ * A profile must assert at least one cell it declares. `declarations` doesn't count: it asserts
+ * for every kind, so counting it would let a profile that excuses everything pass.
  */
 export function assertProfileCoverageFloor(kind, profile) {
-    const asserts = BEHAVIORAL_CELLS.filter((c) => c.coverage(profile).mode === 'assert');
+    const asserts = CONTAINER_CONFORMANCE_CELLS.filter((c) => c.coverage?.({ kind, profile }).mode === 'assert');
     if (asserts.length > 0) {
         assert(profile.wholeProfileExemption === undefined, `${kind} declares a wholeProfileExemption while ${asserts.length} behavioral cell(s) assert`);
         return;
@@ -76,42 +84,30 @@ export function assertProfileCoverageFloor(kind, profile) {
  * `Error` naming every failed cell.
  */
 export async function runContainerConformance(kind, profile) {
-    const cells = [];
-    const failures = [];
+    const earlier = [];
     try {
         assertProfileCoverageFloor(kind, profile);
     }
     catch (error) {
-        failures.push(`coverageFloor: ${error.message}`);
-    }
-    for (const { cell, coverage: read, run } of CONTAINER_CONFORMANCE_CELLS) {
-        const coverage = read(profile);
-        try {
-            if (coverage.mode === 'assert') {
-                await run(kind, profile);
-                cells.push({ cell, status: 'asserted' });
-            }
-            else {
-                assertExemptionDocumented(coverage, `${kind} ${cell}`);
-                cells.push({ cell, status: coverage.mode, reason: coverage.reason });
-            }
-        }
-        catch (error) {
-            failures.push(`${cell}: ${error.message}`);
-        }
-    }
-    if (failures.length > 0) {
-        throw new Error(`container conformance failed for "${kind}":\n  - ${failures.join('\n  - ')}`);
+        earlier.push(`coverageFloor: ${error.message}`);
     }
+    const cells = await runCells(CONTAINER_CONFORMANCE_CELLS, 
+    // A published profile never supplies drivers: no published API can perform their ops.
+    { kind, profile: { ...profile, drivers: undefined } }, { subject: kind, heading: `container conformance failed for "${kind}"` }, earlier);
     return { kind, cells };
 }
 // ── (a) local-index addressing ───────────────────────────────────────────────
-/**
- * Assert the addressed child is the one that mutated (by content) and that the emitted
- * path is the chain of LOCAL indices. The non-first / non-zero setup is what
- * discriminates local from global addressing; at chain [0,0] child 0 the two coincide.
- */
-export async function checkStripLocalIndexAddressing(profile) {
+function driverOf(kind, profile, driver, op) {
+    const run = profile.drivers?.[driver];
+    if (run)
+        return run;
+    const cell = driver === 'gridLocalIndex' ? 'localIndex' : 'multiScope';
+    fail(`"${kind}" asserts ${cell}, but the kit drives ${op} only for the built-in kinds that own ` +
+        `one, so declare it boundary (or exempt, when the kind owns no such op)`);
+}
+/** Asserts the addressed child is the one removed and the emitted path is the chain of local
+ *  indices; the fixture avoids chain [0,0] child 0, where local and global indices coincide. */
+export async function checkStripLocalIndexAddressing(kind, profile) {
     const fixture = profile.localIndexFixture;
     if (!fixture)
         fail('localIndex asserts but the profile carries no localIndexFixture');
@@ -120,6 +116,7 @@ export async function checkStripLocalIndexAddressing(profile) {
     assert(targetChild > 0 || containerChain.some((idx) => idx > 0), 'localIndexFixture must edit a non-first child or descend through a non-zero chain position (else the local-vs-global check is vacuous)');
     const outer = parse(fixture.source).children[0];
     const { deps, doc, events } = createHeadlessActions([outer]);
+    const kindNode = subjectNode(doc, kind, containerChain, 'localIndexFixture');
     const controller = createUndoController(deps);
     const rootContainerEdit = createContainerEditActions(deps, controller);
     let parentBundle = null;
@@ -136,9 +133,8 @@ export async function checkStripLocalIndexAddressing(profile) {
                 },
                 path: containerChain.slice(0, depth + 1)
             },
-            stickyColumn: stubStickyColumn(),
-            getPresentationMode: undefined,
-            linkRef: undefined,
+            caretMemory: stubCaretMemory(),
+            reading: kitReading(),
             parent: {
                 blockEdit: parentBundle?.blockEdit ?? stubBlockEdit(),
                 focus: parentBundle?.focus ?? recordingFocus(),
@@ -150,83 +146,23 @@ export async function checkStripLocalIndexAddressing(profile) {
         if (depth < containerChain.length - 1)
             node = node.children[containerChain[depth + 1]];
     }
-    const kindNode = node;
     assert(kindNode.children.length > 1, 'kind node has ≥2 children to target a non-first one');
     const targetMarker = kindNode.children[targetChild].raw;
     const seen = [];
     events.on('edit', (e) => seen.push(e));
-    await parentBundle.blockEdit.deleteBlock(targetChild);
-    // The commit replaced the spine's nodes — re-resolve through the live doc.
-    const liveKind = nodeAtPath(doc, containerChain);
+    await parentBundle.blockEdit.deleteBlock(targetChild, 'keyless');
+    // The commit replaced the ancestor nodes, so resolve again through the live document.
+    const liveKind = subjectNode(doc, kind, containerChain, 'the document after the delete');
     const remaining = (liveKind.children ?? []).map((c) => c.raw);
     assert(!remaining.includes(targetMarker), `local index ${targetChild} was the child removed`);
     const editEvent = seen.find((e) => e.op === 'delete');
     assert(editEvent, 'a delete edit event fired');
     assertIndices(editEvent.path.slice(0, containerChain.length), containerChain, 'path is the local-index chain');
     assertIs(editEvent.path.at(-1), targetChild, 'path ends at the targeted local child index');
-    // Convergence, not byte round-trip (which is a tautology here): a local-index op
-    // leaving a stale container raw or a divergent shape fires.
+    // Compared against a fresh parse, not byte round-trip, which is trivially true here: this
+    // catches an op that left the container's raw stale or its shape different.
     assertParseConverged(doc, 'doc converges after a local-index op');
 }
-/**
- * Grid local addressing: a table column op addresses cells by (rowIdx, colIdx) and emits
- * the table's own local path. The leading paragraph keeps the table at a non-zero doc
- * index, so a flat global offset would not coincide with the local one.
- */
-export async function checkGridLocalIndexAddressing() {
-    const parsed = parse('lead para\n\n| h1 | h2 |\n| --- | --- |\n| a | b |\n');
-    assertIs(parsed.children[1].kind, 'table', 'table at non-zero doc index');
-    const { ctx, deps, doc, events } = mountTableMutations(parsed.children, 1);
-    const seen = [];
-    events.on('edit', (e) => seen.push(e));
-    // Pinning the new cell's POSITION by content is what proves cells are addressed by
-    // local col index rather than appended at the end.
-    await ctx.insertColumnRight(0);
-    const liveTable = deps.doc.children[1];
-    for (const row of liveTable.children) {
-        const cells = row.children.map((c) => c.raw);
-        assertIs(cells.length, 3, 'every row gained one cell');
-        assert(cells[0] !== '', 'column 0 unchanged');
-        assertIs(cells[1], '', 'new empty cell landed at the addressed colIdx 1');
-        assert(cells[2] !== '', 'original second cell shifted to colIdx 2');
-    }
-    const editEvent = seen.find((e) => e.op === 'tableInsertColumn');
-    assert(editEvent, 'tableInsertColumn edit event fired');
-    assertIndices(editEvent.path, [1], 'column op emits the table’s own local path');
-    // The strip twin's oracle, which the grid arm went without: a column op leaving a stale
-    // table raw or a row the delimiter no longer describes fires here, not at a byte round-trip.
-    assertParseConverged(doc, 'doc converges after a grid column op');
-}
-/** The table-mutations mount both grid cells share: headless deps, controller, row states, ctx. */
-function mountTableMutations(children, tableIndex) {
-    const table = children[tableIndex];
-    const { deps, doc, events } = createHeadlessActions(children);
-    const controller = createUndoController(deps);
-    const rootContainerEdit = createContainerEditActions(deps, controller);
-    const rowsState = mountBlockListState(() => table);
-    // commitColumnEdit resolves each row via expectStateForNode — register them.
-    for (const row of table.children)
-        mountBlockListState(() => row);
-    const ctx = createTableMutationsContext({
-        get node() {
-            return table;
-        },
-        get myPath() {
-            return [tableIndex];
-        },
-        get rowsState() {
-            return rowsState;
-        },
-        get focusedCell() {
-            return { rowIdx: 0, colIdx: 0 };
-        },
-        parentContainerEdit: rootContainerEdit,
-        controller,
-        focusCell: () => { },
-        announceReorder: () => { }
-    });
-    return { ctx, deps, doc, events };
-}
 // ── (b) innermost-first ancestry rebuild ─────────────────────────────────────
 export function checkInnermostFirstAncestry(kind, profile) {
     const { source, leafPath } = profile.deepNesting;
@@ -237,16 +173,13 @@ export function checkInnermostFirstAncestry(kind, profile) {
     assert(!leaf.children, 'leaf is editable (no children)');
     const marker = `zzmark-${kind}`;
     leaf.raw = marker + '\n';
-    // Fresh sharing state, no fold sink and the global grammar: this probe asserts raw propagation
-    // only, and a kit owning neither ids nor refs can reconcile no parent-scope splice.
-    rebuildUnsharedAncestry(doc, leafPath, createSharingState(), null, undefined);
+    // Fresh sharing state, no merge callback and the global grammar: the check covers only raw
+    // propagation, and the kit owns no ids to reconcile a splice with.
+    rebuildUnsharedAncestry(doc, leafPath, createSharingState(), null, defaultGrammarView);
     assert(root.raw.includes(marker), `root raw reflects the deep leaf edit through "${kind}"`);
 }
-/**
- * Mutation probe proving the ancestry check is non-vacuous: a reversed (outer→inner)
- * rebuild leaves the root stale for a strip/opaque container. Returns false for a
- * container that re-derives its whole subtree (grid), which is why grid excuses ancestry.
- */
+/** Shows the ancestry check can fail: an outer-to-inner rebuild leaves a strip or opaque root
+ *  stale. False for a grid, which re-derives its whole subtree and so excuses ancestry. */
 export function reversedAncestryLeavesRootStale(profile) {
     const { source, leafPath } = profile.deepNesting;
     const doc = parse(source);
@@ -254,88 +187,19 @@ export function reversedAncestryLeavesRootStale(profile) {
     const leaf = nodeAtPath(doc, leafPath);
     const marker = 'reversed-mark';
     leaf.raw = marker + '\n';
-    const ancestors = [];
-    let cur = doc;
-    for (let depth = 0; depth < leafPath.length - 1; depth++) {
-        cur = cur.children[leafPath[depth]];
-        ancestors.push(cur);
-    }
     // Outermost-first: each ancestor rebuilt before its descendants are fresh.
-    for (const a of ancestors)
-        rebuildContainerRawIfContainer(a);
+    for (const ancestor of ancestorsOf(doc, leafPath))
+        rebuildContainerRawIfContainer(ancestor);
     return !root.raw.includes(marker);
 }
-// ── (c) one undo entry per multi-scope op ────────────────────────────────────
-/**
- * A multi-scope op is kind-specific: it drives through the kind's own context, not a
- * generic bundle, so only the built-ins that own one are dispatched here.
- */
-export async function checkOneUndoPerMultiScope(kind) {
-    if (kind === 'list')
-        return checkListIndentOneUndo();
-    if (kind === 'table')
-        return checkTableColumnOneUndo();
-    fail(`"${kind}" asserts multiScope but the kit drives no multi-scope op for it — ` +
-        `declare the cell exempt if the kind owns no ≥2-scope op`);
-}
-async function checkListIndentOneUndo() {
-    // Indenting item 1 under item 0 spans outer-list + the new nested-list scope.
-    const list = firstChildOfKind('- alpha\n- beta\n', 'list');
-    const { deps } = createHeadlessActions([list]);
-    const controller = createUndoController(deps);
-    const listState = mountBlockListState(() => list);
-    // indentItem reaches into prevItem (item 0) via expectStateForNode — register each item.
-    for (const item of list.children)
-        mountBlockListState(() => item);
-    const ctx = createListContext({
-        scope: {
-            get index() {
-                return 0;
-            },
-            get node() {
-                return list;
-            },
-            get path() {
-                return [0];
-            }
-        },
-        state: listState,
-        parentBlockEdit: stubBlockEdit(),
-        parentFocus: recordingFocus(),
-        parentListContext: undefined,
-        controller,
-        getPresentationMode: undefined,
-        linkRef: undefined
-    });
-    const before = deps.undoManager.getStacks().undo.length;
-    await ctx.indentItem(1);
-    const after = deps.undoManager.getStacks().undo.length;
-    assertIs(after - before, 1, 'list indentItem (multi-scope) pushes exactly ONE undo entry');
-    assertIs(deps.doc.children[0].children.length, 1, 'item 1 was indented out of the outer list');
-    assertParseConverged(deps.doc, 'doc converges after a multi-scope strip op');
-}
-async function checkTableColumnOneUndo() {
-    const table = firstChildOfKind('| h1 | h2 |\n| --- | --- |\n| a | b |\n| c | d |\n', 'table');
-    const { ctx, deps } = mountTableMutations([table], 0);
-    const before = deps.undoManager.getStacks().undo.length;
-    await ctx.insertColumnRight(0);
-    const after = deps.undoManager.getStacks().undo.length;
-    assertIs(after - before, 1, 'table insertColumn (multi-scope) pushes exactly ONE undo entry');
-    assertParseConverged(deps.doc, 'doc converges after a multi-scope grid op');
-}
 // ── (d) focus-bubble termination at root ─────────────────────────────────────
-/**
- * Bubble an out-of-range ArrowUp through a real 2-level chain (kind-under-test → strip
- * outer at its own top edge → recording root) and assert it reaches the root exactly
- * once. Driving the kind's own bundle rather than `dispatchMoveFocus` is what catches a
- * container whose focus wiring re-enters or double-escapes.
- */
+/** Bubbles an out-of-range ArrowUp through the kind's own focus bundle, under a blockquote at its
+ *  top edge, and asserts the root sees it once, catching wiring that re-enters or escapes twice. */
 export async function checkFocusBubbleTermination(kind, profile) {
     const source = profile.focusSource;
     if (!source)
         fail('focusBubble asserts but the profile carries no focusSource');
-    const innerNode = findFirstOfKind(parse(source), kind);
-    assert(innerNode, `focusSource contains a "${kind}" node`);
+    const innerNode = subjectNode(parse(source), kind, 'first', 'focusSource');
     assert((innerNode.children?.length ?? 0) > 0, `"${kind}" node has children`);
     const rootFocus = recordingFocus();
     const focusRung = (node, index, focus) => createNestedFocus(mountBlockListState(() => node), {
@@ -344,9 +208,8 @@ export async function checkFocusBubbleTermination(kind, profile) {
             return node;
         },
         path: [index],
-        stickyColumn: stubStickyColumn(),
-        getPresentationMode: undefined,
-        linkRef: undefined,
+        caretMemory: stubCaretMemory(),
+        reading: kitReading(),
         parent: { blockEdit: stubBlockEdit(), focus, containerEdit: {} }
     });
     // At its own top edge, so moveFocus(-1) must delegate to root rather than re-enter.
@@ -363,22 +226,17 @@ export async function checkFocusBubbleTermination(kind, profile) {
     assertIs(bubbled[1], 'end', 'root received the bubbled position');
 }
 // ── (f) terminator collision ─────────────────────────────────────────────────
-/**
- * Write a terminator-shaped line into the container's body through `bodyWrite` (the door the
- * commit path uses) and require the live tree to still converge with a fresh parse. Convergence
- * is the oracle, not byte round-trip: `serialize(parse(s)) === s` holds throughout a collision
- * while the container silently stops containing what it says it does. A childless container
- * (body in metadata) seats the same bytes through the fixture's own `writeBody`.
- */
+/** Writes a terminator-shaped body line through `bodyWrite`, as the commit path does, and requires
+ *  the tree to match a fresh parse, since byte round-trip holds even through a collision. */
 export function checkTerminatorCollision(kind, profile) {
     const fixture = profile.terminatorCollisionFixture;
     if (!fixture)
         fail('terminatorCollision asserts but the profile carries no terminatorCollisionFixture');
     const doc = parse(fixture.source);
-    const node = doc.children[0];
-    assertIs(node?.kind, kind, 'terminatorCollisionFixture source opens with a node of the kind');
+    const node = subjectNode(doc, kind, [0], 'terminatorCollisionFixture');
     const bodyWrite = getBlockKindDescriptor(kind).bodyWrite;
-    const body = bodyWrite ? bodyWrite.normalize(fixture.bodyRaw) : fixture.bodyRaw;
+    const ctx = { node, mode: 'literal', lineEnding: documentLineEnding(doc) };
+    const body = bodyWrite ? bodyWrite.normalize(fixture.bodyRaw, ctx) : fixture.bodyRaw;
     const children = node.children ?? [];
     const before = node.raw;
     if (children.length > 0) {
@@ -391,30 +249,60 @@ export function checkTerminatorCollision(kind, profile) {
         }
         fixture.writeBody(node, body);
     }
-    rebuildContainerRawIfContainer(node);
-    // Without this the cell passes over a container the write never reached, which is how a
-    // mis-seated childless body would read as surviving a collision it never saw.
+    // Through the chain rebuild a commit runs, which also re-reads the container's metadata.
+    rebuildUnsharedAncestry(doc, [0], createSharingState(), null, defaultGrammarView);
+    // Without this the cell passes on a container the write never reached, which is how a body
+    // written to the wrong place would look like it survived a collision it never saw.
     assert(node.raw !== before, `the fixture body reached "${kind}"'s own bytes`);
     assertParseConverged(doc, `${kind} survives a body line reproducing its terminator`);
 }
+/** An opaque container wraps its body between its own marker lines, so a body line can reproduce
+ *  its closer whatever it declares; a declared `bodyWrite` is tested on any contract. */
+function refuseExcusedCollision(kind) {
+    const descriptor = getBlockKindDescriptor(kind);
+    if (descriptor.containerContract !== 'opaque' && !descriptor.bodyWrite)
+        return;
+    fail(`${kind} ${descriptor.bodyWrite ? 'declares container.bodyWrite' : 'is an opaque container'}, ` +
+        `and a body line reproducing its terminator truncates it, so assert terminatorCollision ` +
+        `with a fixture whose body does`);
+}
+// ── (g) title row feeds no metadata ──────────────────────────────────────────
+/** Written into the title row; distinctive enough that no fixture's title is it already. */
+const TITLE_PROBE = 'probe title';
+/** A title keystroke skips an opaque container's metadata re-read, so the row is written through
+ *  that keystroke's rebuild and the tree has to match a fresh parse, every metadata key included. */
+export function checkTitleRowFeedsNoMetadata(kind) {
+    const descriptor = getBlockKindDescriptor(kind);
+    const chromeKind = descriptor.reservedChrome?.kind;
+    if (descriptor.containerContract !== 'opaque' || chromeKind === undefined) {
+        return {
+            status: 'exempt',
+            detail: `"${kind}" has no title row whose keystrokes skip the metadata re-read`
+        };
+    }
+    const fixture = descriptor.conformanceFixture;
+    if (fixture === undefined) {
+        fail(`${kind} declares a title row but carries no conformanceFixture to write it in`);
+    }
+    const doc = parse(fixture);
+    const leafPath = [...subjectPath(doc, kind, 'first', `${kind} conformanceFixture`), 0];
+    const title = nodeAtPath(doc, leafPath);
+    assertIs(title.kind, chromeKind, `${kind} conformanceFixture opens a "${kind}" with its title row`);
+    const leafPreviousRaw = title.raw;
+    title.raw = TITLE_PROBE + trailingLineEnding(title.raw, documentLineEnding(doc));
+    const sharing = createSharingState();
+    const chain = walkUnsharing(doc, leafPath, sharing, false);
+    rebuildUnsharedChain(doc, chain, sharing, null, defaultGrammarView, {
+        path: leafPath,
+        leafPreviousRaw
+    });
+    assertParseConverged(doc, `${kind} after a keystroke in its title row`);
+}
 // ── (e) declaration sanity ───────────────────────────────────────────────────
-/**
- * Hold the kind to its schema declarations. A declared `unwrapRole` must name implemented
- * strategies because the nested dispatcher indexes them unguarded, and a capability whose only
- * job is a cell's repair may not ship behind that cell's excuse.
- */
+/** Holds the kind to its declarations: an `unwrapRole` names implemented strategies, which the
+ *  nested dispatcher indexes unguarded. */
 export function checkDeclarationSanity(kind, profile) {
     const descriptor = getBlockKindDescriptor(kind);
-    // Grammatical, not declared: an opaque container wraps its body between chrome lines of its
-    // own, so a body line CAN reproduce its closer whether or not the kind declares the repair.
-    // The bodyWrite arm stays because a declared repair must be probed on any contract.
-    const owesCollisionAnswer = descriptor.containerContract === 'opaque' || !!descriptor.bodyWrite;
-    if (owesCollisionAnswer && profile.terminatorCollision.mode !== 'assert') {
-        fail(`${kind} ${descriptor.bodyWrite ? 'declares container.bodyWrite' : 'is an opaque container'} ` +
-            `but its profile marks terminatorCollision "${profile.terminatorCollision.mode}" — a body ` +
-            `line reproducing the terminator truncates the container, so assert the cell with a ` +
-            `fixture whose body does`);
-    }
     const role = descriptor.unwrapRole;
     if (role) {
         assertIs(typeof firstChildUnwrapStrategies[role.firstChildBackspace], 'function', `${kind} first-child unwrap strategy "${role.firstChildBackspace}" is implemented`);
@@ -427,40 +315,33 @@ export function checkDeclarationSanity(kind, profile) {
         assertIs(typeof descriptor.containerPaste.siblingAbsorb, 'boolean', `${kind} containerPaste.siblingAbsorb is boolean`);
     }
     assertIs(typeof descriptor.rebuildRaw, 'function', `${kind} declares rebuildRaw`);
-    const node = findFirstOfKind(parse(profile.deepNesting.source), kind);
-    assert(node, `deepNesting fixture contains a "${kind}" node`);
+    const node = subjectNode(parse(profile.deepNesting.source), kind, 'first', 'deepNesting');
     assertRebuildIsParseCanonical(descriptor, node, kind);
     assertHintedRebuildMatchesFull(kind, descriptor, node);
     assertBodyWrapMatchesParse(kind, descriptor);
     assertContentStartSpaceIsRebuilt(kind, descriptor);
 }
-/**
- * `rebuildRaw`'s changed-child hint is a shortcut, never a different answer: the same children
- * rebuilt with and without it are the same bytes. A rebuilder that ignores the hint passes here
- * by construction, which is what makes the argument optional to adopt.
- */
+/** `rebuildRaw`'s changed-child hint is a shortcut, never a different answer: the same children
+ *  rebuilt with and without it give the same bytes. */
 function assertHintedRebuildMatchesFull(kind, descriptor, node) {
     const children = node.children;
     if (!children?.length)
         return;
     const index = children.length - 1;
     const previousRaw = children[index].raw;
-    // Doubling keeps whatever line shape the fixture's own child had; one operand, so the
-    // cross-node join census still reads this as a kind re-emitting its own bytes.
+    // Doubling keeps the child's own line shape, and with one operand the cross-node join check
+    // still reads it as the kind re-emitting its own bytes.
     children[index].raw = previousRaw.repeat(2);
     descriptor.rebuildRaw(node, { index, previousRaw });
     const hinted = node.raw;
     descriptor.rebuildRaw(node);
     assertIs(hinted, node.raw, `${kind} rebuildRaw writes the same bytes for a changed-child hint as for a full rebuild`);
 }
-/** The content a probe writes into a body child; distinctive enough that no fixture line ends
- *  in it by accident. */
+/** The content these checks write into a body child, distinctive enough that no fixture line
+ *  ends in it by accident. */
 const CONTENT_START_PROBE = 'probe';
-/**
- * `container.contentStartSpace` consumes the user's space, so it is byte-honest only where the
- * rebuild mints that space back on a content line. A declarer whose rebuild does not eats the
- * keystroke instead of deferring it.
- */
+/** `container.contentStartSpace` swallows the user's space, so the rebuild must write it back on a
+ *  content line or the keystroke is lost. */
 function assertContentStartSpaceIsRebuilt(kind, descriptor) {
     if (descriptor.contentStartSpace !== 'complete-marker')
         return;
@@ -468,12 +349,13 @@ function assertContentStartSpaceIsRebuilt(kind, descriptor) {
     if (fixture === undefined) {
         fail(`${kind} declares container.contentStartSpace but carries no conformanceFixture to probe`);
     }
-    const node = parse(fixture).children.find((child) => child.kind === kind);
-    assert(node?.children?.length, `${kind} conformanceFixture opens a "${kind}" with a body child`);
-    // The LAST child, so a reserved-chrome head (a title, a summary) stays in place: its own line
-    // already carries the opener's space, and rebuilding over it would answer for the wrong line.
+    const doc = parse(fixture);
+    const node = subjectNode(doc, kind, 'first', `${kind} conformanceFixture`);
+    assert(node.children?.length, `${kind} conformanceFixture opens a "${kind}" with a body child`);
+    // The last child, so a reserved title child (a heading, a summary) stays put: its own line
+    // already carries the opener's space, and rebuilding over it would test the wrong line.
     const last = node.children[node.children.length - 1];
-    last.raw = CONTENT_START_PROBE + (trailingLineEnding(last.raw) || '\n');
+    last.raw = CONTENT_START_PROBE + trailingLineEnding(last.raw, documentLineEnding(doc));
     descriptor.rebuildRaw(node);
     const lines = splitLines(node.raw)
         .map((line) => line.text)
@@ -484,13 +366,10 @@ function assertContentStartSpaceIsRebuilt(kind, descriptor) {
         `child holding "${CONTENT_START_PROBE}" — the consumed space is only deferred where the ` +
         `rebuild re-emits the marker's own trailing space on a content line`);
 }
-/**
- * `container.bodyWrap` is probed, never trusted: the separator settle reads it to decide whether
- * a freed blank line belongs to the wrap, and a kind whose parse disagrees loses its body head
- * on reload (`tree-operations/settle.clearRedundantSeparator`).
- */
+/** `container.bodyWrap` is tested, not trusted: `clearRedundantSeparator` reads it to place a freed
+ *  blank line, and a kind whose parse disagrees loses the start of its body on reload. */
 function assertBodyWrapMatchesParse(kind, descriptor) {
-    if (descriptor.containerContract === 'grid')
+    if (isGridDescriptor(descriptor))
         return;
     const fixture = descriptor.conformanceFixture;
     if (fixture === undefined) {
@@ -498,28 +377,23 @@ function assertBodyWrapMatchesParse(kind, descriptor) {
             `the declaration in both directions, so every non-grid container needs a fixture ` +
             `whose top level opens a "${kind}" carrying a body`);
     }
-    // A kind with no standalone recognizer (listItem) can only ever be nested, so it is probed
-    // where the fixture puts it; openers alone misread directive kinds, whose recognizer is the
-    // shared `:::`.
+    // A kind with no recognizer of its own (listItem) is tested where the fixture nests it; a
+    // directive kind's recognizer is the shared `:::`, which the opener registry does not list.
     const doc = parse(fixture);
     const opensAtTop = isBlockOpenerRegistered(kind) || isDirectiveKind(kind);
-    const node = opensAtTop
-        ? doc.children.find((child) => child.kind === kind)
-        : findFirstOfKind(doc, kind);
-    assert(node, `${kind} conformanceFixture must ${opensAtTop ? 'open' : 'carry'} a "${kind}"` +
-        `${opensAtTop ? ' at the top level' : ''} — the bodyWrap probe rebuilds and reparses that ` +
-        `node, and a fixture without one would skip it silently while the declarations cell reads ` +
-        `asserted`);
-    // A container that keeps its body in metadata parses childless, so there is no body child for a
-    // blank line to peel off — the probe has nothing to run and the declaration must be absent,
-    // since a wrap the parse can never perform would tell the separator settle a falsehood.
+    const path = subjectPath(doc, kind, 'first', `${kind} conformanceFixture`);
+    assert(!opensAtTop || path.length === 1, `${kind} conformanceFixture must open a "${kind}" at the top level — the bodyWrap probe ` +
+        `rebuilds that node and reparses its bytes as a document of their own`);
+    const node = nodeAtPath(doc, path);
+    // A container whose body lives in metadata parses childless, so it has no wrap to test and
+    // must declare none: the blank-line fix-up would trust a wrap the parse never performs.
     if (!node.children?.length) {
         assertIs(descriptor.bodyWrap?.afterOpenerLine, undefined, `${kind} parses childless (its body lives in metadata), so a blank line against its ` +
             `opener belongs to that body — drop the container.bodyWrap declaration`);
         return;
     }
     const expected = node.children.length;
-    const ending = trailingLineEnding(node.raw) || '\n';
+    const ending = trailingLineEnding(node.raw, documentLineEnding(doc));
     node.innerPrefix = '';
     descriptor.rebuildRaw(node);
     const withoutPrefix = node.raw;