papilot 0.0.0-stage → 0.1.1

package/examples/papilot-paper/sections/03-background.tex

@@ -0,0 +1,97 @@
+\section{Background}
+\label{sec:background}
+
+This section fixes notation for the four systems Papilot sits between: the
+\TeX{} build, the PDF format, Git, and SyncTeX.
+
+\subsection{The \LaTeX{} build as a fixed point}
+
+\LaTeX{} resolves cross-references, citations and the table of contents by
+reading auxiliary data written by the previous run~\cite{lamport1994}. Let
+$x_k$ be the auxiliary state after run $k$ and $F$ the map computed by one run,
+so that
+\begin{equation}
+  x_{k+1} = F(x_k), \qquad x_0 = \varnothing .
+  \label{eq:fixed-point}
+\end{equation}
+A build tool such as \texttt{latexmk} repeats runs until a fixed point
+$x^{\star} = F(x^{\star})$ is reached or a limit of $K$ runs is hit (five by
+default). A single run suffices when $F(\varnothing) = \varnothing$, which is
+the case only for documents without references. A typical paper converges in
+two or three runs: the first records labels, the second resolves them, and a
+third is needed only when resolving them moved a page break.
+
+\begin{remark}
+$F$ need not be a contraction. A reference whose resolution lengthens a line
+can push a label onto the next page, whose page number shortens the line again;
+the sequence $x_k$ then alternates between two states and the run limit ends
+the build. Such documents are rare, but they are why a build key must include
+the build settings and not only the sources (\cref{sec:build}).
+\end{remark}
+
+\subsection{Text in a PDF}
+
+A PDF page places glyphs with a chain of matrices~\cite{iso32000}. The text
+state contains the font size $T_{fs}$, the horizontal scaling $T_h$, the rise
+$T_{\text{rise}}$, the character and word spacings $T_c$ and $T_w$, and the
+text matrix $T_m$. A glyph is drawn in user space through the text rendering
+matrix
+\begin{equation}
+  T_{rm} =
+  \begin{pmatrix}
+    T_{fs} T_h & 0 & 0 \\
+    0 & T_{fs} & 0 \\
+    0 & T_{\text{rise}} & 1
+  \end{pmatrix}
+  \times T_m \times \mathrm{CTM},
+  \label{eq:trm}
+\end{equation}
+where $\mathrm{CTM}$ is the current transformation matrix. After each glyph
+with horizontal advance $w_0$ (in thousandths of a text space unit) and a
+positioning adjustment $T_j$, the text matrix moves by
+\begin{equation}
+  t_x = \Bigl( \bigl(w_0 - \tfrac{T_j}{1000}\bigr) T_{fs} + T_c + T_w \Bigr) T_h ,
+  \qquad
+  T_m \leftarrow
+  \begin{pmatrix} 1 & 0 & 0 \\ 0 & 1 & 0 \\ t_x & 0 & 1 \end{pmatrix} T_m ,
+  \label{eq:advance}
+\end{equation}
+with $T_w$ applied only to the single-byte space character. \TeX{} rarely uses
+$T_w$; it positions words with explicit adjustments $T_j$, which is why a PDF
+produced from \TeX{} often contains no space characters at all.
+
+\subsection{Git worktrees}
+
+A Git repository is a store of immutable objects (blobs, trees and commits)
+addressed by their hashes, together with a set of references~\cite{chacon2014}.
+A \emph{worktree} is a checkout with its own working files $W_i$, index $I_i$
+and head $\mathrm{HEAD}_i$, sharing the object store with every other worktree
+of the same repository:
+\begin{equation}
+  \mathcal{R} = \bigl(\mathcal{O},\ \mathrm{refs}\bigr), \qquad
+  w_i = \bigl(W_i,\ I_i,\ \mathrm{HEAD}_i\bigr), \quad i = 0, 1, \dots, t .
+\end{equation}
+The manuscript checkout is $w_0$; each task $i \ge 1$ gets its own $w_i$ on its
+own branch. Because objects are shared, creating a worktree costs only the
+working files, and because indexes are separate, a task can stage, diff and
+build without touching $w_0$.
+
+\subsection{SyncTeX}
+
+SyncTeX records, while \TeX{} typesets, where each box, glue and kern came from:
+an input file, a line and a column~\cite{laurens2008}. Positions are recorded
+in \TeX{}'s scaled points. With
+\begin{equation}
+  1\,\mathrm{pt} = \tfrac{1}{72.27}\,\mathrm{in}, \qquad
+  1\,\mathrm{bp} = \tfrac{1}{72}\,\mathrm{in}, \qquad
+  1\,\mathrm{sp} = 2^{-16}\,\mathrm{pt},
+\end{equation}
+a horizontal position $h$ in scaled points becomes PDF points as
+\begin{equation}
+  x = \bigl(h + h_{\text{origin}}\bigr) \cdot 2^{-16} \cdot \frac{72}{72.27},
+  \label{eq:sp-to-bp}
+\end{equation}
+where $h_{\text{origin}}$ is the one-inch offset of \TeX{}'s origin from the
+page edge, expressed in scaled points. A reverse query (``edit'') returns the
+record nearest to a point on the page; a forward query (``view'') returns the
+boxes produced by a source line. Papilot uses only reverse queries.

package/examples/papilot-paper/sections/04-model.tex

@@ -0,0 +1,185 @@
+\section{A model of review rounds}
+\label{sec:model}
+
+\subsection{Documents and edits}
+
+We view a manuscript as a finite sequence of source characters over an
+alphabet $\Sigma$, $\doc \in \Sigma^{*}$, of length $n = \abs{\doc}$. An
+\emph{edit} replaces a half-open range of the source by new text.
+
+\begin{definition}[Edit]
+An edit is a triple $e = (a, b, w)$ with $0 \le a \le b \le n$ and
+$w \in \Sigma^{*}$. Applying $e$ to $\doc$ gives
+\begin{equation}
+  \doc \apply e = \doc_{[0,a)} \, w \, \doc_{[b,n)},
+  \label{eq:apply}
+\end{equation}
+whose length is $n + \delta(e)$ with \emph{shift} $\delta(e) = \abs{w} - (b - a)$.
+\end{definition}
+
+A task proposes a \emph{revision} $\edit = \{e_1, \dots, e_m\}$, a finite set
+of edits against the same base document. Papilot groups nearby edits into
+\emph{changes}, the units the author decides on.
+
+\begin{definition}[Compatibility]
+Two edits $e = (a, b, w)$ and $e' = (a', b', w')$ are \emph{compatible},
+written $e \perp e'$, when their ranges are disjoint and not adjacent:
+\begin{equation}
+  e \perp e' \iff b < a' \ \text{or}\ b' < a .
+  \label{eq:compatible}
+\end{equation}
+A revision is compatible when its edits are pairwise compatible.
+\end{definition}
+
+For a compatible revision we apply edits from right to left, so that earlier
+offsets remain valid:
+\begin{equation}
+  \doc \apply \edit
+  = \bigl(\cdots\bigl((\doc \apply e_{\sigma(1)}) \apply e_{\sigma(2)}\bigr)
+    \cdots\bigr) \apply e_{\sigma(m)},
+  \qquad a_{\sigma(1)} > a_{\sigma(2)} > \dots > a_{\sigma(m)} .
+  \label{eq:apply-revision}
+\end{equation}
+
+\begin{proposition}[Compatible edits commute]
+\label{prop:commute}
+If $e \perp e'$, then applying them right to left in either listing gives the
+same document, and the result of \cref{eq:apply-revision} does not depend on
+how the remaining edits of a compatible revision are ordered.
+\end{proposition}
+
+\begin{proof}
+Assume without loss of generality $b < a'$. Applying $e'$ first changes only
+positions at or after $a'$, so the range $[a, b)$ and every offset before it are
+unchanged, and applying $e$ afterwards gives
+$\doc_{[0,a)}\, w\, \doc_{[b,a')}\, w'\, \doc_{[b',n)}$. Applying $e$ first
+shifts every later offset by $\delta(e)$; rewriting $e'$ as
+$(a'+\delta(e), b'+\delta(e), w')$ yields the same string. Induction on the
+number of edits, ordering them by start offset, gives the general statement.
+\end{proof}
+
+\subsection{Rebasing edits}
+
+When one task's edit $e$ has been accepted, another task's edit $e'$, written
+against the old document, must be moved onto the new one. The
+\emph{transformation} of $e'$ past $e$ is
+\begin{equation}
+  \tau(e', e) =
+  \begin{cases}
+    (a', b', w'), & b' < a,\\
+    \bigl(a' + \delta(e),\ b' + \delta(e),\ w'\bigr), & b < a',\\
+    \bot, & \text{otherwise,}
+  \end{cases}
+  \label{eq:transform}
+\end{equation}
+where $\bot$ signals a conflict that the author must resolve.
+
+\begin{lemma}[Convergence of rebased edits]
+\label{lem:tp1}
+If $e \perp e'$, then
+\begin{equation}
+  \doc \apply e \apply \tau(e', e) = \doc \apply e' \apply \tau(e, e') .
+  \label{eq:tp1}
+\end{equation}
+\end{lemma}
+
+\begin{proof}
+If $b < a'$, then $\tau(e, e') = e$ and $\tau(e', e)$ is $e'$ shifted by
+$\delta(e)$, so the left side is the second computation in the proof of
+\cref{prop:commute} and the right side the first. The case $b' < a$ is
+symmetric.
+\end{proof}
+
+\Cref{eq:tp1} is the convergence property known from operational
+transformation~\cite{ellis1989}. Papilot needs only the compatible case: an
+incompatible pair is never merged automatically.
+
+\subsection{Decisions and rounds}
+
+Let $U$ be the set of changes in a round. A \emph{decision state} is a map
+\begin{equation}
+  \theta : U \to \{\textsf{pending}, \textsf{accepted}, \textsf{rejected},
+  \textsf{commented}\},
+\end{equation}
+and the accepted part of a revision is
+$\edit^{\theta} = \{ e \in \edit : \theta(u(e)) = \textsf{accepted} \}$.
+The manuscript after round $t$ is
+\begin{equation}
+  \doc_{t+1} =
+  \begin{cases}
+    \doc_t \apply \edit_t^{\theta_t}, & \text{if } \edit_t^{\theta_t}
+      \text{ applies cleanly to } \doc_t,\\[2pt]
+    \doc_t, & \text{otherwise, and the task is asked for a new proposal.}
+  \end{cases}
+  \label{eq:round}
+\end{equation}
+Rejected and commented changes return to the agent as feedback bound to their
+round, file and lines; the agent must not reintroduce a rejected edit unless it
+is explicitly asked to.
+
+\paragraph{Actions and undo.}
+An \emph{action} $\alpha = (\iota, u, d)$ carries an identifier $\iota$, a
+change $u$ and a decision $d$. Applying it to a state gives
+$\theta \cdot \alpha = \theta[u \mapsto d]$, and the history is a stack
+$\alpha_1, \dots, \alpha_k$. Two properties make decisions safe over an
+unreliable network:
+\begin{align}
+  (\theta \cdot \alpha) \cdot \alpha &= \theta \cdot \alpha
+    && \text{(idempotence: a retried write changes nothing)},
+    \label{eq:idempotent}\\
+  \operatorname{undo}(\theta_0 \cdot \alpha_1 \cdots \alpha_k)
+    &= \theta_0 \cdot \alpha_1 \cdots \alpha_{k-1}
+    && \text{(undo reverses exactly the last action)}.
+    \label{eq:undo}
+\end{align}
+An undo request names the action it reverses, so a retried undo cannot reverse
+a different one.
+
+\subsection{How many rounds?}
+
+Suppose that each change is accepted in a round independently with probability
+$p \in (0,1]$, and otherwise revised and proposed again. The number of rounds
+$R$ until a single change is accepted is geometric,
+\begin{equation}
+  \Prob(R = r) = (1-p)^{r-1} p, \qquad
+  \E[R] = \frac{1}{p}, \qquad
+  \Var(R) = \frac{1-p}{p^{2}} .
+\end{equation}
+For $m$ independent changes the task ends when the last one is accepted, after
+$R_{\max} = \max_i R_i$ rounds.
+
+\begin{proposition}[Expected rounds]
+\label{prop:rounds}
+\begin{equation}
+  \E[R_{\max}]
+  = \sum_{k=1}^{m} (-1)^{k+1} \binom{m}{k} \frac{1}{1 - (1-p)^{k}} .
+  \label{eq:rounds}
+\end{equation}
+\end{proposition}
+
+The proof is in \cref{app:proofs}. For small $p$ the sum behaves like
+$\frac{1}{p} H_m$, where $H_m = \sum_{k=1}^{m} 1/k \approx \ln m + \gamma$ is
+the $m$-th harmonic number: doubling the number of changes adds only about
+$(\ln 2)/p$ rounds.
+
+\begin{corollary}[Rounds with confidence]
+\label{cor:rounds}
+For every $\eta \in (0,1)$, the task ends within
+\begin{equation}
+  r_{\eta} = \ceil*{ \frac{\ln(m/\eta)}{-\ln(1-p)} }
+  \label{eq:rounds-confidence}
+\end{equation}
+rounds with probability at least $1 - \eta$.
+\end{corollary}
+
+\begin{proof}
+By the union bound, $\Prob(R_{\max} > r) \le m\, \Prob(R > r) = m (1-p)^{r}$,
+which is at most $\eta$ as soon as $r \ge \ln(m/\eta) / (-\ln(1-p))$.
+\end{proof}
+
+\begin{example}
+With $p = 0.8$ and $m = 5$, \cref{eq:rounds} gives
+$\E[R_{\max}] \approx 1.91$ and \cref{eq:rounds-confidence} with $\eta = 0.05$
+gives $r_{\eta} = 3$: most tasks finish in one or two rounds, and almost all
+within three.
+\end{example}

package/examples/papilot-paper/sections/05-conflicts.tex

@@ -0,0 +1,99 @@
+\section{Concurrent tasks and conflicts}
+\label{sec:conflicts}
+
+Papilot runs up to $c = 2$ tasks at once, each against the manuscript as it was
+when the task started. Accepted text from one task can therefore overlap a
+later proposal from another, and \cref{eq:transform} then returns $\bot$.
+This section estimates how often that happens.
+
+\subsection{Uniformly placed edits}
+
+\begin{assumption}
+\label{ass:uniform}
+Each task proposes edits of a common length $\ell$ whose start positions are
+independent and uniformly distributed over a document of length $n \gg \ell$.
+\end{assumption}
+
+\begin{proposition}[Conflict probability]
+\label{prop:conflict}
+Under \cref{ass:uniform}, let two tasks propose $k_1$ and $k_2$ edits. The
+number $X$ of incompatible cross pairs has mean
+\begin{equation}
+  \E[X] = \frac{(2\ell + 1)\, k_1 k_2}{n},
+  \label{eq:conflict-mean}
+\end{equation}
+and the probability that the tasks conflict at all is
+\begin{equation}
+  \Prob(X > 0)
+  = 1 - \Bigl(1 - \frac{2\ell + 1}{n}\Bigr)^{k_1 k_2}
+  \approx 1 - \exp\Bigl(-\frac{(2\ell+1)\, k_1 k_2}{n}\Bigr).
+  \label{eq:conflict}
+\end{equation}
+\end{proposition}
+
+\begin{proof}
+Two edits of length $\ell$ starting at $s$ and $s'$ violate
+\cref{eq:compatible} exactly when $\abs{s - s'} \le \ell$, an event of
+probability $(2\ell+1)/n$ up to boundary effects of order $\ell/n$. Summing over
+the $k_1 k_2$ cross pairs gives \cref{eq:conflict-mean}. Treating the pairs as
+independent gives the product in \cref{eq:conflict}, and
+$\log(1-x) = -x + O(x^2)$ gives the approximation, which is the Poisson
+approximation $\Prob(X = 0) \approx e^{-\E[X]}$~\cite{feller1968}.
+\end{proof}
+
+For a $40$-page paper with $n \approx 1.2 \times 10^{5}$ characters, two tasks
+of $k_1 = k_2 = 10$ edits of $\ell = 200$ characters have $\E[X] \approx 0.33$
+and conflict with probability about $1 - e^{-0.33} \approx 0.28$.
+
+\subsection{How much overlaps}
+
+When two edits do conflict, the overlap is usually partial.
+
+\begin{proposition}[Expected overlap]
+\label{prop:overlap}
+Conditioned on a conflict, the offset $d = s' - s$ is uniform on
+$\{-\ell, \dots, \ell\}$ and the overlap $\ell - \abs{d}$ has mean
+\begin{equation}
+  \E\bigl[\ell - \abs{d} \bigm| \abs{d} \le \ell\bigr]
+  = \frac{1}{2\ell + 1} \sum_{d=-\ell}^{\ell} \bigl(\ell - \abs{d}\bigr)
+  = \frac{\ell^{2}}{2\ell + 1}
+  \approx \frac{\ell}{2} .
+  \label{eq:overlap}
+\end{equation}
+\end{proposition}
+
+\begin{proof}
+The sum is $\ell + 2\sum_{j=1}^{\ell} (\ell - j) = \ell + \ell(\ell - 1) = \ell^2$.
+\end{proof}
+
+A typical conflict therefore involves about half of an edit, which matches the
+experience that conflicting proposals usually touch the same sentence rather
+than the same word.
+
+\subsection{Clustered edits}
+
+Real revisions are not uniform: an author working on the introduction asks for
+several changes there. We model this by letting both tasks place their edits
+uniformly within a common region covering a fraction $\nu \in (0, 1]$ of the
+document.
+
+\begin{corollary}[Clustering raises conflicts]
+\label{cor:clustered}
+If both tasks edit only within a region of length $\nu n$,
+\begin{equation}
+  \Prob(X > 0) \approx 1 - \exp\Bigl(-\frac{(2\ell+1)\, k_1 k_2}{\nu n}\Bigr),
+  \label{eq:clustered}
+\end{equation}
+so that confining two tasks to a tenth of the paper multiplies the expected
+number of conflicts by ten.
+\end{corollary}
+
+\begin{proof}
+Apply \cref{prop:conflict} with $n$ replaced by $\nu n$.
+\end{proof}
+
+\Cref{cor:clustered} argues for fewer, longer tasks over many short ones that
+touch the same part of a paper, and for finishing the review of one task
+before starting another in the same section. It also explains why Papilot
+surfaces conflicts from Git rather than resolving them: a resolution would
+have to choose between two texts the author has not yet compared.

package/examples/papilot-paper/sections/06-building.tex

@@ -0,0 +1,70 @@
+\section{Building the PDF}
+\label{sec:build}
+
+\subsection{Snapshots of the working tree}
+
+The PDF view shows the manuscript exactly as it is on disk, including accepted
+but uncommitted changes. Let $W$ be the working tree and $H$ the tree of
+\texttt{HEAD}. A temporary index $I$ records the working tree without touching
+the real index:
+\begin{equation}
+  I \leftarrow \operatorname{read-tree}(H), \qquad
+  I \leftarrow I \cup \operatorname{add}(W), \qquad
+  T = \operatorname{write-tree}(I) .
+  \label{eq:snapshot}
+\end{equation}
+The tree $T$ is a content hash of every tracked and untracked, non-ignored
+file. The build is cached under the key
+\begin{equation}
+  \key(W) = h\bigl(T \,\|\, \text{build settings}\bigr),
+  \label{eq:key}
+\end{equation}
+where $h$ is a cryptographic hash and the settings name the engine and the
+main file.
+
+\begin{proposition}[Undo never recompiles]
+\label{prop:undo-build}
+Let $W_0$ be a working tree whose build has completed, and let a sequence of
+decisions followed by their undos return the files to the same content. Then
+the final working tree has the key of $W_0$ and its PDF is served from the
+cache.
+\end{proposition}
+
+\begin{proof}
+$T$ in \cref{eq:snapshot} depends only on file contents, so equal contents give
+equal trees and, by \cref{eq:key}, equal keys.
+\end{proof}
+
+\subsection{When to build}
+
+While the PDF view is open, Papilot checks the working tree every second and
+a half during a build, every fifteen seconds otherwise, and whenever the window
+regains focus. Let checks happen at rate at least $\varphi$, edits at rate
+$\mu$ and builds take time $\beta$. A build that is running when the tree
+changes is not cancelled; the first check after it finishes starts a build for
+the newer key. An edit made just after a build started waits for that build,
+then for the next check, then for its own build, so the PDF is never older than
+\begin{equation}
+  \text{staleness} \le 2\beta + \frac{1}{\varphi} ,
+  \label{eq:staleness}
+\end{equation}
+and the number of builds per unit time is at most
+$\min\bigl(\mu, \varphi, 1/\beta\bigr)$ in the long run: frequent edits do not
+cause a backlog of builds, they only skip intermediate states.
+
+\subsection{Reviewing changed pages}
+
+A review compares the PDF of the round's base with the PDF after the task's
+edits. Let the two documents have pages $P = (p_1, \dots, p_N)$ and
+$P' = (p'_1, \dots, p'_M)$ with content hashes $h(p_i)$. Inserting a paragraph
+shifts every later page, so comparing pages by index would mark almost
+everything as changed. A robust comparison aligns the pages by a longest common
+subsequence of their hashes,
+\begin{equation}
+  \operatorname{LCS}(P, P') = \max\Bigl\{ \abs{S} : S \subseteq [N]\times[M]
+  \text{ increasing},\ h(p_i) = h(p'_j)\ \forall (i,j) \in S \Bigr\},
+\end{equation}
+computed in $O\bigl((N + M) D\bigr)$ time, where $D = N + M - 2\abs{S}$ is the
+size of the edit script~\cite{myers1986}. Papilot's review goes further and
+renders only the strips of each page around the changed source lines, so that
+a one-word change is reviewed as one or two lines of typeset text.

package/examples/papilot-paper/sections/07-geometry.tex

@@ -0,0 +1,193 @@
+\section{Geometry of the PDF view}
+\label{sec:geometry}
+
+\subsection{From a glyph to a pixel}
+
+A PDF page lives in user space, in points ($1\,\mathrm{bp} = 1/72$\,in), with
+the origin at the bottom left of its view box $[x_0, y_0, x_1, y_1]$. Following
+the PDF convention we use row vectors. A glyph's origin is placed by the text
+rendering matrix of \cref{eq:trm},
+\begin{equation}
+  \begin{pmatrix} x & y & 1 \end{pmatrix}
+  = \begin{pmatrix} 0 & 0 & 1 \end{pmatrix} T_{rm} ,
+\end{equation}
+and the viewer draws the page at scale $s$ (device pixels per point) with the
+origin at the top left, so for an unrotated page the viewport matrix is
+\begin{equation}
+  V_s =
+  \begin{pmatrix}
+    s & 0 & 0 \\
+    0 & -s & 0 \\
+    -s x_0 & s y_1 & 1
+  \end{pmatrix},
+  \qquad
+  \begin{pmatrix} u & v & 1 \end{pmatrix}
+  = \begin{pmatrix} x & y & 1 \end{pmatrix} V_s .
+  \label{eq:viewport}
+\end{equation}
+A page rotated by $\phi \in \{0, \tfrac{\pi}{2}, \pi, \tfrac{3\pi}{2}\}$ is
+drawn with $V_s$ composed with a rotation about the page centre,
+\begin{equation}
+  R_{\phi} =
+  \begin{pmatrix}
+    \cos\phi & \sin\phi & 0 \\
+    -\sin\phi & \cos\phi & 0 \\
+    0 & 0 & 1
+  \end{pmatrix},
+\end{equation}
+so that the complete chain from a glyph to a pixel is
+$(0\ 0\ 1)\, T_{rm}\, V_s\, R_{\phi}$ up to a translation. Zooming changes only
+$s$, which is why Papilot stores positions on the page in normalised
+coordinates $r = (\xi_0, \eta_0, \xi_1, \eta_1) \in [0,1]^4$ relative to the
+view box:
+\begin{equation}
+  \xi = \frac{x - x_0}{x_1 - x_0}, \qquad
+  \eta = \frac{y_1 - y}{y_1 - y_0} .
+  \label{eq:normalised}
+\end{equation}
+
+\subsection{How \TeX{} spaces a line}
+
+\TeX{} sets a line of natural width $L_0$ in a box of width $L$ by stretching or
+shrinking the glue between words~\cite{knuth1984}. If the line's glue has total
+stretchability $Y$ and shrinkability $Z$, the \emph{adjustment ratio} is
+\begin{equation}
+  r =
+  \begin{cases}
+    (L - L_0)/Y, & L \ge L_0,\\
+    (L - L_0)/Z, & L < L_0,
+  \end{cases}
+  \label{eq:ratio}
+\end{equation}
+and an interword space with natural width $g$, stretch $y$ and shrink $z$ is
+set at width $g + r y$ or $g + r z$. The \emph{badness} of the line is
+approximately
+\begin{equation}
+  b(r) = \min\bigl(10000,\ 100\,\abs{r}^{3}\bigr),
+  \label{eq:badness}
+\end{equation}
+with $10000$ meaning infinitely bad. The Knuth--Plass algorithm chooses breaks
+that minimise the total \emph{demerits}~\cite{knuth1981}, where a line with
+badness $b$ ending at a break with penalty $p$ costs
+\begin{equation}
+  d =
+  \begin{cases}
+    (l + b)^{2} + p^{2}, & 0 \le p < 10000,\\
+    (l + b)^{2} - p^{2}, & -10000 < p < 0,\\
+    (l + b)^{2}, & p \le -10000,
+  \end{cases}
+  \label{eq:demerits}
+\end{equation}
+and $l$ is the line penalty (ten by default). Because \cref{eq:demerits}
+trades badness between lines, interword spaces vary from line to line, and
+that variation is what a text layer must follow.
+
+\subsection{Why a line-wide text layer drifts}
+
+To make text selectable, a viewer overlays invisible text on the rendered page.
+A common construction places one run per line in a stand-in font and stretches
+it horizontally so that the run's ends meet the line's ends~\cite{pdfjs}. Let a
+line consist of glyphs with true advances $a_1, \dots, a_N$ and stand-in
+advances $b_1, \dots, b_N$. The stretch factor is
+\begin{equation}
+  \sigma = \frac{\sum_{i=1}^{N} a_i}{\sum_{i=1}^{N} b_i},
+\end{equation}
+and the selectable position of glyph $k$ is off by
+\begin{equation}
+  \varepsilon_k = \sum_{i<k} \delta_i, \qquad
+  \delta_i = \sigma b_i - a_i, \qquad
+  \varepsilon_1 = \varepsilon_{N+1} = 0 .
+  \label{eq:drift}
+\end{equation}
+
+\begin{theorem}[Mid-line drift]
+\label{thm:drift}
+If the discrepancies $\delta_1, \dots, \delta_N$ are exchangeable with
+variance $v$, then $\sum_i \delta_i = 0$ forces
+$\Cov(\delta_i, \delta_j) = -v/(N-1)$ for $i \ne j$, and
+\begin{equation}
+  \Var(\varepsilon_k) = v\, \frac{(k-1)(N-k+1)}{N-1},
+  \qquad
+  \max_k \Var(\varepsilon_k) \approx \frac{v N}{4} .
+  \label{eq:bridge}
+\end{equation}
+\end{theorem}
+
+The proof is in \cref{app:proofs}. \Cref{eq:bridge} is the variance of a
+discrete Brownian bridge~\cite{billingsley1999}: the error vanishes at both
+ends of the line, where the run is anchored, and is largest in the middle.
+
+Justified lines add a deterministic bias. Every space is printed $g + r y$
+wide but drawn $\sigma b_{\text{space}}$ wide in the stand-in font, so that
+\begin{equation}
+  \beta_k = \bigl(g + r y - \sigma b_{\text{space}}\bigr) \cdot
+  \#\{\text{spaces before glyph } k\} .
+  \label{eq:bias}
+\end{equation}
+With \TeX{}'s interword glue at ten points, $g = 3.33$\,pt and $y = 1.67$\,pt,
+a line set with $r = 0.6$ has spaces of $4.33$\,pt; if the stand-in font's
+spaces come out at $3.0$\,pt after stretching, the bias grows by $1.33$\,pt per
+space and reaches $8$\,pt, more than a letter and a half, after six words. Together,
+\cref{eq:bridge,eq:bias} explain drifts of several characters in the middle of
+a line, enough for a drag to select a neighbouring word.
+
+\subsection{Per-word runs}
+
+Papilot instead reads every word's printed place from the PDF: its left edge
+$\lambda_j$, baseline $y_j$, size $f_j$ and width $w_j$. It places one run per
+word, stretched to end where the next word begins, so that the run for word
+$j$ covers glyphs $J_j$ and the space after them with its own factor
+\begin{equation}
+  \sigma_j = \frac{\lambda_{j+1} - \lambda_j}
+    {\sum_{i \in J_j} b_i + b_{\text{space}}} .
+\end{equation}
+
+\begin{theorem}[Per-word drift]
+\label{thm:per-word}
+With per-word runs, every word starts exactly where it is printed, and the
+error at a glyph $k$ of word $j$ satisfies
+\begin{equation}
+  \abs{\varepsilon_k} \le \sum_{i \in J_j} \abs{\sigma_j b_i - a_i}
+  \le N_j \max_{i \in J_j} \abs{\sigma_j b_i - a_i},
+  \qquad
+  \Var(\varepsilon_k) \le \frac{v N_j}{4} ,
+  \label{eq:per-word}
+\end{equation}
+where $N_j = \abs{J_j}$. The bias \cref{eq:bias} does not accumulate across
+words.
+\end{theorem}
+
+\begin{proof}
+The run for word $j$ starts at $\lambda_j$, so $\varepsilon$ is zero at the
+first glyph of every word. Within the word, \cref{eq:drift} applies with $N$
+replaced by $N_j$ and $\sigma$ by $\sigma_j$, which gives the first two bounds
+by the triangle inequality and the third by \cref{thm:drift}. Since every word
+restarts at its printed position, no space contributes to the error of a later
+word.
+\end{proof}
+
+For a line of $N = 80$ glyphs and words of $N_j \approx 6$, the typical error
+falls by a factor of about $\sqrt{N/N_j} \approx 3.7$ and the bias disappears.
+\Cref{fig:drift} compares the two layouts.
+
+\begin{figure}[t]
+\centering
+\begin{tikzpicture}
+\begin{axis}[
+  width=0.92\linewidth, height=5.2cm,
+  xlabel={glyph position $k$ in the line}, ylabel={$\sqrt{\Var(\varepsilon_k)/v}$},
+  xmin=0, xmax=80, ymin=0, ymax=5,
+  legend style={at={(0.5,1.03)}, anchor=south, legend columns=2, draw=none, font=\small, /tikz/every even column/.append style={column sep=1.2em}},
+  grid=major, grid style={gray!20}, tick label style={font=\small}, label style={font=\small}]
+  \addplot[blue!60!black, thick, domain=0:80, samples=161] {sqrt(x*(80-x)/79)};
+  \addlegendentry{one run per line}
+  \addplot[orange!80!black, thick, domain=0:80, samples=561] {sqrt(mod(x,7)*(7-mod(x,7))/6)};
+  \addlegendentry{one run per word}
+\end{axis}
+\end{tikzpicture}
+\caption{Standard deviation of the selection error along a line of $80$ glyphs,
+from \cref{eq:bridge}, for a single stretched run and for per-word runs with
+words of six letters and a space. The per-word error returns to zero at every
+word.}
+\label{fig:drift}
+\end{figure}