quario 0.6.0 → 0.7.0

package/CHANGELOG.md

@@ -7,6 +7,129 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.7.0] - 2026-09-07
+
+### Added
+
+- **Styled runs.** Bold a word, colour a phrase, or format one value inside a
+  sentence, and have it survive into the PDF and the spreadsheet — not only the
+  HTML, which was the only place `<b>` in a template ever meant anything. A run
+  carries the inline declarations only: no padding, borders or spacing, which
+  belong to a whole line or block.
+
+  A cell's tokens carry a run's resolved style on the tokens it covers, and
+  `styledRuns(tokens)` groups them back out — the same rule every built-in
+  target reads them through, so a custom target cannot drift from them.
+  `RUN_STYLE_NAMES` is the inline half of the vocabulary as a list, beside
+  `STYLE_NAMES`, for a tool that offers an author what a run may wear.
+
+- **`plan()` now reports declarations that nothing will read.** A definition can
+  be perfectly valid and still say something the engine quietly drops, and
+  until now the only way to find out was to notice the output was wrong.
+  `plan()` returns a `warnings` list beside `problems` — same shape, same
+  document order, one entry per declaration — and it currently catches three:
+
+  - a `format` on a cell whose value can never present a single interpolation —
+    `"Due {{ due }}"` under `format: "date"` — which the engine leaves unread;
+  - a `currency` on a cell whose `format` is not `"currency"`, which the engine
+    reads only under that kind and otherwise ignores, so the cell renders in
+    the instance's currency and the code you wrote does nothing;
+  - a table where every column declares a `width` and the widths total under
+    100, which leaves the trailing share of the table unused — usually a column
+    edited down without its neighbours being adjusted.
+
+  `problems` is unchanged and still fatal: a definition with problems compiles
+  to nothing, while one carrying only warnings compiles and renders exactly as
+  before. Hosts that ignore the new field are unaffected, and `validate()` is
+  untouched.
+
+  Warnings are advisory and deliberately incomplete — they catch what can be
+  seen in the definition alone, without data, so a quiet `warnings` list is not
+  a promise that every declaration will be read.
+
+### Changed
+
+- **A `format` declaration now needs one value to speak about, and a cell can
+  give it one.** Previously a `format` on a cell reached every interpolation in
+  it and skipped the literal text between them, which meant
+  `"{{ amount }} of {{ quantity }}"` under `format: "currency"` rendered the
+  quantity as money too — and the page and the spreadsheet disagreed about it,
+  the page formatting inside a sentence where the sheet did not.
+
+  A cell `value` may now be a list of **styled runs** —
+  `{ "value": "…", "style": { … } }` — each with its own declarations, and
+  `format` applies to a run holding a single interpolation.
+
+  **What changes in an existing report:** a cell that mixes text and an
+  interpolation under a `format` stops presenting that value and renders it
+  plainly, in every target. `"Due {{ due }}"` with `format: "date"` was
+  `Due 14 Aug 2026` on the page and `Due 2026-08-14` in the sheet; it is now
+  the plain form in both. To restore it, split the value and leave the
+  declaration where it is:
+
+  ```jsonc
+  {
+    "value": [{ "value": "Due " }, { "value": "{{ due }}" }],
+    "style": { "format": "date" }
+  }
+  ```
+
+  A cell's `format` reaches its runs, so nothing moves and nothing is declared
+  twice. `plan()` reports the cells this affects wherever it can see them
+  without data.
+
+### Fixed
+
+- **`round`, `floor` and `ceil` reuse their formatters instead of rebuilding
+  one per call.** The three reach the decimal you wrote through `Intl`, and
+  each call built a fresh formatter to do it — so a detail column of
+  `{{ round(@.qty * @.price, 2) }}` paid for one per row. A hundred-thousand
+  row report with two such columns drained in 3.5 s; it now drains in 0.2 s.
+  Every answer is the value it was before: the rounding mode and the digit
+  count are both part of what a reused formatter is found by, so no call can
+  be handed one built for another.
+
+- **`round`, `floor` and `ceil` name themselves when they refuse an `n`.** All
+  three threw `n must be a number from 0 to 100`, so a cell calling more than
+  one was told how it failed and never which call; the message now opens with
+  the function, as a reducer's already did. The located path still names the
+  cell — one cell holds as many calls as you write, which is the whole reason
+  the name is worth having.
+
+  **An `n` that cannot be read as a number at all now gets the same answer.**
+  A `BigInt` or a `Symbol` reaching `n` from render data used to surface the
+  runtime's own `Cannot convert a BigInt value to a number`, and an object
+  carrying a throwing `valueOf` surfaced whatever it threw — each located at
+  the cell but naming neither the function nor anything an author could act
+  on. All of them are now the same refusal.
+
+- **`isDiagnostic` is documented for what it actually answers.** The README
+  said it was true for "one of the stack's located errors: quario's own, or one
+  thrown directly by xprsn, sjabloon, or padvinder", and its example read a
+  `false` as "one of your own functions failed". Only an engine's own error is
+  a diagnostic: quario's verdicts on a document — an unknown reducer, a
+  misused inline reducer, image bytes it will not vouch for — are located just
+  the same and are not diagnostics, so a host following that example rethrew
+  report faults as its own. Nothing about the guard changes; it never behaved
+  the way the page described.
+
+- **A misused inline reducer says what it is, instead of how it folds.**
+  `{{ min(1, 2) }}` — the two-argument scalar `min` quario does not have —
+  failed at the cell with `(rows || []).map is not a function`, the fold's own
+  internals, naming neither the reducer nor the mistake. It now reads
+  `min is a reducer over an array, not a scalar function; got a number`, and a
+  second argument that is not a lambda says so in the same words rather than
+  reaching a host as `of is not a function`. Register a function of your own to
+  shadow a built-in reducer when a report needs the scalar.
+
+  **Two reducers used to answer instead of failing**, each reading a `length`
+  off a value that is not a collection: `count('ab')` presented `2` — a
+  string's own length, folded as if it were a count of rows — while `count(1)`
+  and `avg(1, 2)` presented nothing at all. All three are now the same located
+  error. A reducer over an **absent** array is unchanged and still not a
+  mistake: `sum(@.lines)` on a row carrying no lines is `0`, exactly as an
+  empty array gives.
+
 ## [0.6.0] - 2026-09-07
 
 ### Added

package/README.md

@@ -127,6 +127,14 @@ display text. Passing the cell's resolved `format` kind opts into the seam's one
 real numeric cells;
 [`@quario/csv`](https://www.npmjs.com/package/@quario/csv) is the short form.
 
+### `styledRuns(tokens)`
+
+Groups a cell's tokens into its **styled runs**, in order — each `{ style, tokens }`,
+with `style` `null` where the tokens carry none and the cell's own applies. Consecutive tokens
+with equal styles are one run, which is lossless: equal styles render identically, so the grouping
+survives a JSON round trip. Every built-in target reads a cell's runs through this, so a custom
+target cannot drift from them.
+
 ### `walk(events, handlers)` / `breathe()`
 
 `walk` is the delivery driver every official target uses. Pass one render's event iterable and
@@ -154,7 +162,8 @@ cell the same way:
 - `currencyOf(style?, options?)` — which code a money cell wears: its own, else the instance's.
 - `isReportBand(role)` — whether a role names one of the report's own bands rather than a
   group's.
-- `STYLE_NAMES` — the closed style vocabulary, in the spec's order.
+- `STYLE_NAMES` — the closed style vocabulary, in the spec's order, and
+  `RUN_STYLE_NAMES` — the inline half of it, which is what a styled run may wear.
 
 ### `validate(schema, functions?)`
 
@@ -172,34 +181,49 @@ so `validate()` can never disagree with what `report()` accepts.
 ### `quario().plan(schema, functions?)`
 
 The one traversal, whole — for hosts that validate and render in a loop, like an editor. Returns
-`{ report, problems, anchors }`: the compiled report (`null` while the document has problems),
-every problem structurally as `{ path, source?, message, diagnostic? }` (the `message` is exactly
-`validate()`'s string, and every problem keeps its own located diagnostic with `start`/`end`
-offsets, not only the first), and `anchors`, mapping each compiled source's schema path to the
-anchors and group handles it reads — the unfiltered complement of `names`.
+`{ report, problems, anchors, warnings }`: the compiled report (`null` while the document has
+problems), every problem structurally as `{ path, source?, message, diagnostic? }` (the `message`
+is exactly `validate()`'s string, and every problem keeps its own located diagnostic with
+`start`/`end` offsets, not only the first), `anchors`, mapping each compiled source's schema path
+to the anchors and group handles it reads — the unfiltered complement of `names` — and
+`warnings`.
+
+A warning is `{ path, source?, message }`: the document declares something nothing will read. It
+is not a problem at a lower severity, which is why it has no `diagnostic` — nothing raised, the
+engine decided. Neither warning below locates into an authored source, so none carries a `source`
+today. **A warning is never fatal**: a document carrying only warnings compiles and
+renders, so `report` is `null` on `problems` alone. Two declarations warn today — a `currency` on
+a cell whose `format` is not `"currency"`, and a table where every column is sized and the widths
+total under 100 — and the list is advisory and deliberately incomplete, so a quiet one is not a
+promise that every declaration will be read. `validate()` returns problems only.
 
 ```js
-const { report, problems, anchors } = quario().plan(schema);
+const { report, problems, anchors, warnings } = quario().plan(schema);
+for (const warning of warnings) console.warn(warning.message);
 if (report) await report.render(html(), data);
 else console.error(problems[0].path, problems[0].message);
 ```
 
 ### `isDiagnostic(error)`
 
-True when a caught value is one of the stack's located errors: quario's own, or one thrown
-directly by xprsn, sjabloon, or padvinder. Authentication checks identity. An error that only
-matches the shape does not pass.
+True when a caught value is a **located diagnostic**: an error xprsn, sjabloon or padvinder
+minted — thrown by that engine, or re-thrown by quario with the engine original behind it.
+Authentication checks identity. An error that only matches the shape does not pass.
 
-Located errors name their band path and offending source while keeping their original type
-(`SyntaxError`, `TypeError`, `RangeError`). They carry `code`, `start`/`end` offsets, and (for
-query budget failures) `limit` and `actual`.
+Being located is not what the guard reads: quario's own verdicts on a document and a registered
+function's own throw are located too, and neither is a diagnostic. Errors a report throws
+name the path they failed at — and the offending source, where there is one — while keeping their
+original type (`SyntaxError`, `TypeError`, `RangeError`). What a diagnostic adds on top is
+metadata an engine vouches for: `code`, `start`/`end` offsets, and, for a query budget in place
+of those offsets, `limit` and `actual`.
 
 ```js
 try {
   await report.render(html(), data);
 } catch (e) {
-  if (isDiagnostic(e)) console.error("report problem:", e.message);
-  else throw e; // one of your own functions failed
+  // Every error names where it failed; a diagnostic also carries an engine's own metadata.
+  if (isDiagnostic(e)) console.error(e.code, e.start, e.end);
+  throw e;
 }
 ```
 

package/lib/format.js

@@ -17,6 +17,7 @@
  * carries no count presents nothing here and the caller falls back to
  * `display()`.
  */
+import { boundedMemo } from "./memo.js";
 import { currencyOf, formatOf } from "./style.js";
 import { finiteDate, finiteNum, reviveDate } from "./stream.js";
 /** @type {(options: any) => string} */
@@ -24,11 +25,9 @@ let localeOf = (options) => options?.locale || "en-US";
 /** @type {(options: any) => string} */
 let zoneOf = (options) => options?.timeZone || "UTC";
 
-// Building an `Intl` formatter costs about 22 µs; using one costs 0.3 µs. A
-// report presents cell after cell from a handful of distinct formats, so
-// constructing per token spent 3.2 s on a hundred thousand presented cells
-// where 0.2 s does (a report of mixed currencies rendered to HTML), and the
-// formatters are memoised.
+// The formatters are memoised behind `./memo.js`'s bounded store, which
+// carries the rules a bounded memo has; what is here is what only this call
+// site knows -- its key, and its cap.
 //
 // **The key is everything the formatter is made from**, and it is values
 // rather than an object identity because no identity survives both paths: a
@@ -48,12 +47,6 @@ let zoneOf = (options) => options?.timeZone || "UTC";
 // single locale. Measured at 244 bytes retained per entry, that is about 90 MB
 // held for the life of the process on data nobody vetted.
 //
-// So the map is bounded, and past the bound it is emptied rather than grown.
-// A workload presenting more distinct formats than the cap pays what it paid
-// before any of this and never more, which is the one cost that needs no
-// argument -- and it can never hand back a formatter built for another cell,
-// because clearing forgets rather than reuses.
-//
 // 2048 leaves the margin a threshold like this wants on both sides: about
 // 500 KB at the cap, against a real report reaching a small multiple of the
 // ISO codes actually in circulation, which is under two hundred. Raising it
@@ -62,23 +55,7 @@ let zoneOf = (options) => options?.timeZone || "UTC";
 //
 // Memoising a fact that cannot change within an ICU version, like
 // `fractionDigits`' own minor-units map (docs/adr/0025).
-let CAP = 2048;
-/** @type {Map<string, any>} */
-let formatters = new Map();
-// A construction that throws -- an unreadable locale, zone, or currency code
-// -- caches nothing: it reaches `format()`'s own catch, and a later cell asks
-// again rather than finding nothing sitting in the map under a good key.
-// Missing on `undefined` rather than `has()`, which is what `precision.js`
-// needs because *it* caches an absent answer; a formatter is never one.
-/** @type {(key: string, make: () => any) => any} */
-let memo = (key, make) => {
-  let formatter = formatters.get(key);
-  if (formatter !== undefined) return formatter;
-  formatter = make();
-  if (formatters.size >= CAP) formatters.clear();
-  formatters.set(key, formatter);
-  return formatter;
-};
+let memo = boundedMemo(2048);
 
 // The kind leads, so a number's key can never read as a date's; the currency
 // is empty for the two kinds that wear none.

package/lib/index.d.ts

@@ -118,8 +118,52 @@ export interface SortKey {
   dir?: "asc" | "desc";
 }
 
-/** A cell value: one template string. */
-export type CellValue = string;
+/**
+ * The names a styled run may wear, in the vocabulary's own order. A tool that
+ * offers them — the editor's style rail — reads this rather than keeping a
+ * copy, exactly as it reads `STYLE_NAMES` for the whole set.
+ */
+export const RUN_STYLE_NAMES: readonly string[];
+
+/**
+ * The declarations a styled run accepts: the inline half of the vocabulary,
+ * and nothing else. The box and flow spacing describe a block and `align`
+ * describes a line, and neither means anything on part of one — so a run is
+ * narrowed from the other end than an image item is. A narrowing of the one
+ * vocabulary rather than a second list of its own, so the two cannot drift.
+ */
+export type RunStyleDeclarations = Pick<
+  StyleDeclarations,
+  | "family"
+  | "size"
+  | "bold"
+  | "italic"
+  | "underline"
+  | "strikethrough"
+  | "color"
+  | "background"
+  | "uppercase"
+  | "format"
+  | "currency"
+>;
+
+/**
+ * One styled run: a stretch of a cell's text with its own declarations. A
+ * closed two-key object — `{{#if}}` already conditions a run's own text, so
+ * there is no `visible` on one.
+ */
+export interface StyledRun {
+  value: string;
+  /** Literal only — never an expression. */
+  style?: RunStyleDeclarations;
+}
+
+/**
+ * A cell value: one template string, or a non-empty array of styled runs. A
+ * cell written as one template string is one run, so a one-run array says
+ * exactly what that string says.
+ */
+export type CellValue = string | StyledRun[];
 
 export type Align = "left" | "center" | "right";
 export type VAlign = "top" | "middle" | "bottom";
@@ -194,8 +238,12 @@ export interface ImageItem {
   source: `=${string}`;
   /** Defaults to `"natural"`. */
   fit?: ImageFit;
-  /** The image's textual stand-in, as a cell value. */
-  alt?: CellValue;
+  /**
+   * The image's textual stand-in: one template string. A styled run means
+   * nothing on a stand-in for a picture, so this is the one cell value the
+   * widened type does not reach.
+   */
+  alt?: string;
   visible?: ExpressionValue<boolean>;
   style?: ImageStyleDeclarations;
 }
@@ -445,14 +493,43 @@ export type ItemRole =
   | "page-header"
   | "page-footer";
 
+/**
+ * The resolved declarations for one stretch of a cell's text: the cell's own
+ * with its styled run's layered over them, already composed, so a consumer
+ * applies it exactly where it applies the cell's `style` rather than merging
+ * the two. Present only where it differs from the cell's own.
+ */
+export interface TokenStyle {
+  style?: Record<string, unknown>;
+}
+
 /** One static text run of a cell's template, verbatim (sjabloon's literal token). */
-export type LiteralToken = SjabloonLiteralToken;
+export type LiteralToken = SjabloonLiteralToken & TokenStyle;
 
 /** One interpolation's pre-stringify value (sjabloon's value token). */
-export type ValueToken = SjabloonValueToken;
+export type ValueToken = SjabloonValueToken & TokenStyle;
 
 export type Token = LiteralToken | ValueToken;
 
+/** One of a cell's styled runs, as `styledRuns` groups them back out. */
+export interface TokenRun {
+  /** The style this run's tokens carry, or `null` where the cell's applies. */
+  style: Record<string, unknown> | null;
+  tokens: Token[];
+}
+
+/**
+ * Group a cell's tokens into its styled runs, in order. Consecutive tokens
+ * with equal styles are one run — a lossless rule, because equal styles render
+ * identically, so grouping survives a JSON round trip. Equality is compared
+ * one level deep, which is exhaustive rather than approximate: `format` is the
+ * only object-valued declaration and is itself flat.
+ *
+ * The built-in targets consume it, so a custom target grouping through it
+ * cannot drift from them.
+ */
+export function styledRuns(tokens: Token[]): TokenRun[];
+
 export interface EventCell {
   tokens: Token[];
   style?: Record<string, unknown>;
@@ -744,17 +821,35 @@ export interface Problem {
   readonly diagnostic?: QuarioDiagnostic;
 }
 
+/**
+ * An advisory: the document declares something nothing will read. Not a
+ * `Problem` at lower severity, and not its shape either — a problem carries
+ * the engine's located `diagnostic` when one authenticated the fault, and a
+ * `source` when it came from compiling one. Neither can happen here: nothing
+ * raises, and the engine decides a declaration will not be read after every
+ * compile has already succeeded. A warning that did locate into an authored
+ * source would add the field back; carrying one nothing sets would promise a
+ * location that never arrives.
+ */
+export interface Warning {
+  readonly path: string;
+  readonly message: string;
+}
+
 /**
  * The plan: both readings of the one traversal, kept. `report` is the
  * compiled report, or null while the document has problems; `problems` is the
- * structured list `validate()` flattens to strings; `anchors` maps each
- * compiled source's schema path to the anchors and group handles it reads —
- * the unfiltered complement of `names`, which excludes them.
+ * structured list `validate()` flattens to strings; `warnings` is the advisory
+ * half, which never nulls the report; `anchors` maps each compiled source's
+ * schema path to the anchors and group handles it reads — the unfiltered
+ * complement of `names`, which excludes them. `problems` is fatal and
+ * `warnings` is advisory, both in document order from the one descent.
  */
 export interface Plan {
   readonly report: CompiledReport | null;
   readonly problems: readonly Problem[];
   readonly anchors: Readonly<Record<string, readonly string[]>>;
+  readonly warnings: readonly Warning[];
 }
 
 export interface Quario {
@@ -767,8 +862,8 @@ export interface Quario {
   report(schema: ReportSchema, functions?: FunctionRegistry): CompiledReport;
   /**
    * The one traversal, whole: compiled report (null on problems), structured
-   * problems, and per-node anchor sets — one descent per edit for a host that
-   * validates and renders in a loop.
+   * problems, advisory warnings, and per-node anchor sets — one descent per
+   * edit for a host that validates and renders in a loop.
    */
   plan(schema: unknown, functions?: FunctionRegistry): Plan;
 }

package/lib/index.js

@@ -24,9 +24,15 @@ import { opt } from "./stream.js";
 // The event stream's public seam, single-sourced in ./stream.js, and the
 // diagnostic predicate in ./locate.js. Re-exported here because a consumer
 // imports them from the package, not from a file inside it.
-export { breathe, display, isReportBand, text, typed, walk } from "./stream.js";
+export { breathe, display, isReportBand, styledRuns, text, typed, walk } from "./stream.js";
 export { format } from "./format.js";
-export { currencyOf, FORMAT_VOCABULARY, fractionDigits, STYLE_NAMES } from "./style.js";
+export {
+  currencyOf,
+  FORMAT_VOCABULARY,
+  fractionDigits,
+  RUN_STYLE_NAMES,
+  STYLE_NAMES,
+} from "./style.js";
 export { imageError, isDiagnostic } from "./locate.js";
 
 /** @typedef {import("./scope.js").Scope} Scope */
@@ -89,11 +95,13 @@ export function validate(schema, funcs) {
   return plan(schema, funcs).problems.map((problem) => problem.message);
 }
 
-// The structured problems, frozen for handing out: the traversal's own objects
-// go to exactly one caller, so freezing here cannot disturb a second reader.
-// The diagnostic stays an engine-minted error and is deliberately not frozen.
-/** @type {(problems: any[]) => readonly any[]} */
-let freezeProblems = (problems) => Object.freeze(problems.map((problem) => Object.freeze(problem)));
+// The structured problems and warnings, frozen for handing out: the
+// traversal's own objects go to exactly one caller, so freezing here cannot
+// disturb a second reader. The diagnostic stays an engine-minted error and is
+// deliberately not frozen. One helper for both lists, because a warning is a
+// problem's shape less the field that cannot occur on one.
+/** @type {(entries: any[]) => readonly any[]} */
+let freezeEntries = (entries) => Object.freeze(entries.map((entry) => Object.freeze(entry)));
 
 // The per-node anchor sets, as frozen host data (CONTEXT.md, "Freeze"): which
 // anchors and group handles each compiled source reads, keyed by schema path.
@@ -333,8 +341,9 @@ export function quario(options) {
       let planned = plan(schema, funcs, options);
       return {
         report: planned.problems.length ? null : wrap(assemble(planned, schema, marking, options)),
-        problems: freezeProblems(planned.problems),
+        problems: freezeEntries(planned.problems),
         anchors: freezeAnchors(planned.anchors),
+        warnings: freezeEntries(planned.warnings),
       };
     },
   };

package/lib/math.js

@@ -15,17 +15,44 @@
  * table, is in docs/adr/0050. The locale is hardcoded `en-US` rather than the
  * instance's: this is arithmetic, not presentation, and a locale with
  * non-ASCII digits or its own grouping would not parse back through `Number`.
- * Formatters are built per call, deliberately -- see the ADR.
  */
+import { boundedMemo } from "./memo.js";
+
+// The formatters are memoised behind `./memo.js`, the same seam `format()`
+// uses -- one bounded store each, not one between them. ADR 0050 declined this
+// cache and records why the decline expired; what is here is what only this
+// call site knows, its key and its cap.
+//
+// **The key is the mode and the count**, which is all that varies: the locale
+// and `useGrouping` are constants here rather than configuration, precisely so
+// the answer parses back through `Number`, so they are not in it. The mode
+// leads, as the kind does in `format()`'s key, and the two shapes read the
+// same way. Drop either piece and a `floor` presents a `round`'s answer, or a
+// three-digit call presents two -- pinned a piece at a time in
+// `test/frozen.test.js`.
+//
+// **The cap is unreachable, and that is the point of stating it.** `places`
+// admits 0 to 100 and there are three modes, so this store holds at most 303
+// entries however hostile the data is -- `n` may be an `=` result, but it
+// cannot be an unbounded one. 512 is headroom over that rather than a
+// threshold: if the admitted range ever widened, the store would empty and
+// rebuild rather than grow without limit, which is the same degradation
+// `format()`'s cap buys and no correctness knob either way.
+let memo = boundedMemo(512);
+
 /** @type {(x: number, n: number, mode: string) => number} */
 let decimal = (x, n, mode) =>
   Number(
-    new Intl.NumberFormat("en-US", {
-      minimumFractionDigits: n,
-      maximumFractionDigits: n,
-      useGrouping: false,
-      roundingMode: /** @type {any} */ (mode),
-    }).format(x),
+    memo(
+      mode + "|" + n,
+      () =>
+        new Intl.NumberFormat("en-US", {
+          minimumFractionDigits: n,
+          maximumFractionDigits: n,
+          useGrouping: false,
+          roundingMode: /** @type {any} */ (mode),
+        }),
+    ).format(x),
   );
 // The one test both halves make of `x`. Named because the rule it stands for
 // is the interesting part: rounding a value that is not a finite number would
@@ -47,16 +74,36 @@ let honourable = (digits) => Number.isFinite(digits) && digits >= 0 && digits <=
 // `maximumFractionDigits`, an option the author never wrote, so the message is
 // ours. Fractional `n` truncates rather than throwing, which is what Intl does
 // with it and is not worth a second rule for an author to hold.
-/** @type {(n: any) => number} */
-let places = (n) => {
-  let digits = Math.trunc(+(n ?? 0));
-  if (!honourable(digits)) throw new RangeError("n must be a number from 0 to 100");
+/** @type {(fn: string, n: any) => number} */
+let places = (fn, n) => {
+  let digits = NaN;
+  // `+` is the other way `n` fails, and it used to fail rawly: a BigInt or a
+  // Symbol makes the coercion throw a TypeError of its own, and an object
+  // carrying a hostile `valueOf` throws whatever it likes. Each arrived
+  // located at the cell and naming nothing -- the very fault this rule closes
+  // -- and render data may be untrusted (SCHEMA.md, "Trust and Content
+  // Security Policy"), so an `n` that cannot even be read is folded into the
+  // one answer an author can act on rather than surfacing V8's.
+  try {
+    digits = Math.trunc(+(n ?? 0));
+  } catch {
+    digits = NaN;
+  }
+  if (!honourable(digits)) throw new RangeError(fn + "'s n must be a number from 0 to 100");
   return digits;
 };
 
-/** @type {(mode: string) => (x: any, n: any) => any} */
-let rounder = (mode) => (x, n) => {
-  let digits = places(n);
+// The name is threaded rather than prefixed by a wrapper around the registry.
+// `places` is the only place a built-in refuses an argument -- `abs` and the
+// folds never do -- so a catch on every built-in call would exist to serve one
+// function's messages. A mechanical prefix would also cost both halves their
+// own sentence: a reducer names itself inside its (`min is a reducer over an
+// array`) where a scalar names an argument it owns (`round's n`), and a
+// uniform `name: ` joiner fits neither without rewriting the other
+// (quario-gr4h).
+/** @type {(fn: string, mode: string) => (x: any, n: any) => any} */
+let rounder = (fn, mode) => (x, n) => {
+  let digits = places(fn, n);
   return finite(x) ? decimal(x, digits, mode) : x;
 };
 /** @type {Record<string, (...args: any[]) => any>} */
@@ -64,8 +111,8 @@ export let MATH = {
   // Written `(x, n)` rather than `(x, n = 0)` on purpose: xprsn's signatures()
   // reports arity from `fn.length`, and a default parameter would describe
   // these to an editor as taking one argument.
-  round: rounder("halfExpand"),
-  floor: rounder("floor"),
-  ceil: rounder("ceil"),
+  round: rounder("round", "halfExpand"),
+  floor: rounder("floor", "floor"),
+  ceil: rounder("ceil", "ceil"),
   abs: (x) => (finite(x) ? Math.abs(x) : x),
 };

package/lib/memo.js

@@ -0,0 +1,49 @@
+/**
+ * The bounded store the engine's `Intl` call sites are memoised behind.
+ *
+ * Building an `Intl` formatter costs about 20 µs and using one costs about
+ * 0.4 µs, so every path that builds one per call spends fifty times what it
+ * needs to. Two do: `./format.js` presents a token at the markup edge, and
+ * `./math.js` reaches a decimal through a formatter's `roundingMode`
+ * (docs/adr/0050). One rule, stated once, rather than the same six lines
+ * twice.
+ *
+ * **A factory, so each site owns its store.** One shared map would let a
+ * report turning over thousands of currency formatters evict the three a
+ * rounder ever holds, which is the caller with no unbounded key space paying
+ * for the caller that has one. The cap is passed rather than fixed here for
+ * the same reason: it is a claim about a key space, and only the call site
+ * knows what its keys are made of.
+ *
+ * **Past the cap the store is emptied rather than grown.** A workload with
+ * more distinct keys than the cap pays what it paid before any of this and
+ * never more, and it can never be handed a value built for another key,
+ * because clearing forgets rather than reuses.
+ *
+ * **The seam is the store, not the key.** The two keys have no shape in
+ * common -- four pieces off a resolved style declaration against a rounding
+ * mode and a count -- so a shared builder would be a joiner both callers
+ * already have in `+`, and it would put the piece that decides correctness a
+ * module away from the site that knows what the pieces are. They were
+ * designed together and each says so; nothing else about them is shared.
+ *
+ * **A `make` that throws caches nothing.** It reaches the caller's own catch
+ * and a later call asks again, rather than finding nothing sitting under a
+ * good key. That is why a miss is `undefined` rather than `has()`:
+ * `./precision.js` deliberately caches an *absent* answer and so needs
+ * `has()`, which is why it is not on this seam.
+ */
+
+/** @type {(cap: number) => (key: string, make: () => any) => any} */
+export let boundedMemo = (cap) => {
+  /** @type {Map<string, any>} */
+  let store = new Map();
+  return (key, make) => {
+    let value = store.get(key);
+    if (value !== undefined) return value;
+    value = make();
+    if (store.size >= cap) store.clear();
+    store.set(key, value);
+    return value;
+  };
+};