rapier-html 1.2.3 → 1.2.5

package/dist/ledger/inverse-source.mjs

@@ -2,7 +2,9 @@
 // Exact source projection shared by canonical history and causal transport.
 // Callers admit and order the records first; this projection retains no state.
 import {_rapierTransformSplices, _rapierHistoryEffects} from './journal-records.mjs';
-import {diff} from './diff.mjs';
+import {authoredPlacements} from './authored-origin.mjs';
+import {canonicalJSON} from './data.mjs';
+import {diff} from './diff/index.mjs';
 
 const historyFailure = reason => ({ok: false, reason});
 const historyBoundary = (source, at) => Number.isSafeInteger(at) && at >= 0 && !Object.is(at, -0) && at <= source.length &&
@@ -174,6 +176,24 @@ export function projectInverseSource(prepared, selected, projectedEffects, optio
 	try {
 		let pieces = prepared.initialSource ? [{text: prepared.initialSource, owner: null, lineage: []}] : [];
 		const all = [], byId = new Map(), byAct = new Map(), processed = [], keptInverseAncestors = new Set();
+		const recordsForCover = prepared.records || prepared.rows.map(({record, splices}) => record.splices === splices ? record : {...record, splices});
+		const coverGroups = new Map();
+		let coverOrigins = null;
+		// An empty document is a real causal source. Fresh notes start there, and a
+		// shared replacement authored against that source still has to stay covered.
+		if (typeof prepared.initialSource === 'string' && recordsForCover.some(record => record.authored?.splices?.some(row => row.removed.length))) {
+			try { coverOrigins = authoredPlacements(prepared.initialSource, recordsForCover); } catch { coverOrigins = null; }
+		}
+		const coverIdsFor = id => {
+			const origin = coverOrigins?.get(id);
+			if (!origin?.splices.some(row => row.removed.length)) return null;
+			const key = canonicalJSON({basis: origin.basis, splices: origin.splices});
+			if (!coverGroups.has(key)) coverGroups.set(key, []);
+			const ids = coverGroups.get(key);
+			if (!ids.includes(id)) ids.push(id);
+			return ids;
+		};
+		const coverHeld = hunk => hunk.coverIds?.length > 1 && hunk.coverIds.some(id => projectedEffects.active.has(id));
 		const texts = rows => rows.map(row => row.text || '');
 		const textOf = rows => texts(rows).join('');
 		const lengthOf = (rows, to = rows.length) => { let size = 0; for (let i = 0; i < to; i++) size += rows[i].text?.length || 0; return size; };
@@ -234,8 +254,16 @@ export function projectInverseSource(prepared, selected, projectedEffects, optio
 			return next && effects.active.has(next.actId) && !prepared.effects.references.get(next.actId)?.length;
 		});
 		const reactivate = (actIds, effects) => {
+			// Any author of one shared removal or replacement restores that one physical
+			// hunk, including an author who stored no splice. A later independent act
+			// keeps the bytes it wrote until that act itself is withdrawn.
+			const wanted = new Set(actIds);
+			for (const id of actIds) for (const hunk of all) {
+				if (hunk.reversedHunk || hunk.derived || !hunk.coverIds?.includes(id) || wanted.has(hunk.actId)) continue;
+				if (hunk.coverIds.some(cover => effects.active.has(cover))) wanted.add(hunk.actId);
+			}
 			for (const hunk of all) {
-				if (!actIds.has(hunk.actId) || hunk.derived || prepared.effects.references.get(hunk.actId)?.length) continue;
+				if (!wanted.has(hunk.actId) || hunk.derived || prepared.effects.references.get(hunk.actId)?.length) continue;
 				if (keptInverseAncestors.has(hunk.id)) continue;
 				if (laterSource(hunk, effects) || pieces.some(piece => piece.text && piece.owner === hunk.id) ||
 					(!hunk.inserted && hunk.active)) continue;
@@ -245,8 +273,9 @@ export function projectInverseSource(prepared, selected, projectedEffects, optio
 					// inverse's marker. Its exact ancestry also preserves later inserted runs.
 					const inverse = all.findLast(prior => prior.reversedHunk === hunk.id && pieces.includes(prior.marker));
 					if (!inverse) throw Error('reactivation');
-					if (laterSource(inverse, effects)) continue;
-					restoreHunk(inverse); inverse.active = false;
+					const runs = all.filter(prior => prior.actId === inverse.actId && prior.reversedHunk === hunk.id && pieces.includes(prior.marker));
+					if (runs.some(prior => laterSource(prior, effects))) continue;
+					for (const prior of runs) { restoreHunk(prior); prior.active = false; }
 					hunk.active = true; delete hunk.undoneBy;
 					continue;
 				}
@@ -291,51 +320,65 @@ export function projectInverseSource(prepared, selected, projectedEffects, optio
 			if (references.size) {
 				// Exact inverse rows restore the previous run identities. Retain the inverse's
 				// own transient marker too, so reversing it restores that same ancestry again.
-				const targets = all.filter(hunk => hunk.active && references.has(hunk.actId));
-				let restored = targets.length ? pieces.slice() : null;
-				const inverses = [], priorSplices = options.keepHunk ? [] : null;
-				for (let index = targets.length - 1; restored && index >= 0; index--) {
-					const target = targets[index], first = restored.indexOf(target.marker);
-					if (first < 0) { restored = null; break; }
-					let last = first;
-					for (let at = first; at < restored.length; at++) if (owns(restored[at], target)) last = at;
-					const pos = lengthOf(restored, first);
-					const before = restored.slice(first, last + 1), replacement = [];
-					for (const piece of before) {
-						if (piece === target.marker) replacement.push(...target.before);
-						else if (!owns(piece, target)) replacement.push(piece);
-					}
-					const id = tx.id + '#inverse:' + index, lineage = new Set([id]);
-					for (const piece of before) for (const parent of piece.lineage || piece.mark?.lineage || []) lineage.add(parent);
-					const hunk = {id, actId: tx.id, removed: textOf(before), inserted: textOf(replacement), before, reversedHunk: target.id,
-						chosen: selected.has(tx.id), lineage: [...lineage], supersededBy: new Set(), active: true,
-						restoredMarkers: new Set(replacement.filter(piece => !piece.text))};
-					if (hunk.chosen && options.keepHunk) {
-						const spliceIndex = splices.findIndex(row => row.pos <= pos && row.pos + row.removed.length >= pos);
-						const keep = options.keepHunk({actId: tx.id, spliceIndex: Math.max(0, spliceIndex), hunkIndex: index,
-							splice: {pos, removed: hunk.removed, inserted: hunk.inserted}, beforeSource: textOf(restored), actSource, priorSplices});
-						if (typeof keep !== 'boolean') throw Error('hunk_selection');
-						hunk.chosen = !keep;
+				const invert = targets => {
+					const restored = pieces.slice(), inverses = [], priorSplices = options.keepHunk ? [] : null;
+					for (let index = targets.length - 1; index >= 0; index--) {
+						const target = targets[index], first = restored.indexOf(target.marker);
+						if (first < 0) return null;
+						// Each run of the target's own pieces inverts alone: a later author's pieces between
+						// its runs stay in place, outside every inverse, so reversing it cannot move them.
+						const runs = [];
+						for (let at = first; at < restored.length; at++) if (owns(restored[at], target))
+							if (runs.at(-1)?.[1] === at) runs.at(-1)[1]++; else runs.push([at, at + 1]);
+						for (let run = runs.length - 1; run >= 0; run--) {
+							const [from, to] = runs[run], before = restored.slice(from, to), pos = lengthOf(restored, from);
+							const replacement = run ? [] : target.before;
+							const id = tx.id + '#inverse:' + index + (run ? '.' + run : ''), lineage = new Set([id]);
+							for (const piece of before) for (const parent of piece.lineage || piece.mark?.lineage || []) lineage.add(parent);
+							const hunk = {id, actId: tx.id, removed: textOf(before), inserted: textOf(replacement), before, reversedHunk: target.id,
+								chosen: selected.has(tx.id), lineage: [...lineage], supersededBy: new Set(), active: true,
+								restoredMarkers: new Set(replacement.filter(piece => !piece.text))};
+							if (hunk.chosen && options.keepHunk) {
+								const spliceIndex = splices.findIndex(row => row.pos <= pos && row.pos + row.removed.length >= pos);
+								const keep = options.keepHunk({actId: tx.id, spliceIndex: Math.max(0, spliceIndex), hunkIndex: index,
+									splice: {pos, removed: hunk.removed, inserted: hunk.inserted}, beforeSource: textOf(restored), actSource, priorSplices});
+								if (typeof keep !== 'boolean') throw Error('hunk_selection');
+								hunk.chosen = !keep;
+							}
+							hunk.kept = selected.has(tx.id) && !hunk.chosen;
+							// A semantic owner retaining this inverse also retains the exact ancestors
+							// it restored; effect reactivation must not change them behind that owner.
+							if (hunk.kept) for (let prior = target; prior; prior = byId.get(prior.reversedHunk)) keptInverseAncestors.add(prior.id);
+							hunk.marker = {mark: hunk};
+							const insertion = replacement.map(piece => piece.text ? {...piece,
+								lineage: [...new Set([...(piece.lineage || []), id])],
+								restoredBy: [...(piece.restoredBy || []), id]} : piece);
+							restored.splice(from, to - from, hunk.marker, ...insertion);
+							inverses.push(hunk); priorSplices?.push({pos, removed: hunk.removed, inserted: hunk.inserted});
+						}
 					}
-					hunk.kept = selected.has(tx.id) && !hunk.chosen;
-					// A semantic owner retaining this inverse also retains the exact ancestors
-					// it restored; effect reactivation must not change them behind that owner.
-					if (hunk.kept) for (let prior = target; prior; prior = byId.get(prior.reversedHunk)) keptInverseAncestors.add(prior.id);
-					hunk.marker = {mark: hunk};
-					const insertion = replacement.map(piece => piece.text ? {...piece,
-						lineage: [...new Set([...(piece.lineage || []), id])],
-						restoredBy: [...(piece.restoredBy || []), id]} : piece);
-					restored.splice(first, last + 1 - first, hunk.marker, ...insertion);
-					inverses.push(hunk); priorSplices?.push({pos, removed: hunk.removed, inserted: hunk.inserted});
-				}
-				if (restored && replays(pieces, restored, splices)) {
-					pieces = restored;
-					for (const target of targets) { target.active = false; target.undoneBy = tx.id; }
+					return replays(pieces, restored, splices) ? {restored, inverses} : null;
+				};
+				// An inverse taken while a later edit had replaced some of the act's hunks restored only
+				// the rest. Those replaced hunks survive it: no later projection treats them as undone.
+				// Recorded splices decide. An author who stored no splice still inverts the one
+				// shared hunk; an empty inverse does not match that text change and leaves it.
+				const direct = all.filter(hunk => hunk.active && references.has(hunk.actId));
+				const targets = direct.length ? direct : all.filter(hunk => hunk.active && !hunk.reversedHunk && !hunk.derived &&
+					hunk.coverIds?.some(id => references.has(id)));
+				const free = targets.filter(hunk => ![...hunk.supersededBy].some(id => byId.get(id)?.active));
+				let found = targets.length ? invert(targets) : null, survivors = [];
+				if (!found && free.length && free.length < targets.length && (found = invert(free)))
+					survivors = targets.filter(hunk => !free.includes(hunk));
+				if (found) {
+					pieces = found.restored;
+					for (const target of targets) if (survivors.includes(target)) target.survived = true;
+					else { target.active = false; target.undoneBy = tx.id; }
 					for (const piece of pieces) if (piece.mark) {
 						piece.mark.active = true; delete piece.mark.undoneBy;
 					}
-					for (const hunk of inverses) { all.push(hunk); byId.set(hunk.id, hunk); }
-					byAct.set(tx.id, inverses);
+					for (const hunk of found.inverses) { all.push(hunk); byId.set(hunk.id, hunk); }
+					byAct.set(tx.id, found.inverses);
 					continue;
 				}
 			}
@@ -354,6 +397,7 @@ export function projectInverseSource(prepared, selected, projectedEffects, optio
 					for (const [hunk, active, undoneBy] of priorStates) { hunk.active = active; hunk.undoneBy = undoneBy; }
 				}
 			}
+			if (!references.size) coverIdsFor(tx.id);
 			const priorSplices = options.keepHunk ? [] : null;
 			// An admitted codec finish replaces the complete embedded definition/reference.
 			// Keep its inserted run whole, including byte-identical prefixes of a re-edit;
@@ -395,7 +439,8 @@ export function projectInverseSource(prepared, selected, projectedEffects, optio
 					const lineage = new Set([id]);
 					for (const piece of removed) for (const parent of piece.lineage || piece.mark?.lineage || []) lineage.add(parent);
 					const hunk = {id, actId: tx.id, removed: row.removed, inserted: row.inserted, before: removed, derived,
-						chosen, kept: selected.has(tx.id) && !chosen, lineage: [...lineage], supersededBy: new Set(), active: true};
+						chosen, kept: selected.has(tx.id) && !chosen, lineage: [...lineage], supersededBy: new Set(), active: true,
+						...(coverIdsFor(tx.id) ? {coverIds: coverIdsFor(tx.id)} : {})};
 					hunk.marker = {mark: hunk};
 					all.push(hunk); byId.set(id, hunk);
 					if (!byAct.has(tx.id)) byAct.set(tx.id, []);
@@ -414,9 +459,22 @@ export function projectInverseSource(prepared, selected, projectedEffects, optio
 		let offset = 0;
 		for (const piece of pieces) if (piece.text) { origins.set(piece, offset); offset += piece.text.length; }
 		const superseded = [];
+		// Survival means an inverse left this hunk in place because a later independent
+		// edit still covered it. Once that edit is gone, deactivating its last owner through
+		// any inverse path withdraws every exposed hunk. Undoing only the later
+		// edit reveals the survived insertion and does not discard it.
+		for (const hunk of all) if (hunk.survived) {
+			const covered = [...hunk.supersededBy].some(id => {
+				const next = byId.get(id);
+				return next?.active && projectedEffects.active.has(next.actId) && !prepared.effects.references.get(next.actId)?.length;
+			});
+			const owners = hunk.coverIds?.length ? hunk.coverIds : [hunk.actId];
+			if (!covered && owners.some(id => prepared.effects.active.has(id)) && !owners.some(id => projectedEffects.active.has(id))) hunk.survived = false;
+		}
 		for (let index = all.length - 1; index >= 0; index--) {
 			const hunk = all[index];
-			const inheritedInactive = !hunk.derived && !hunk.kept && !keptInverseAncestors.has(hunk.id) && !projectedEffects.active.has(hunk.actId) &&
+			if (coverHeld(hunk)) continue;
+			const inheritedInactive = !hunk.derived && !hunk.kept && !hunk.survived && !keptInverseAncestors.has(hunk.id) && !projectedEffects.active.has(hunk.actId) &&
 				!prepared.effects.references.get(hunk.actId)?.length;
 			if (!hunk.chosen && !inheritedInactive) continue;
 			hunk.active = prepared.effects.active.has(hunk.actId);
@@ -432,9 +490,13 @@ export function projectInverseSource(prepared, selected, projectedEffects, optio
 			restoreHunk(hunk);
 		}
 		// A hidden withdrawal can have no splice of its own. Reversing that withdrawal
-		// reactivates the original hunk at its retained marker, never at a text search.
-		reactivate(new Set(records.filter(record => !prepared.effects.active.has(record.transaction.id) &&
-			projectedEffects.active.has(record.transaction.id)).map(record => record.transaction.id)), projectedEffects);
+		// reactivates the shared hunk through the inverse that still carries it.
+		// Withdrawing a later act reveals that same hunk while any original author remains.
+		const reactivated = new Set(records.filter(record => !prepared.effects.active.has(record.transaction.id) &&
+			projectedEffects.active.has(record.transaction.id)).map(record => record.transaction.id));
+		for (const hunk of all) if (!hunk.reversedHunk && !hunk.derived && hunk.coverIds?.length > 1 &&
+			hunk.coverIds.some(id => projectedEffects.active.has(id))) reactivated.add(hunk.actId);
+		reactivate(reactivated, projectedEffects);
 		const after = textOf(pieces), changes = [];
 		let cursor = 0, inserted = '';
 		for (const piece of pieces) {

package/dist/ledger/journal-records.mjs

@@ -1,4 +1,5 @@
 // SPDX-License-Identifier: MIT
+import {fields, scalar, plainPrototype} from './data.mjs';
 
 const _RAPIER_TRANSACTION_ACTOR_LIMIT = 160;
 const _RAPIER_TRANSACTION_OPERATION_LIMIT = 96;
@@ -32,32 +33,15 @@ function _rapierTransformSplices(text, splices, inverse = false) {
 }
 
 function _rapierPlainLedgerData(record) {
-	try {
-		const active = new Set(), pending = [[record, false]];
-		while (pending.length) {
-			const [value, leaving] = pending.pop();
-			if (leaving) { active.delete(value); continue; }
-			if (value === null || typeof value === 'boolean') continue;
-			if (typeof value === 'string') { if (/[\uD800-\uDFFF]/u.test(value)) return false; continue; }
-			if (typeof value === 'number') { if (!Number.isFinite(value) || Object.is(value, -0)) return false; continue; }
-			if (!value || typeof value !== 'object' || active.has(value)) return false;
-			const array = Array.isArray(value), proto = Object.getPrototypeOf(value);
-			if (!array && proto !== null && (Object.getPrototypeOf(proto) !== null ||
-				Object.getOwnPropertyDescriptor(proto, 'constructor')?.value?.name !== 'Object')) return false;
-			const keys = Reflect.ownKeys(value);
-			if (array && keys.length !== value.length + 1) return false;
-			active.add(value); pending.push([value, true]);
-			for (const key of keys) {
-				if (array && key === 'length') continue;
-				if (typeof key !== 'string' || ['__proto__', 'constructor', 'prototype'].includes(key) ||
-					(array && (!Number.isSafeInteger(Number(key)) || Number(key) < 0 || Number(key) >= value.length || String(Number(key)) !== key))) return false;
-				const field = Object.getOwnPropertyDescriptor(value, key);
-				if (!field || !Object.hasOwn(field, 'value') || !field.enumerable) return false;
-				pending.push([field.value, false]);
-			}
-		}
-		return true;
-	} catch (_) { return false; }
+	const active = new Set();
+	const walk = (value, depth) => {
+		if (scalar(value)) return;
+		const {descriptors, keys} = fields(value, depth, active, false);
+		active.add(value);
+		for (const key of keys) walk(descriptors[key].value, depth + 1);
+		active.delete(value);
+	};
+	try { walk(record, 0); return true; } catch (_) { return false; }
 }
 
 const _rapierMetadataValue = (key, value) => key === 'filename'
@@ -156,9 +140,16 @@ function _rapierRecordSplices(entry, ledger) {
 }
 
 // Source identifies a retained checkpoint even when host revision numbers differ.
+// The History Slider compares now → earlier: that answer is the earlier → now walk, inverted.
 function journalOperations(before, after, journal) {
 	if (typeof before !== 'string' || typeof after !== 'string' || !Array.isArray(journal)) return;
 	if (before === after) return [];
+	const forward = journalWalk(before, after, journal);
+	if (forward) return forward;
+	return journalWalk(after, before, journal)?.reverse().map(({pos, removed, inserted}) => ({pos, removed: inserted, inserted: removed}));
+}
+
+function journalWalk(before, after, journal) {
 	try {
 		let text = after;
 		const lookup = _rapierRecordIndex(journal), groups = [];
@@ -480,8 +471,7 @@ const _rapierPrepareHistoryRecords = (() => {
 			// input later cannot retroactively certify an earlier view of its properties.
 			frame.frozen = frame.immutable = Object.isFrozen(value);
 			const array = Array.isArray(value), proto = Object.getPrototypeOf(value);
-			if (!array && proto !== null && (Object.getPrototypeOf(proto) !== null ||
-				Object.getOwnPropertyDescriptor(Object.getOwnPropertyDescriptor(proto, 'constructor')?.value || {}, 'name')?.value !== 'Object')) throw Error('history_data');
+			if (!array && !plainPrototype(proto)) throw Error('history_data');
 			const descriptors = Object.getOwnPropertyDescriptors(value), keys = Reflect.ownKeys(descriptors);
 			if (array && keys.length !== descriptors.length.value + 1) throw Error('history_data');
 			for (const key of keys) {
@@ -588,7 +578,12 @@ function _rapierCheckLedgerRecord(record, prior, documentAuthority, maxDocumentB
 		const own = Array.isArray(record.splices), navigation = !!(record.transaction?.reverts || record.transaction?.reapplies);
 		if ((!own && !navigation) || (own && record.splices.length > 64) ||
 			(record.transaction?.reverts && record.transaction?.reapplies)) return false;
-		if (metadata === undefined || (!splices?.length && !Object.values(metadata || {}).some(pair => pair.before !== pair.after) && !semantic) ||
+		const metadataChanged = Object.values(metadata || {}).some(pair => pair.before !== pair.after);
+		// An identical concurrent replacement keeps its authored rows and an empty
+		// physical splice. The origin proof, not this gate, shows the effect is already present.
+		const coincidentWitness = !splices?.length && record.beforeHash === record.afterHash &&
+			record.authored && _rapierValidAuthored(record.authored) && record.authored.splices.some(row => row.removed.length);
+		if (metadata === undefined || (!splices?.length && !metadataChanged && !semantic && !coincidentWitness) ||
 			(record.beforeHash === record.afterHash && splices?.length) ||
 			(record.beforeHash !== record.afterHash && !splices?.length) ||
 			((record.transaction?.sourceTransactionId || record.transaction?.sourceTransactionIds?.length || navigation) && !semantic)) return false;

package/dist/ledger/transport.mjs

@@ -2,6 +2,7 @@
 // Paired source placement, shared by live editing and canonical-history proof.
 import {_rapierTransformSplices, _rapierValidAuthored, _rapierHistoryEffects} from './journal-records.mjs';
 import {projectInverseSource} from './inverse-source.mjs';
+import {authoredBasis, authoredPlacement, authoredPlacements} from './authored-origin.mjs';
 import {sha256} from './hash.mjs';
 import {canonicalJSON} from './data.mjs';
 
@@ -74,6 +75,18 @@ export function transposeRecord(base, splices, id, records) {
     if (next === null) throw new RangeError('canonical_transport_invalid');
     current = next;
   }
+  // A concurrent act that already removed these same authored units and wrote the
+  // same replacement is one physical edit. This act stays in history with no second
+  // deletion. Pure insertions are never collapsed: each one is its own unit. An
+  // inverse of that act means the replacement is not still in force.
+  const sameRows = (left, right) => left.length === right.length && left.every((row, index) =>
+    row.pos === right[index].pos && row.removed === right[index].removed && row.inserted === right[index].inserted);
+  const matched = crossed.filter(record => sameRows(record.splices, splices));
+  const targetsOf = record => record.transaction.sourceTransactionIds || (record.transaction.sourceTransactionId ? [record.transaction.sourceTransactionId] : []);
+  const withdrawn = matched.some(record => crossed.some(other => targetsOf(other).includes(record.transaction.id) ||
+    other.transaction.reverts === record.transaction.id || other.transaction.reapplies === record.transaction.id));
+  if (splices.some(row => row.removed.length) && matched.length && !withdrawn)
+    return {splices: [], sourceIndices: [], against: crossed, text: current};
   const moved = [], sourceIndices = [];
   for (const [sourceIndex, row] of splices.entries()) {
     const submitted = _rapierTransformSplices(source, [row]);
@@ -120,49 +133,7 @@ export function transposeSource(base, splices, client, log) {
   return transposeRecord(base, splices, client, records);
 }
 
-// The frontier names only causal maxima. Linear history needs one predecessor,
-// and concurrent predecessors remain separate until an act observes both.
-function authoredFrontier(records, visit = null) {
-  const dependencies = new Map(), frontier = new Set();
-  for (const record of records) {
-    const id = record.transaction.id, basis = record.authored?.basis;
-    if (visit) visit(record, basis ?? [...frontier].sort());
-    if (!basis) { dependencies.set(id, [...frontier]); frontier.clear(); }
-    else {
-      const pending = [...basis], seen = new Set();
-      while (pending.length) {
-        const prior = pending.pop();
-        if (seen.has(prior)) continue;
-        if (!dependencies.has(prior)) throw new RangeError('canonical_origin_invalid');
-        seen.add(prior); frontier.delete(prior); pending.push(...dependencies.get(prior));
-      }
-      dependencies.set(id, basis);
-    }
-    frontier.add(id);
-  }
-  return [...frontier].sort();
-}
-
-export function authoredBasis(records) { return authoredFrontier(records); }
-
-export function authoredPlacements(base, records) {
-  const origins = new Map(); let source = base;
-  authoredFrontier(records, (record, basis) => {
-    origins.set(record.transaction.id, record.authored ?? authoredPlacement(source, record.splices, basis));
-    source = _rapierTransformSplices(source, record.splices);
-    if (source === null) throw new RangeError('canonical_origin_invalid');
-  });
-  return origins;
-}
-
-// Immutable authored placement stays on its own act. Basis IDs refer only to this
-// canonical history; no source snapshot or duplicate history is stored.
-export function authoredPlacement(source, splices, basis) {
-  const origin = {basis: basis.slice().sort(), source: sha256(source), splices: splices.map(row => ({...row}))};
-  if (!_rapierValidAuthored(origin) || _rapierTransformSplices(source, splices) === null)
-    throw new RangeError('canonical_origin_invalid');
-  return origin;
-}
+export {authoredBasis, authoredPlacement, authoredPlacements};
 
 // Reconstruct an authored view from the same records, then prove its exact physical
 // placement. Equality of resulting text alone cannot prove a repeated-text anchor.
@@ -233,6 +204,19 @@ function authoredReplay(base, records, append = null) {
       if (source === null) throw new RangeError('canonical_origin_invalid');
     }
   }
+  const coverKey = origin => origin?.splices.some(row => row.removed.length)
+    ? canonicalJSON({basis: origin.basis, splices: origin.splices}) : null;
+  const coverCounts = new Map();
+  for (const [id, origin] of origins) {
+    if (effects.references.get(id)?.length) continue;
+    const key = coverKey(origin);
+    if (key) coverCounts.set(key, (coverCounts.get(key) || 0) + 1);
+  }
+  // Two inverses can name different acts and still withdraw one physical replacement.
+  const sharesCover = id => (effects.references.get(id) || []).some(ref => {
+    const key = coverKey(origins.get(ref));
+    return !!key && coverCounts.get(key) > 1;
+  });
   const ordered = (ids, selected = null) => {
     const order = [], known = new Set(ids), waiting = new Map(), dependents = new Map(), ready = [];
     const rank = id => selected ? Number(selected.has(id)) : Number(origins.get(id).splices.some(row => row.removed.length));
@@ -351,10 +335,11 @@ function authoredReplay(base, records, append = null) {
       if (aligned.text !== text) throw new RangeError('canonical_origin_invalid');
       const crossed = aligned.records.slice(basisOrder.length);
       let moved;
-      if (sharedInverses && effects.references.get(id)?.length) {
+      if (effects.references.get(id)?.length && (sharedInverses || sharesCover(id))) {
         // Each inverse retains its own targets. First prove the exact intention
         // in its causal source, then place that choice in the accepted effect
-        // graph. Another inverse may already suppress the same original bytes.
+        // graph. Another inverse may already suppress the same original bytes,
+        // including when the two inverses name different authors of one replacement.
         const authored = projectInverse(basis.text, basis.records, id);
         if (!same(origin.splices, authored.splices) ||
             _rapierTransformSplices(basis.text, origin.splices) !== authored.after)

package/dist/page.mjs

@@ -12,10 +12,13 @@ const USAGE = 'usage: rapier-html <document.md> [out.html] [--view draw|notes] [
 	'  --drawing   carries an SVG drawing alongside the document, opened on Draw as the page boots\n' +
 	'  --compare   carries the original text; the page opens showing its diff from the current document\n' +
 	'  --by        with --compare: the name shown on the diff with the time the page was made\n' +
-	'  --return    carries a one-use return URL from document.create_return; Share offers Send back\n' +
+	'  --return    carries a one-use return URL from show {target:"return"}; Share offers Send back\n' +
 	'  --return-expires-at  carries the same mint\'s expiry; Share offers Save once the return expires\n' +
 	'  --          everything after it is a filename, even one that starts with a dash\n' +
 	'  --help      this text';
+// Damaged UTF-8 is refused, never carried as U+FFFD; a BOM is carried.
+const text = async path => { try { return new TextDecoder('utf-8', {fatal: true, ignoreBOM: true}).decode(await readFile(path)); } catch (error) { throw error.code === 'ERR_ENCODING_INVALID_ENCODED_DATA' ? new Error(path + ' is not valid UTF-8') : error; } };
+
 export async function main(argv, pagesDir, {log = console.log} = {}) {
 	const names = [];
 	let drawingPath = null, basePath = null, by = null, view = null, address = null, expiry = null, onlyNames = false;
@@ -41,7 +44,7 @@ export async function main(argv, pagesDir, {log = console.log} = {}) {
 			address = returnAddress(argv[++i]);
 		}
 		else if (arg === '--return-expires-at') {
-			if (expiry !== null || !argv[i + 1] || argv[i + 1].startsWith('-')) throw new Error('--return-expires-at takes one ISO timestamp from document.create_return');
+			if (expiry !== null || !argv[i + 1] || argv[i + 1].startsWith('-')) throw new Error('--return-expires-at takes one ISO timestamp from show {target:"return"}');
 			expiry = returnExpiresAt(argv[++i]);
 		}
 		else if (arg !== '--drawing') throw new Error('unknown option ' + arg + '\n' + USAGE);
@@ -50,22 +53,22 @@ export async function main(argv, pagesDir, {log = console.log} = {}) {
 	}
 	if (names.length < 1 || names.length > 2) throw new Error(USAGE);
 	const [input, named] = names;
-	const text = await readFile(input, 'utf8');
+	const source = await text(input);
 	const page = await readFile(join(pagesDir, 'rapier.html'), 'utf8');
 	const name = basename(input);
 	const out = named || join(dirname(input), name.replace(/\.(md|markdown|txt)$/i, '') + '.rapier.html');
 	const wrapOptions = {};
-	if (drawingPath) { wrapOptions.drawing = await readFile(drawingPath, 'utf8'); wrapOptions.drawingName = basename(drawingPath); }
+	if (drawingPath) { wrapOptions.drawing = await text(drawingPath); wrapOptions.drawingName = basename(drawingPath); }
 	if (by !== null && !basePath) throw new Error('--by labels a comparison: give its --compare file');
-	if (basePath) { wrapOptions.base = await readFile(basePath, 'utf8'); wrapOptions.baseName = basename(basePath); wrapOptions.at = new Date().toISOString(); }
+	if (basePath) { wrapOptions.base = await text(basePath); wrapOptions.baseName = basename(basePath); wrapOptions.at = new Date().toISOString(); }
 	if (by !== null) { wrapOptions.by = by; wrapOptions.at = new Date().toISOString(); }
 	if (view) wrapOptions.view = view;
 	if (address) wrapOptions.return = address;
 	if (expiry) wrapOptions.return_expires_at = expiry;
 	// Always a new file; 'wx' refuses any existing path, links included.
-	try { await writeFile(out, wrap(page, text, name, wrapOptions), {flag: 'wx'}); }
+	try { await writeFile(out, wrap(page, source, name, wrapOptions), {flag: 'wx'}); }
 	catch (error) { throw error.code === 'EEXIST' ? new Error(out + ' already exists, and rapier-html never overwrites a file: name a new one') : error; }
-	log(out + ' (' + name + ', ' + Buffer.byteLength(text) + ' bytes of document' +
+	log(out + ' (' + name + ', ' + Buffer.byteLength(source) + ' bytes of document' +
 		(view ? ', opens on ' + (view === 'draw' ? 'Draw' : 'Notes') : '') + (drawingPath ? ', ' + basename(drawingPath) + ' drawing' : '') + (basePath ? ', its diff from ' + basename(basePath) : '') + ')');
 	return out;
 }