rapier-html 1.2.3 → 1.2.6

package/BUILD.json

@@ -1,10 +1,10 @@
 {
   "package": "rapier-html",
-  "version": "1.2.3",
+  "version": "1.2.6",
   "path": "dist/rapier.html",
-  "bytes": 5086203,
-  "sha256": "864fe7a94b5c3064653e2a7423449f439c0ab864062ec1644a88dee90c042af6",
-  "builtAt": "2026-10-14T16:53:28.260Z",
+  "bytes": 4952859,
+  "sha256": "48b694df7db506a77f5a98e01098f37d54e7f9a88d6e5647ca09ea43578c3927",
+  "builtAt": "2026-10-16T12:09:12.607Z",
   "node": "v22.23.3",
   "canonical": true,
   "packing": "zopfli",
@@ -14,15 +14,15 @@
       "delivery": "built-in",
       "kind": "script",
       "element": "rapier-plugin-math",
-      "bytes": 749536,
-      "packedBytes": 504166,
+      "bytes": 691650,
+      "packedBytes": 438088,
       "files": [
         {
           "id": "rapier-math",
-          "name": "rapier-math-2.2.0.js",
-          "version": "2.2.0",
-          "bytes": 749536,
-          "sri": "pzYte7azbAoS8XSwIKjFg7mxGOxAxBKo9/IUy07H4j0WoyguAS/zwkR1O6kDXq9S"
+          "name": "rapier-math-2.4.0.js",
+          "version": "2.4.0",
+          "bytes": 691650,
+          "sri": "C92x26+pBI4q9FoWypMhBb8CqSGaaPLw8dpYigWiYNsYQRTcPVrFyPVjrhc/Tnwh"
         }
       ]
     },
@@ -31,8 +31,8 @@
       "delivery": "built-in",
       "kind": "files",
       "element": "rapier-plugin-mermaid",
-      "bytes": 7384142,
-      "packedBytes": 1563922,
+      "bytes": 7389640,
+      "packedBytes": 1526485,
       "files": [
         {
           "id": "rapier-mermaid-core",
@@ -43,10 +43,10 @@
         },
         {
           "id": "rapier-mermaid-zenuml",
-          "name": "rapier-zenuml-4.5.0-1.js",
-          "version": "4.5.0-1",
-          "bytes": 1890966,
-          "sri": "MVn/Or1nIHTDvy84lSSJAH2Fx1Y7AGoaMfd7hW7i3LJe7M/dau8VDFnF8Q+X0qOl"
+          "name": "rapier-zenuml-4.5.0-2.js",
+          "version": "4.5.0-2",
+          "bytes": 1896464,
+          "sri": "8Ptjhh1zNTOvy1dxFHhXgYKfs290DSlpzow5rF9FvP38cohtbsBW381Whym1WI6E"
         }
       ]
     },
@@ -56,7 +56,7 @@
       "kind": "files",
       "element": "rapier-plugin-letters",
       "bytes": 463027,
-      "packedBytes": 204178,
+      "packedBytes": 198962,
       "files": [
         {
           "id": "rapier-letters-field",
@@ -94,7 +94,7 @@
       "kind": "files",
       "element": "rapier-plugin-font-subset",
       "bytes": 1214356,
-      "packedBytes": 453061,
+      "packedBytes": 441192,
       "files": [
         {
           "id": "rapier-font-subset",

package/README.md

@@ -1,79 +1,62 @@
 # rapier-html
 
-Turn Markdown into one offline HTML file with the full Rapier editor. It opens in any browser on a phone or
-computer, with no account. People read, edit, draw and paint watercolor. Agents deliver documents, show what
-changed and receive the person's edited copy through the door. Start with `npx rapier-html@1.2.3 notes.md`.
+Turn Markdown into one offline HTML file that contains the full Rapier editor. It opens in any browser, on a phone or
+computer, with no account. People read, edit, draw and paint; agents hand over documents, show what changed and get
+the edited copy back. Start with `npx rapier-html@1.2.6 notes.md`.
 
-Use it for a plan to rearrange, an illustrated guide to annotate, a draft to continue writing, or a revision
-to review. Text and drawings stay editable, and the file remains usable independently of a hosted workspace.
+Use it for a plan to rearrange, a guide to annotate, a draft to keep writing, or a revision to review. The file works
+without any hosted workspace.
 
-- The page writes, draws and paints, saves Markdown, exports Word, PDF and a web page, and prints, with no account
-  and nothing fetched to open, edit or save.
-- `--return` adds a one-use Send back address from the agent door: the person edits offline, presses Send back,
-  and the agent reads the returned copy.
-- `--view draw` opens on Draw; `--compare original.md` opens the edited document showing what changed;
-  `--by <name>` attributes the comparison with the time the page was made.
-- `wrap` and `unwrap` carry a document into a page and out again, exactly, for programs.
+- The page writes, draws and paints, saves Markdown, exports Word, PDF and a web page, and prints. It needs no account
+  and fetches nothing to open, edit or save.
+- `--return` adds a one-use Send back address from the agent door.
+- `--view draw` opens on Draw. `--compare original.md` opens the edit with its diff; `--by <name>` attributes it.
+- `wrap` and `unwrap` move a document into a page and back out, exactly.
 
-Node 22 or newer.
+Needs Node 22 or newer.
 
 ```sh
-npx -- rapier-html@1.2.3 notes.md                          # the editor, notes.md inside it, written beside the file
-npx -- rapier-html@1.2.3 notes.md --view draw              # opens on Draw: sketch and paint, the document behind it
-npx -- rapier-html@1.2.3 notes.md --view notes             # opens the Notes library
-npx -- rapier-html@1.2.3 notes.md --drawing sketch.svg     # carries a drawing, opened on Draw over the document
-npx -- rapier-html@1.2.3 revised.md --compare original.md # opens showing what changed
-npx -- rapier-html@1.2.3 notes.md --return "$RETURN_URL" --return-expires-at "$RETURN_EXPIRES_AT" # Send back
-npx -- rapier-html@1.2.3 notes.md out.html                 # a named output
-npm install rapier-html@1.2.3                              # as a library: wrap, unwrap
+npx -- rapier-html@1.2.6 notes.md                          # the editor, notes.md inside it, written beside the file
+npx -- rapier-html@1.2.6 notes.md --view draw              # opens on Draw: sketch and paint, the document behind it
+npx -- rapier-html@1.2.6 notes.md --view notes             # opens the Notes library
+npx -- rapier-html@1.2.6 notes.md --drawing sketch.svg     # carries a drawing, opened on Draw over the document
+npx -- rapier-html@1.2.6 revised.md --compare original.md # opens showing what changed
+npx -- rapier-html@1.2.6 notes.md --return "$RETURN_URL" --return-expires-at "$RETURN_EXPIRES_AT" # Send back
+npx -- rapier-html@1.2.6 notes.md out.html                 # a named output
+npm install rapier-html@1.2.6                              # as a library: wrap, unwrap
 ```
 
 The first `--` is for npm, so `--help` reaches the command. It never overwrites a file.
 
-For live shared editing, open the document through Rapier's MCP tools. The agent edits beside the person or
-while they are away. Rapier shows its presence and change marks; the person taps a change to see the before
-and undoes anything. Use `show {target:"comparison"}` to show a diff deliberately. Export Markdown or an offline
-editor when the result needs an independent copy. Send back returns the edited copy alongside the hosted
-document, preserving both.
-
-Will markers in the Markdown control agent edits: `keep`, `append`, `edit`.
+Will markers in the Markdown (`keep`, `append`, `edit`) control what agents may change.
 
 ## Choose a Rapier workflow
 
-Rapier is a phone-first Markdown editor for notes, diagrams, drawing and watercolor painting. It runs offline
-as one HTML file on Android, Web and Windows.
-Collaborate over MCP and WebMCP, use optional encrypted sync to your own Cloudflare account, or embed the
-editor and lightweight reader (about 190 kB gzipped). The agent edits live; the person sees its presence and
-changes, taps a change to see the before and undoes anything. Use `show {target:"comparison"}` to show a diff deliberately.
-
 1. **Work together live.** Connect to `https://mcp.rapier.website/door/mcp`, then call `open` to share one document with the person.
-2. **Deliver an offline editor.** Run `npx rapier-html@1.2.3 notes.md` to put the document and editor in one HTML file ([rapier-html](https://github.com/jackskip22/rapier-plugins/tree/main/npm/rapier-html)).
-3. **Embed in your app.** Install [rapier-embed](https://github.com/jackskip22/rapier-plugins/tree/main/npm/rapier-embed); mount the editor or reader, with your app's agent over WebMCP in the editor.
-4. **Keep portable Markdown.** Use [rapier-markdown-kit](https://github.com/jackskip22/rapier-plugins/tree/main/npm/rapier-markdown-kit) for pictures, editable SVG drawings and layout in one `.md` file. Respect [Will/1](https://github.com/jackskip22/will) `keep`, `append` and `edit` regions.
-5. **Encode JPEG XL.** Install [rapier-jxl](https://github.com/jackskip22/rapier-jxl) to encode pixels, photographs and existing JPEGs in JavaScript.
-6. **Host the door.** Run [rapier-server](https://github.com/jackskip22/rapier/tree/main/server) over your own folder or S3-compatible bucket.
+2. **Hand over an offline editor.** Use this package.
+3. **Embed the editor.** [rapier-embed](https://github.com/jackskip22/rapier-plugins/tree/main/npm/rapier-embed)
+   mounts the editor or reader in your app.
+4. **Keep portable Markdown.** [rapier-markdown-kit](https://github.com/jackskip22/rapier-plugins/tree/main/npm/rapier-markdown-kit)
+   keeps pictures, drawings and layout in one `.md` file.
 
 ## Send an edited document back
 
-Call `show {target:"return"}` on the Rapier agent door for the document's workspace and pass its `return_url`
-and `return_expires_at` as `--return "$RETURN_URL" --return-expires-at "$RETURN_EXPIRES_AT"`, or
-`wrap(..., {return: return_url, return_expires_at})`. Only the worker's HTTPS return route at
-`https://mcp.rapier.website/return/…` is accepted. The page then shows Send back in Share; a page without an
-address has no such action.
-
-The person edits offline and presses Send back: the current source and filename go once, the page shows the
-acceptance or the worker's refusal, and it sends nothing again. The return lasts up to one day, takes one
-document with a 64 MiB decoded-source ceiling, subject to the workspace’s remaining storage quota, and grants no
-access to the agent's workspace. After the expiry, or a refusal, Share offers
-Save instead; bring that file back to the assistant for a fresh return.
+1. Call `show {target:"return"}` on the Rapier agent door for the document's workspace.
+2. Pass its `return_url` and `return_expires_at` as `--return "$RETURN_URL" --return-expires-at "$RETURN_EXPIRES_AT"`,
+   or `wrap(..., {return: return_url, return_expires_at})`. Only `https://mcp.rapier.website/return/…` is accepted.
+   Share then shows Send back; a page without an address doesn't.
+3. The person edits offline and taps Send back. The source and filename go once; the page shows acceptance or
+   refusal and never sends again.
+4. `show {target:"ask",wait:"message"}` returns a `returned` receipt with the `return_id`, name and time, and
+   `read {state:true}` lists receipts. Read the source with `read {return_id}`, then `cursor` alone until complete.
 
-`show {target:"ask",wait:"message"}` returns a `returned` receipt with the `return_id`, name and time;
-`read {state:true}` lists returned-copy receipts. Use `read {return_id}` for the source, then `cursor`
-alone to continue until complete. The returned copy stays separate from the workspace's current document.
+A return lasts up to one day and takes one document of up to 64 MiB of decoded source, within the workspace's
+remaining storage. It grants no access to the workspace, and the returned copy stays separate from the workspace's
+current document. After expiry or a refusal, Share offers Save instead; bring that file back for a fresh return.
 
 ## As a library
 
-Save this as `example.mjs` in the folder you installed into and run `node example.mjs`:
+Save this as `example.mjs` in the folder you installed into, then run `node example.mjs`:
 
 ```js
 import {readFile, writeFile} from 'node:fs/promises';
@@ -86,50 +69,47 @@ console.log('words back exactly:', unwrap(page).text === words);
 await writeFile('hello.rapier.html', page, {flag: 'wx'});        // 'wx': never over an existing file
 ```
 
-`wrap(rapierHtml, text, name, {view, drawing, drawingName, base, baseName, by, at, return: returnURL, return_expires_at})`
-and `unwrap(pageHtml)`, which returns the same fields plus the validated `comparisonBase` record, with `null`
-for what a page does not carry. Also exported:
-`encodeCarried`, `decodeCarried`, `main`.
+- `wrap(rapierHtml, text, name, {view, drawing, drawingName, base, baseName, by, at, return: returnURL, return_expires_at})`
+- `unwrap(pageHtml)` returns the same fields, plus the validated `comparisonBase` record, with `null` for anything the
+  page doesn't carry.
+- Also exported: `encodeCarried`, `decodeCarried` and `main`.
 
 ## How the page carries the document
 
-One `<script type="text/markdown" id="rapier-document">` block at the top of the body, never executed,
-read once at boot. A drawing rides in `id="rapier-drawing"`, the original text for comparison in
-`id="rapier-base"`, the view to open on in the document block's `data-view`, the optional return URL
-in `data-return` and its exact expiry in `data-return-expires-at`. The block holds no `<`
-before `/` or `!`, no carriage return and no NUL: `\\`, `\/`, `\!`, `\r` and `\0` stand for them, one
-reversible pass each way, so a note about HTML is as safe as any other. A byte-order mark is kept as a
-fact of the file and written back on Save.
-
-`comparisonBase` contains the original `text`, `sha256`, `revision`, `name`, `by` and `at`. Rewrapping retains
-its original text, hash and revision; a baseline equal to the current text is omitted. It is a display
-reference, never a write grant or a history record. The edited document remains the source used by Save and
-Send back.
+- One `<script type="text/markdown" id="rapier-document">` block at the top of the body, never run, read once at
+  start-up.
+- A drawing goes in `id="rapier-drawing"` and the comparison original in `id="rapier-base"`. The document block's
+  `data-view` names the opening view, `data-return` the return URL, and `data-return-expires-at` its expiry.
+- The block holds no `<` before `/` or `!`, no carriage return and no NUL: `\\`, `\/`, `\!`, `\r` and `\0` stand for
+  them, one reversible pass each way. A byte-order mark is kept and written back on Save.
+- `comparisonBase` holds the original `text`, `sha256`, `revision`, `name`, `by` and `at`. Rewrapping keeps the
+  original text, hash and revision; a baseline equal to the current text is left out. It is for display only, never a
+  write grant or history. Save and Send back use the edited document.
 
 ## Safety
 
-- It never overwrites: an existing output, the document itself included, is refused, as are unknown options, a
-  `--view` other than `draw` or `notes`, a `--drawing` or `--compare` with no file, a return without its expiry, an
+- It never overwrites: an existing output, including the document itself, is refused. So are unknown options, a
+  `--view` other than `draw` or `notes`, `--drawing` or `--compare` without a file, a return without its expiry, an
   invalid expiry, an unsafe return URL and a third filename.
-- Opening and rendering use carried resources; the page cannot fetch pictures, media, fonts or plug-ins.
-  The staged editor includes verified math, Mermaid and lettering resources. Embed any document pictures.
-  An explicit Send back connects only to the minted return origin. Its URL names the worker's exact route;
-  credentials, query strings and fragments are refused.
+- The page opens and renders from what it carries; it can't fetch pictures, media, fonts or plugins. The editor
+  includes verified math, Mermaid and lettering resources. Embed any document pictures.
+- Send back connects only to the return origin it was given. Credentials, query strings and fragments in the return
+  URL are refused.
 
 ## Optional edit history
 
-`wrap(page, text, filename, {ledger, authorship})` accepts the public kit's
-`rapier-ledger/1` and `rapier-authorship/1` objects. `unwrap(page)` returns the
-checked parts beside its text. Neither is on by default. An authorship projection
-contains only attribution of current characters; a full ledger contains deleted
-text too. A wrong-text, malformed, duplicate or inconsistent part throws instead
-of attaching false history. Saved Markdown written with the kit's
-`ledger/carried.writeDocument` is read automatically when wrapping. Rewrapping a
-page without parts drops its previous document's parts. Published npm files carry
-their own staged MIT validator closure; no source checkout is needed.
+`wrap(page, text, filename, {ledger, authorship})` accepts the kit's `rapier-ledger/2` and `rapier-authorship/1`
+objects, and `unwrap(page)` returns the checked parts beside the text. Both are off by default.
+
+- An authorship projection holds only who wrote the current characters; a full ledger also holds deleted text.
+- A part that doesn't match the text, or is malformed, duplicated or inconsistent, throws instead of attaching false
+  history.
+- Markdown saved with the kit's `ledger/carried.writeDocument` is read automatically when wrapping. Rewrapping a page
+  without parts drops the old parts.
+- The published package carries its own MIT validator; no source checkout is needed.
 
-## Licence
+## License
 
-AGPL-3.0-only (`LICENSE`): the page is the Rapier editor with the notices of the libraries it carries.
-The Markdown standard without the editor is `rapier-markdown-kit` (MIT). Rapier is https://rapier.website.
+AGPL-3.0-only (`LICENSE`): the page is the Rapier editor, with the notices of the libraries it carries. For the
+Markdown standard without the editor, use `rapier-markdown-kit` (MIT). Rapier is at https://rapier.website.
 `BUILD.json` records the page's size, SHA-256, build time and Node version.

package/dist/ledger/LICENSE

@@ -20,7 +20,7 @@ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 
-Files under this licence carry `SPDX-License-Identifier: MIT` in their first lines: the standard's
+Files under this license carry `SPDX-License-Identifier: MIT` in their first lines: the standard's
 grammar, marks and reference style (`spec/md-layout.mjs`, `spec/md-marks.mjs`, `spec/md-source.mjs`, `spec/flowchart.mjs`, `spec/markdown-style.css`), ink geometry
 (`spec/ink.mjs`),
 the layout model and line planner (`layout/model.mjs`, `layout/line-plan.mjs`, `layout/typography.mjs`, `layout/preparation.mjs`,
@@ -35,14 +35,15 @@ own MIT notices. The edit-ledger module (`kit/rapier-ledger.mjs`, `kit/ledger/*.
 its editor compatibility import (`editor/journal-records.mjs`) are also covered. The
 record validator/replayer and text-only conflict merger were moved, not copied,
 into that module; the Notes index merger and the rest of the agent/editor remain
-AGPL-3.0-only. The wrapper's carrier-staging helper
-(`skills/rapier-html/package-files.mjs`) is MIT. The kit's MIT-marked facades,
+AGPL-3.0-only. The page wrapper (`skills/rapier-html/wrap.mjs`, `skills/rapier-html/page.mjs`,
+`skills/rapier-html/return-address.mjs`) and its carrier-staging helper
+(`skills/rapier-html/package-files.mjs`) are MIT. The kit's MIT-marked facades,
 `kit/render-entry.mjs`, `kit/render*.mjs`, `kit/export-fonts.mjs`, `kit/print-capitals.mjs`,
 `kit/pdf-vectors.mjs`, `kit/pdf-glyphs.mjs`, `kit/stage.mjs` and MIT-marked conformance
 modules are covered too. These names describe the Rapier-owned files carrying the
 MIT notice, not a grant over the editor or third-party code. Other Rapier-owned
-files retain their stated licence; the editor is AGPL-3.0-only (see `LICENSE`).
-Third-party components retain their own copyright and licence notices.
+files retain their stated license; the editor is AGPL-3.0-only (see `LICENSE`).
+Third-party components retain their own copyright and license notices.
 
 The portable font helpers read document definitions and accept explicit host validation and
 subsetting functions. The application binding (`editor/export-fonts.mjs`), captured-font

package/dist/ledger/authored-origin.mjs

@@ -0,0 +1,49 @@
+// SPDX-License-Identifier: MIT
+// Immutable authored origins shared by causal transport and inverse projection.
+import {_rapierTransformSplices, _rapierValidAuthored} from './journal-records.mjs';
+import {sha256} from './hash.mjs';
+
+// The frontier names only causal maxima. Linear history needs one predecessor,
+// and concurrent predecessors remain separate until an act observes both.
+function authoredFrontier(records, visit = null) {
+  const dependencies = new Map(), frontier = new Set();
+  for (const record of records) {
+    const id = record.transaction.id, basis = record.authored?.basis;
+    if (visit) visit(record, basis ?? [...frontier].sort());
+    if (!basis) { dependencies.set(id, [...frontier]); frontier.clear(); }
+    else {
+      const pending = [...basis], seen = new Set();
+      while (pending.length) {
+        const prior = pending.pop();
+        if (seen.has(prior)) continue;
+        if (!dependencies.has(prior)) throw new RangeError('canonical_origin_invalid');
+        seen.add(prior); frontier.delete(prior); pending.push(...dependencies.get(prior));
+      }
+      dependencies.set(id, basis);
+    }
+    frontier.add(id);
+  }
+  return [...frontier].sort();
+}
+
+export function authoredBasis(records) { return authoredFrontier(records); }
+
+export function authoredPlacements(base, records) {
+  const origins = new Map(); let source = base;
+  authoredFrontier(records, (record, basis) => {
+    origins.set(record.transaction.id, record.authored ?? authoredPlacement(source, record.splices, basis));
+    source = _rapierTransformSplices(source, record.splices);
+    if (source === null) throw new RangeError('canonical_origin_invalid');
+  });
+  return origins;
+}
+
+// Immutable authored placement stays on its own act. Basis IDs refer only to this
+// canonical history; no source snapshot or duplicate history is stored.
+export function authoredPlacement(source, splices, basis) {
+  const origin = {basis: basis.slice().sort(), source: sha256(source), splices: splices.map(row => ({...row}))};
+  if (!_rapierValidAuthored(origin) || _rapierTransformSplices(source, splices) === null)
+    throw new RangeError('canonical_origin_invalid');
+  return origin;
+}
+

package/dist/ledger/authorship.mjs

@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: MIT
 import {readLedger, exportLedger, textRoot, rootAfter} from './format.mjs';
-import {_rapierTransformSplices} from './journal-records.mjs';
+import {_rapierTransformSplices, _rapierHistoryEffects} from './journal-records.mjs';
 import {sha256} from './hash.mjs';
 import {plainData, documentText, nonnegative, exactKeys, fault} from './data.mjs';
 function coalesce(runs) {
@@ -14,16 +14,25 @@ function coalesce(runs) {
   return out;
 }
 export function authorship(input) {
-  const {ledger, text} = readLedger(input);
+  const {ledger, text} = readLedger(input), references = _rapierHistoryEffects(ledger.records).references, removed = new Map();
   let runs = ledger.start.text ? [[0, ledger.start.text.length, 'system', 'unattributed', 0]] : [];
-  for (const record of ledger.records) for (const row of record.splices) {
-    const cut = row.pos + row.removed.length, delta = row.inserted.length - row.removed.length, before = [], after = [];
-    for (const run of runs) {
-      if (run[0] < row.pos) before.push([run[0], Math.min(run[1], row.pos), ...run.slice(2)]);
-      if (run[1] > cut) after.push([Math.max(run[0], cut) + delta, run[1] + delta, ...run.slice(2)]);
+  for (const record of ledger.records) {
+    // An Undo or Redo puts back text the act it references removed: that text keeps the runs it had.
+    const tx = record.transaction, gone = [], kept = (references?.get(tx.id) || []).flatMap(id => removed.get(id) || []);
+    for (const row of record.splices) {
+      const cut = row.pos + row.removed.length, delta = row.inserted.length - row.removed.length, before = [], after = [], inside = [];
+      for (const run of runs) {
+        if (run[0] < row.pos) before.push([run[0], Math.min(run[1], row.pos), ...run.slice(2)]);
+        if (run[1] > cut) after.push([Math.max(run[0], cut) + delta, run[1] + delta, ...run.slice(2)]);
+        if (run[0] < cut && run[1] > row.pos) inside.push([Math.max(run[0], row.pos) - row.pos, Math.min(run[1], cut) - row.pos, ...run.slice(2)]);
+      }
+      if (row.removed) gone.push({text: row.removed, runs: inside});
+      const at = row.inserted ? kept.findIndex(entry => entry.text === row.inserted) : -1;
+      const put = at < 0 ? [[row.pos, row.pos + row.inserted.length, tx.actor.kind, tx.actor.id, tx.createdAt]]
+        : kept.splice(at, 1)[0].runs.map(run => [run[0] + row.pos, run[1] + row.pos, ...run.slice(2)]);
+      runs = coalesce([...before, ...put, ...after]);
     }
-    const tx = record.transaction;
-    runs = coalesce([...before, [row.pos, row.pos + row.inserted.length, tx.actor.kind, tx.actor.id, tx.createdAt], ...after]);
+    removed.set(tx.id, gone);
   }
   return {format: 'rapier-authorship/1', sha256: sha256(text), runs};
 }

package/dist/ledger/data.mjs

@@ -1,10 +1,13 @@
 // SPDX-License-Identifier: MIT
 // Only plain JSON data enters the public format. Accessors and toJSON are never executed.
 export function fault(message) { return Object.assign(new Error('Ledger: ' + message), {code: 'ledger_invalid'}); }
-function fields(value, depth, active, sorted = true) {
+// A plain object's prototype is null or Object's own. Both lookups read descriptors, so no getter runs.
+export const plainPrototype = proto => proto === null || Object.getPrototypeOf(proto) === null &&
+  Object.getOwnPropertyDescriptor(Object.getOwnPropertyDescriptor(proto, 'constructor')?.value || {}, 'name')?.value === 'Object';
+export function fields(value, depth, active, sorted = true) {
   if (!value || typeof value !== 'object' || depth > 64 || active.has(value)) throw fault('not plain JSON data');
-  const array = Array.isArray(value), proto = Object.getPrototypeOf(value);
-  if (!array && proto !== null && (Object.getPrototypeOf(proto) !== null || Object.getOwnPropertyDescriptor(proto, 'constructor')?.value?.name !== 'Object')) throw fault('not a plain object');
+  const array = Array.isArray(value);
+  if (!array && !plainPrototype(Object.getPrototypeOf(value))) throw fault('not a plain object');
   const descriptors = Object.getOwnPropertyDescriptors(value), keys = Reflect.ownKeys(descriptors);
   for (const key of keys) {
     if (array && key === 'length') continue;
@@ -14,7 +17,7 @@ function fields(value, depth, active, sorted = true) {
   if (array && (keys.length !== value.length + 1 || keys.some(k => k !== 'length' && (!/^(0|[1-9]\d*)$/.test(k) || +k >= value.length)))) throw fault('sparse array');
   return {array, descriptors, keys: array ? keys.filter(key => key !== 'length') : sorted ? keys.sort() : keys};
 }
-function scalar(value) {
+export function scalar(value) {
   if (value === null || typeof value === 'boolean') return true;
   if (typeof value === 'string') { if (/[\uD800-\uDFFF]/u.test(value)) throw fault('unpaired surrogate'); return true; }
   return typeof value === 'number' && Number.isFinite(value) && !Object.is(value, -0);

package/dist/ledger/diff/concerns.mjs

@@ -0,0 +1,163 @@
+// SPDX-License-Identifier: MIT
+import {letter, within, prev, next} from './tokens.mjs';
+
+// Separator-only pieces join the edit beside them; adjacent blocks each carry their own line break.
+export function separate(c, endA = c.before.length, endB = c.after.length) {
+  const {before, after, safe, raw, spend} = c;
+  // A separator-only piece beside another edit joins it; equal separators at its ends stay unchanged.
+  if (!raw) for (let i = c.result.length - 1; i > 0; i--) {
+    const p = c.result[i - 1], q = c.result[i], side = p[0][0] === p[0][1] ? 1 : p[1][0] === p[1][1] ? 0 : -1, text = side ? after : before;
+    if (side >= 0 && !/\S/.test(text.slice(...p[side]))) {
+      let n = 0;
+      while (p[0][1] + n < q[0][0] && text[p[side][0] + n] === text[p[side][1] + n] && spend()) n++;
+      if (p[0][1] + n === q[0][0] && p.slice(0, 2).every((span, k) => safe(k ? after : before, span[0] + n) && safe(k ? after : before, span[1] + n)))
+        for (const span of p.slice(0, 2)) { span[0] += n; span[1] += n; }
+    }
+    if (p[2] || q[2] || p[0][1] !== q[0][0] || p[1][1] !== q[1][0] ||
+      ![p, q].some(r => !/\S/.test(before.slice(...r[0]) + after.slice(...r[1])))) continue;
+    const x = [p[0][0], q[0][1]], y = [p[1][0], q[1][1]], keep = /\S/.test(before.slice(...q[0]) + after.slice(...q[1])) ? q : p;
+    // CRLF steps as one separator.
+    for (let k; x[0] < x[1] && y[0] < y[1] && /\s/.test(before[x[1] - 1]) && before[x[1] - 1] === after[y[1] - 1] &&
+      (k = before.endsWith('\r\n', x[1]) && after.endsWith('\r\n', y[1]) ? 2 : 1) <= Math.min(x[1] - x[0], y[1] - y[0]) &&
+      safe(before, x[1] - k) && safe(after, y[1] - k);) { x[1] -= k; y[1] -= k; }
+    keep[3][0] = x[0] === x[1] ? 2 : y[0] === y[1] ? 0 : 1;
+    c.result.splice(i - 1, 2, [x, y, false, keep[3]]);
+  }
+  // Repeated closing lines can attach to the wrong block. Rotate an exact insertion/deletion to the
+  // next blank-line boundary, without crossing another edit or splitting a character.
+  if (!raw) for (let i = 0; i < c.result.length; i++) {
+    const p = c.result[i], q = c.result[i + 1], side = p[0][0] === p[0][1] ? 1 : p[1][0] === p[1][1] ? 0 : -1;
+    if (side < 0 || p[2]) continue;
+    const text = side ? after : before;
+    const room = Math.min((q?.[0][0] ?? endA) - p[0][1], (q?.[1][0] ?? endB) - p[1][1]);
+    let n = 0, shift = 0;
+    while (n < room && text[p[side][0] + n] === text[p[side][1] + n] && spend()) {
+      n++;
+      if (text[p[side][0] + n - 1] === '\n' && /^\r?\n/.test(text.slice(p[side][0] + n))) { shift = n; break; }
+    }
+    if (shift && p.slice(0, 2).every((span, k) => safe(k ? after : before, span[0] + shift) && safe(k ? after : before, span[1] + shift)))
+      for (const span of p.slice(0, 2)) { span[0] += shift; span[1] += shift; }
+  }
+  // Adjacent blocks deleted or inserted together: when the first carries the line break before it, each carries
+  // its own, so any one restores apart from its neighbors.
+  if (!raw) for (let i = 1; i < c.result.length; i++) {
+    const p = c.result[i - 1], q = c.result[i], kind = p[3][0], side = kind ? 1 : 0, text = side ? after : before;
+    if (kind % 2 || q[3][0] !== kind || p[2] || q[2] || p[side][1] !== q[side][0] || p[1 - side][0] !== q[1 - side][0]) continue;
+    const blank = /^\r?\n/.test(text.slice(...p[side])) && !/^\r?\n/.test(text.slice(...q[side])) && /(\r?\n)(?:[ \t]*\r?\n)+$/.exec(text.slice(...p[side]));
+    if (blank && blank.index > 0) p[side][1] = q[side][0] -= blank[0].length - blank[1].length;
+  }
+}
+
+// Refine the outer walk and each move's inner walk before assigning transport ownership.
+export function phrases(c) {
+  const {before, after, raw, code} = c;
+  // Whole-word replacements separated only by spaces read and restore as one phrase, and one number stays one number.
+  if (!raw) for (let i = c.result.length - 1; i > 0; i--) {
+    const p = c.result[i - 1], q = c.result[i], gap = before.slice(p[0][1], q[0][0]);
+    if (p[3][0] !== 1 || q[3][0] !== 1 || p[3][3] || q[3][3] || p[2] || q[2] || gap !== after.slice(p[1][1], q[1][0])) continue;
+    // A time, a date, a version or a decimal is one number.
+    const number = /^(?:[.,:/-]\d*)+$/.test(gap) && /\d/.test(before[p[0][1] - 1] + after[p[1][1] - 1]) && /\d/.test(before[q[0][0]] + after[q[1][0]]);
+    if (!number && (code || !/^[^\S\r\n]+$/.test(gap) || within(before, p[0][0]) || within(after, p[1][0]) ||
+      within(before, q[0][1]) || within(after, q[1][1]))) continue;
+    p[0][1] = q[0][1]; p[1][1] = q[1][1]; c.result.splice(i, 1);
+  }
+  // Paired inline markers added or removed around unchanged text on one line are one concern.
+  if (!raw && !code) for (let i = 1; i < c.result.length; i++) {
+    const p = c.result[i - 1], q = c.result[i], kind = p[3][0], side = kind ? 1 : 0, text = side ? after : before;
+    if (kind % 2 || kind !== q[3][0] || p[2] || q[2] || p[3][3] || q[3][3]) continue;
+    const open = text.slice(...p[side]), close = text.slice(...q[side]), inner = text.slice(p[side][1], q[side][0]);
+    if (!inner.trim() || inner.includes('\n') || !(open === close && /^(?:[*_]{1,3}|~~|==|`+)$/.test(open) ||
+      open === '[' && /^\]\([^\s()]*\)$/.test(close))) continue;
+    p[3] = q[3] = [kind, 'word', p[3][2], [[p[0][0], q[0][1]], [p[1][0], q[1][1]]]];
+  }
+}
+
+// Readable concerns: phrases, numbers and paired markers, then the public edits and changes with context.
+export function concerns(c) {
+  phrases(c);
+  const {before, after, spend, safe, budget, raw, code, evidence, structures, initial, options, pa, pb} = c, lb = c.lb;
+  const overlaps = (a, b) => a[0] < b[1] && a[1] > b[0];
+  // Siblings are ordered and disjoint: the parts holding a range are found by descent, outermost first.
+  const containing = (parts, from, to, out = []) => {
+    let lo = 0, hi = parts.length;
+    while (lo < hi) { const mid = lo + hi >>> 1; if (parts[mid].end < to) lo = mid + 1; else hi = mid; }
+    for (let k = lo; k < parts.length && parts[k].start <= from && spend(); k++)
+      if (parts[k].end >= to) { out.push(parts[k]); containing(parts[k].children, from, to, out); }
+    return out;
+  };
+  // Edits are ordered and disjoint on the after side.
+  const touched = (edits, range) => {
+    let lo = 0, hi = edits.length;
+    while (lo < hi) { const mid = lo + hi >>> 1; if (edits[mid].after[1] <= range[0]) lo = mid + 1; else hi = mid; }
+    return lo < edits.length && overlaps(range, edits[lo].after);
+  };
+  const changes = [], edits = [];
+  let normalized;
+  const meaning = structures?.[0]?.meaning;
+  const format = typeof meaning === 'string' && meaning === structures[1].meaning;
+  for (let i = 0; i < c.result.length; i++) {
+    const item = c.result[i];
+    if (raw === 'char' && !evidence) {
+      const a = item[0], b = item[1], next = c.result[i + 1];
+      if (item[3][0] !== 1) {
+        const room = Math.min((next?.[0][0] ?? before.length) - a[1], (next?.[1][0] ?? after.length) - b[1]);
+        let n = 0;
+        while (n < room && before[a[0] + n] === after[b[0] + n] && spend()) n++;
+        while (n && (!safe(before, a[0] + n) || !safe(before, a[1] + n) || !safe(after, b[0] + n) || !safe(after, b[1] + n))) n--;
+        a[0] += n; a[1] += n; b[0] += n; b[1] += n;
+      }
+      const p = normalized;
+      if (p && p[0][0] === p[0][1] && item[3][0] === 2 && p[0][0] === a[0] && p[1][1] === b[0]) {
+        p[1][1] = b[1]; if (item[2]) edits.at(-1).coarse = true; continue;
+      }
+      normalized = item;
+    }
+    const group = item[3];
+    if (!raw && !group[3]) group[3] = [[...item[0]], [...item[1]]];
+    if (!group[4]) {
+      const context = group[3];
+      // Context completes a word only where an edge falls inside it.
+      if (!raw) for (const [text, span] of [[before, context[0]], [after, context[1]]]) {
+        const start = within(text, span[0]), end = within(text, span[1]);
+        for (let c; start && letter(c = prev(text, span[0])) && spend() && safe(text, span[0] - c.length);) span[0] -= c.length;
+        for (let c; end && letter(c = next(text, span[1])) && spend() && safe(text, span[1] + c.length);) span[1] += c.length;
+      }
+      group[4] = []; changes.push(group);
+      if (format) group[0] = 5;
+    }
+    group[4].push(edits.length);
+    edits.push({before: item[0], after: item[1], ...(item[2] ? {coarse: true} : {})});
+  }
+  if (structures && !raw && budget.left >= 0) {
+    const oldNames = new Set(pa.filter(p => p.nameAt).map(p => p.name)), newNames = new Set(pb.filter(p => p.nameAt).map(p => p.name));
+    const linksTo = new Map();
+    if (spend(pa.length + pb.length + lb.length)) lb.forEach((link, k) => linksTo.set(link.to, [...linksTo.get(link.to) || [], k]));
+    for (const change of changes) {
+      if (change[0] === 5) continue;
+      if (budget.left < 0) break;
+      const range = change[3];
+      const older = containing(structures[0].parts, ...range[0]), newer = containing(structures[1].parts, ...range[1]);
+      const part = (change[0] === 0 ? older : newer).at(-1) || older.at(-1);
+      if (!change[2] && part?.name) { change[2] = part.name; change[1] = part.kind; }
+      const names = new Set([change[2], ...older.map(p => p.name), ...newer.map(p => p.name)]), breaks = [], affects = [];
+      for (const k of [...names].flatMap(name => linksTo.get(name) || []).sort((a, b) => a - b)) {
+        const {at, to} = lb[k];
+        if (!newNames.has(to)) { if (oldNames.has(to)) breaks.push({at, to}); continue; }
+        if (!spend() || touched(edits, at)) continue;
+        const p = containing(structures[1].parts, ...at).filter(p => /^(paragraph|call|item|task|cell|declaration)$/.test(p.kind)).at(-1);
+        affects.push(p && !touched(edits, [p.start, p.end]) ? [p.start, p.end] : at);
+      }
+      if (breaks.length) change[6] = breaks;
+      if (affects.length) change[5] = affects;
+    }
+  }
+  if (options._stats) Object.assign(options._stats, {work: Math.max(0, initial - Math.max(0, budget.left)), coarse: edits.some(c => c.coarse)});
+  // Concern tuples: kind, unit, name, context, edits, affects, breaks. Wording inside a move shares its context.
+  const moves = new Map(changes.map((change, i) => change[0] === 3 && [change[3], i + 1]).filter(Boolean));
+  return {edits, changes: changes.map(([kind, unit, name, context, owned, affects, breaks], i) => ({
+    id: i + 1, kind: ['delete', 'replace', 'insert', 'move', 'rename', 'format'][kind], unit, edits: owned,
+    ...(name ? {name} : {}), ...(context ? {context: {before: context[0], after: context[1]}} : {}),
+    ...(kind !== 3 && moves.has(context) ? {move: moves.get(context)} : {}),
+    ...(affects ? {affects} : {}), ...(breaks ? {breaks} : {})
+  }))};
+}