rapier-markdown-kit 1.1.104 → 1.2.5

package/LICENSE

@@ -21,8 +21,11 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 
 Files under this licence carry `SPDX-License-Identifier: MIT` in their first lines: the standard's
-grammar, marks and reference style (`spec/md-layout.mjs`, `spec/md-marks.mjs`, `spec/md-source.mjs`, `spec/flowchart.mjs`, `spec/markdown-style.css`), the layout model and line planner
-(`layout/model.mjs`, `layout/line-plan.mjs`, `layout/typography.mjs`, `layout/preparation.mjs`),
+grammar, marks and reference style (`spec/md-layout.mjs`, `spec/md-marks.mjs`, `spec/md-source.mjs`, `spec/flowchart.mjs`, `spec/markdown-style.css`), ink geometry
+(`spec/ink.mjs`),
+the layout model and line planner (`layout/model.mjs`, `layout/line-plan.mjs`, `layout/typography.mjs`, `layout/preparation.mjs`,
+`layout/prepared-paragraph.mjs`, `layout/hyphenation.mjs`, `layout/paragraph-fit.mjs`), the animated-picture reader and playback
+the HTML blocks use (`images/gif.mjs`, `images/playback.mjs`),
 the portable HTML and document metadata helpers (`spec/html-blocks.mjs`, `spec/frontmatter.mjs`,
 `spec/document-settings.mjs`, `spec/document-fonts.mjs`), the Will grammar (`agent/will.mjs`), the picture appendix reader and writer
 (`spec/md-assets.mjs`), the two shared-page reference readers (`tools/read-shared-page.mjs`,
@@ -32,8 +35,9 @@ own MIT notices. The edit-ledger module (`kit/rapier-ledger.mjs`, `kit/ledger/*.
 its editor compatibility import (`editor/journal-records.mjs`) are also covered. The
 record validator/replayer and text-only conflict merger were moved, not copied,
 into that module; the Notes index merger and the rest of the agent/editor remain
-AGPL-3.0-only. The wrapper's carrier-staging helper
-(`skills/rapier-html/package-files.mjs`) is MIT. The kit's MIT-marked facades,
+AGPL-3.0-only. The page wrapper (`skills/rapier-html/wrap.mjs`, `skills/rapier-html/page.mjs`,
+`skills/rapier-html/return-address.mjs`) and its carrier-staging helper
+(`skills/rapier-html/package-files.mjs`) are MIT. The kit's MIT-marked facades,
 `kit/render-entry.mjs`, `kit/render*.mjs`, `kit/export-fonts.mjs`, `kit/print-capitals.mjs`,
 `kit/pdf-vectors.mjs`, `kit/pdf-glyphs.mjs`, `kit/stage.mjs` and MIT-marked conformance
 modules are covered too. These names describe the Rapier-owned files carrying the

package/README.md

@@ -37,7 +37,7 @@ import {parseAssets} from 'rapier-markdown-kit/assets';   // the picture appendi
 Rapier is a phone-first Markdown editor for notes, diagrams, drawing and watercolor painting. It runs offline
 as one HTML file on Android, Web and Windows.
 
-1. **Work together live.** Connect to `https://mcp.rapier.website/mcp`, then call `open` to share one document with the person.
+1. **Work together live.** Connect to `https://mcp.rapier.website/door/mcp`, then call `open` to share one document with the person.
 2. **Deliver an offline editor.** Run `npx rapier-html notes.md` to put the document and editor in one HTML file ([rapier-html](https://github.com/jackskip22/rapier-plugins/tree/main/npm/rapier-html)).
 3. **Embed in your app.** Install [rapier-embed](https://github.com/jackskip22/rapier-plugins/tree/main/npm/rapier-embed); mount the editor or reader, with your app's agent over WebMCP in the editor.
 4. **Keep portable Markdown.** Use [rapier-markdown-kit](https://github.com/jackskip22/rapier-plugins/tree/main/npm/rapier-markdown-kit) for pictures, editable SVG drawings and layout in one `.md` file. Respect [Will/1](https://github.com/jackskip22/will) `keep`, `append` and `edit` regions.
@@ -64,6 +64,27 @@ const {html, filename} = await writer.render(source, {filename: 'report.md'});
 ```
 
 `createMarkdownRenderer(host).render(source, metadata)` returns the semantic HTML.
+`createMarkdownRenderer(host).renderWithMathML(source, metadata)` returns
+`{html, equations}` using the ready host math provider's `renderWithMathML` operation.
+The provider must also support the existing `renderToString` operation.
+Each equation is parsed once for its SVG and MathML. The HTML stays identical to
+ordinary SVG rendering; `equations` follows render order and carries `source`
+(the admitted token spelling, including its delimiters), `tex`, `displayMode`, `semantics`, and SVG
+`errors`. Pass `{docKind: 'markdown'}` as metadata for Markdown documents.
+The existing Markdown grammar may normalize display-block indentation; the original
+document remains the source of untouched document bytes.
+Inspect both `errors` and `semantics.status`: a rendered SVG can have refused or
+partial semantic output. The method throws if the combined provider is unavailable
+or fails, rather than returning an empty semantic success. It does not return an AST.
+
+This explicit method makes structured output available to consuming applications;
+Rapier's live editor and ordinary HTML/DOCX/print exports still use the current
+engine's Latin Modern SVG path. They do not insert hidden MathML, synthesize speech,
+or claim screen-reader qualification. A consumer that inserts MathML must preserve
+its namespace and semantics/annotation elements, name enclosing links meaningfully,
+and qualify its own accessibility presentation. The current ordinary document
+sanitizer is not a MathML composition API.
+
 The page writer's `render` returns `{html, filename}` asynchronously and preserves the
 original source, including BOM and line endings, in the SHA-256-verified source carrier.
 Every existing lower-level method is also returned for hosts that compose the stages.
@@ -235,8 +256,7 @@ are ignored; invalid/unclosed style strings admit no facts. Inner spans override
 clearing a selection removes that property's overrides and preserves the surrounding words' styles.
 
 Keep each opener with its first words and each closer with its last words. Soft/hard breaks may stay inside one paragraph; blank lines cannot. An opener alone on a line can become a raw HTML block.
-The old leading colour comment has the same portability fault: it can suppress Markdown parsing or disappear
-with its whole block in a non-HTML conversion. With inline HTML enabled, the new form preserves words, emphasis,
+With inline HTML enabled, the new form preserves words, emphasis,
 links and heading rank; GitHub strips the styles, and HTML-disabled readers may show the tags. Rapier's **Copy
 markdown without typography** removes recognized wrappers while retaining semantic Markdown and literal code.
 Its separate Pandoc/Quarto copy option writes bracketed spans deliberately; Pandoc HTML carries the CSS, but
@@ -563,6 +583,8 @@ no accessors, sparse arrays, cycles, undefined, negative zero or unpaired surrog
 Readers reject unknown envelope/start/head fields, bad checksums, invalid records,
 invalid source boundaries, a replay/root mismatch, or a head different from the
 actual document. `historyEnvelope` additionally proves the editor's Undo/Redo branch.
+Its optional third and fourth arguments are the expected text and metadata, as in
+`readLedger`; installing history can prove both source and navigation in one pass.
 
 **Roots are path-dependent.** `textRoot(text)` mints the existing
 `chars:fnv-base36:adler-base36` initial root. Each splice advances it with
@@ -601,7 +623,9 @@ the authorship projection recomputed from the ledger must agree exactly.
 text. Runs are `[start, end, actorKind, actorId, at]`, in order, nonoverlapping and
 covering every current character. A start without earlier authorship is attributed
 to `system/unattributed`, time zero. Insertions take the inserting record's actor
-and time; deleted runs disappear. Thus the projection contains **no removed text**.
+and time, except text an Undo or Redo puts back: a splice inserting exactly the text
+that a splice of the referenced act removed keeps the runs that text had. Deleted
+runs disappear. Thus the projection contains **no removed text**.
 An authorship-only import becomes a clearly incomplete insertion ledger; future
 attribution is again derived from that one ledger, never a mutable blame database.
 
@@ -628,6 +652,15 @@ The comparison page's `#rapier-base` is independent: `text/markdown`, with
 display reference. It is not reconstructed from the optional ledger and never
 replaces current source. `rapier-html --compare original.md revised.md` packages both texts.
 
+A comparison may also carry `data-fonts`, an HTML-attribute-escaped JSON string of
+canonical embedded `[font:]` reference definitions. The admitted base record exposes
+this as `fonts`. These resources belong to the exact comparison, outside its text,
+digest and revision; they never become a source edit or ledger record. Font preparation
+validates their actual bytes and reads font usage only from the original comparison.
+Existing source-owned assets remain authoritative. A missing personal-library font is
+embedded here when available, otherwise export refuses. Reopening and resaving need
+no library or network, and never substitute the current device's default font.
+
 ## Merging copies without a server
 
 `merge(first, second)` locates a common checkpoint with the same root **and exact
@@ -638,9 +671,19 @@ editor's restore reader can replay the result. Both merge orders yield the same
 text for independently edited nonoverlapping ranges; their ordered ledgers need
 not be identical. Full and conflict receipts make repeated imports idempotent.
 
-Overlaps fall back to the existing text three-way merge. Unresolved alternatives
-are carried in the existing `note-conflict:v1` envelope, never silently selected.
-Different Will `keep` regions require conflict review even when one copy was
+An identical replacement converges with both original acts retained and one physical
+splice. The format identifier stays `rapier-ledger/2`. That unchanged identifier is not
+backward compatibility with an older reader. There is no `rapier-ledger/3`, no
+compatibility reader, and no migration. An older reader rejects the empty physical
+witness with `ledger_invalid` and does not mutate the ledger. Mixed-version sync throws
+`notes_history_unavailable` (`the note and its canonical history cannot be proved`).
+The older participant's store snapshot and remote object count stay unchanged. That
+throw is not a per-note `held` or `caughtUp` result. The same format string is not
+interoperability, and the ledger is not rewritten into the older shape. Reactivating
+any author of that replacement checks the shared text again; undoing that author
+withdraws it once no author remains. A different overlap returns `text_overlap_unpreserved` and the caller's exact
+ledger, including the text merge's alternatives for review, and does not mint a synthetic
+act. Different Will `keep` regions require conflict review even when one copy was
 unchanged. `review.required` names an unresolved result; a UI must not auto-accept
 it. Rapier offers carried-copy imports from Compare through its existing review,
 checks the live document again at commit, and installs the proven ledger before

package/dist/images/gif.mjs

@@ -0,0 +1,49 @@
+// SPDX-License-Identifier: MIT
+// Container admission and a single-frame carrier, not a pixel/LZW decoder.
+// Original bytes remain the asset. Native ImageDecoder owns frame composition.
+export function inspectGIF(bytes) {
+  const fail = message => {throw Object.assign(new Error(message), {code: 'GIF_ADMISSION'});};
+  if (!(bytes instanceof Uint8Array) || bytes.length < 13 || bytes.length > 16 * 1024 * 1024 ||
+      !/^GIF8[79]a$/.test(String.fromCharCode(...bytes.subarray(0, 6)))) fail('Invalid GIF header or byte budget');
+  const u16 = at => bytes[at] + bytes[at + 1] * 256;
+  const width = u16(6), height = u16(8);
+  if (!width || !height || width > 16384 || height > 16384 || width * height > 24000000) fail('GIF dimensions exceed the image budget');
+  let at = 13, frames = 0, control = null, first = null, duration = 0;
+  const need = n => {if (at + n > bytes.length) fail('Truncated GIF');};
+  if (bytes[10] & 128) at += 3 * (2 << (bytes[10] & 7));
+  need(0); const prefix = at;
+  const blocks = () => {for (;;) {need(1); const n = bytes[at++]; need(n); at += n; if (!n) break;}};
+  while (at < bytes.length) {
+    const start = at, code = bytes[at++];
+    if (code === 0x3b) {
+      if (!first) fail('GIF contains no image');
+      const still = new Uint8Array(prefix + (first.control?.length || 0) + first.image.length + 1);
+      still.set(bytes.subarray(0, prefix)); let offset = prefix;
+      if (first.control) {still.set(first.control, offset); offset += first.control.length;}
+      still.set(first.image, offset); still[still.length - 1] = 0x3b;
+      return {type: 'image/gif', width, height, displayWidth: width, displayHeight: height, orientation: 1,
+        frames, animated: frames > 1, duration, first: still};
+    }
+    if (code === 0x21) {
+      need(1); const label = bytes[at++];
+      if (label === 0xf9) {
+        need(6); if (bytes[at] !== 4 || bytes[at + 5] !== 0 || (bytes[at + 1] >> 2 & 7) > 3) fail('Invalid GIF frame control');
+        control = bytes.subarray(start, at + 6); at += 6;
+      } else {blocks(); if (label === 1) fail('GIF plain-text rendering is unsupported');}
+      continue;
+    }
+    if (code !== 0x2c) fail('Invalid GIF record');
+    need(9);
+    const x = u16(at), y = u16(at + 2), w = u16(at + 4), h = u16(at + 6), packed = bytes[at + 8];
+    if (!w || !h || x + w > width || y + h > height) fail('Invalid GIF frame bounds');
+    at += 9; if (packed & 128) at += 3 * (2 << (packed & 7));
+    need(1); if (bytes[at] < 2 || bytes[at] > 8) fail('Invalid GIF code size');
+    at++; blocks(); frames++;
+    // A delay of 0 or 1 centisecond shows for 100 ms, as the browser draws it (images/playback.mjs times frames the same).
+    const delay = control ? control[4] + control[5] * 256 : 0;
+    duration += delay > 1 ? delay * 10 : 100;
+    if (frames > 240 || width * height * frames > 96000000 || duration > 120000) fail('GIF animation exceeds the frame, work or duration budget');
+    first ||= {control, image: bytes.subarray(start, at)}; control = null;
+  }
+  fail('GIF trailer is missing');
+}

package/dist/images/playback.mjs

@@ -0,0 +1,103 @@
+// SPDX-License-Identifier: MIT
+// Shared, self-contained playback for the host and its opaque HTML frames.
+// No source/history authority; at most one decoder and one returned frame per object.
+export function createMediaPlayback(win, inspectGIF) {
+  const active = new Map(), encode = bytes => bytes.toBase64();
+  // Base64 decodes in 1 MiB slices with a task yield between them, so a large animation never holds the main thread.
+  const bytes = async url => {
+    const text = url.slice(url.indexOf(',') + 1), slice = 1 << 20;
+    const out = new Uint8Array(text.length / 4 * 3 - (text.endsWith('==') ? 2 : text.endsWith('=') ? 1 : 0));
+    if (out.length > 16 * 1024 * 1024) throw new Error('Animation exceeds the byte budget');
+    for (let i = 0, at = 0; i < text.length; i += slice) {
+      if (i) await new Promise(resolve => win.setTimeout(resolve, 0));
+      at += out.subarray(at).setFromBase64(text.slice(i, i + slice)).written;
+    }
+    return out;
+  };
+  function raster(url, canvas, changed = () => {}, dimensions = null) {
+    // setFromBase64 refuses any character outside base64 while decoding.
+    if (url.length > 24 * 1024 * 1024 || !/^data:image\/(gif|jxl);base64,/i.test(url) || (url.length - url.indexOf(',') - 1) % 4) throw new Error('Unsupported animation source');
+    const type = url.slice(5, url.indexOf(';')).toLowerCase();
+    let data = null, info = null, size = null, decoder = null, timer = 0, closed = false, paused = true, ticket = 0, next = 0, loops = 0, duration = 0, single = false, held = false;
+    const state = {animated: true, status: 'loading', first: '', frames: 0};
+    const admitted = (async () => {
+      const buffer = await bytes(url); info = type === 'image/gif' ? inspectGIF(buffer) : null;
+      size = info || dimensions;
+      if (!size || !Number.isInteger(size.width) || !Number.isInteger(size.height) || size.width < 1 || size.height < 1 ||
+          size.width > 16384 || size.height > 16384 || size.width * size.height > 24000000) throw new Error('Animation requires bounded inspected dimensions');
+      data = buffer; state.animated = info?.animated ?? true; state.frames = info?.frames || 0;
+      if (info) state.first = 'data:image/gif;base64,' + encode(info.first);
+      if (!closed) changed(state);
+    })();
+    admitted.catch(error => {if (!closed) {state.status = 'admission-failed'; state.error = String(error.message).slice(0, 160); changed(state);}});
+    // A decoder closes only after its in-flight decode settles; Chrome 155's JPEG XL decoder fails when closed mid-decode.
+    // Its budget place goes with it: a poster or a finished loop holds no decoder.
+    let inflight = null;
+    const closeDecoder = () => {ticket++; win.clearTimeout(timer); timer = 0; active.delete(canvas); const old = decoder; decoder = null; if (old) inflight ? inflight.then(() => old.close()) : old.close();};
+    const settle = async promise => {
+      let timeout;
+      try {return await Promise.race([promise, new Promise((_, reject) => {timeout = win.setTimeout(() => reject(new Error('Animation decode timeout')), 5000);})]);}
+      finally {win.clearTimeout(timeout);}
+    };
+    async function step() {
+      if (closed || paused) return;
+      const stamp = ticket;
+      try {await admitted;} catch {return;}
+      try {
+        if (!win.ImageDecoder || !await win.ImageDecoder.isTypeSupported(type)) {
+          state.status = 'playback-unavailable'; paused = true; changed(state); return;
+        }
+        if (closed || paused || stamp !== ticket) return;
+        if (!decoder) {
+          if ([...active].reduce((sum, [other, pixels]) => sum + (other === canvas ? 0 : pixels), 0) + size.width * size.height > 24000000 || !active.has(canvas) && active.size >= 8) {
+            state.status = 'playback-budget'; paused = true; changed(state); return;
+          }
+          active.set(canvas, size.width * size.height);
+          decoder = new win.ImageDecoder({data, type, preferAnimation: true});
+          const current = decoder; await settle(current.tracks.ready);
+          if (closed || paused || stamp !== ticket || decoder !== current) return;
+          const track = current.tracks.selectedTrack;
+          if (!track || track.frameCount < 1 || track.frameCount > 240 || info && track.frameCount !== info.frames) throw new Error('Animation frame budget or container mismatch');
+          state.frames = track.frameCount; state.animated = track.animated;
+        }
+        const current = decoder, decoding = current.decode({frameIndex: next, completeFramesOnly: true});
+        const settled = inflight = decoding.then(() => {}, () => {}).then(() => {if (inflight === settled) inflight = null;});
+        decoding.then(result => {if (closed || stamp !== ticket) result.image.close();}, () => {});
+        const result = await settle(decoding);
+        const frame = result.image;
+        try {
+          if (closed || paused || stamp !== ticket || decoder !== current) return;
+          const w = frame.displayWidth, h = frame.displayHeight;
+          if (!result.complete || w !== size.width || h !== size.height || w * h * state.frames > 96000000) throw new Error('Decoded animation exceeds the image budget');
+          if (canvas.width !== w) canvas.width = w;
+          if (canvas.height !== h) canvas.height = h;
+          const ctx = canvas.getContext('2d'); ctx.clearRect(0, 0, w, h); ctx.drawImage(frame, 0, 0);
+          if (!state.first && next === 0) state.first = canvas.toDataURL('image/png');
+          // A frame of 10 ms or less shows for 100 ms, as the browser draws an <img> (images/gif.mjs counts the same).
+          const delay = frame.duration > 10000 ? Math.max(20, frame.duration / 1000) : 100;
+          duration += delay; if (duration > 120000) throw new Error('Animation exceeds the duration budget');
+          state.status = 'ready'; state.frame = next; changed(state);
+          if (single) {paused = true; closeDecoder(); return;}
+          next++;
+          if (next === state.frames) {
+            next = 0; duration = 0; loops++;
+            if (!state.animated || Number.isFinite(current.tracks.selectedTrack.repetitionCount) && loops > current.tracks.selectedTrack.repetitionCount) {paused = true; closeDecoder(); return;}
+          }
+          timer = win.setTimeout(step, delay);
+        } finally {frame.close();}
+      } catch (error) {
+        if (closed || stamp !== ticket) return;
+        state.status = 'decode-failed'; state.error = String(error.message).slice(0, 160); paused = true; closeDecoder(); changed(state);
+      }
+    }
+    return {state, play() {if (!closed && paused && !['decode-failed', 'admission-failed'].includes(state.status)) {paused = false; void step();}},
+      // A suspension that arrives during the one-frame decode (an offscreen host's first visibility report) waits for it.
+      async first() {if (!state.first && !closed) {single = true; next = 0; paused = false; try {await step();} finally {single = false; paused = true; closeDecoder(); if (held) {held = false; this.suspend();}}} return state.first;},
+      // Pause keeps the decoder and its frame position; only suspension and removal release it.
+      pause() {paused = true; ticket++; win.clearTimeout(timer); timer = 0;},
+      suspend() {if (single) {held = true; return;} paused = true; closeDecoder(); canvas.width = canvas.height = 0; state.status = 'suspended'; changed(state);},
+      close() {closed = true; paused = true; closeDecoder(); canvas.width = canvas.height = 0;},
+      get paused() {return paused;}};
+  }
+  return {raster, inspectGIF, encode, source: '(' + createMediaPlayback.toString() + ')(window, ' + inspectGIF.toString() + ')'};
+}

package/dist/kit/conformance/03-wrap-around-silhouette.md

@@ -1,7 +1,7 @@
 
 # Wrap around a silhouette
 
-This paragraph comes before the picture and stays the anchor whenever the block right after the picture cannot be one -- another image paragraph, or a heading -- so the words below keep their own separate life.
+This paragraph comes before the picture and stays the anchor whenever the block right after the picture cannot be one -- another image paragraph, or a table -- so the words below keep their own separate life.
 
 ![A silhouette picture][diamond] <!--md-layout:v1 width=35% wrap=around x=20%-->
 

package/dist/kit/conformance/04-wrap-box.md

@@ -1,7 +1,7 @@
 
 # Wrap box
 
-This paragraph comes before the picture and stays the anchor whenever the block right after the picture cannot be one -- another image paragraph, or a heading -- so the words below keep their own separate life.
+This paragraph comes before the picture and stays the anchor whenever the block right after the picture cannot be one -- another image paragraph, or a table -- so the words below keep their own separate life.
 
 ![A tight-box picture][opaque] <!--md-layout:v1 width=35% wrap=box x=75%-->
 

package/dist/kit/conformance/05-behind.md

@@ -1,7 +1,7 @@
 
 # Behind
 
-This paragraph comes before the picture and stays the anchor whenever the block right after the picture cannot be one -- another image paragraph, or a heading -- so the words below keep their own separate life.
+This paragraph comes before the picture and stays the anchor whenever the block right after the picture cannot be one -- another image paragraph, or a table -- so the words below keep their own separate life.
 
 ![A behind picture][opaque] <!--md-layout:v1 width=35% wrap=behind x=50%-->
 

package/dist/kit/conformance/06-front.md

@@ -1,7 +1,7 @@
 
 # Front
 
-This paragraph comes before the picture and stays the anchor whenever the block right after the picture cannot be one -- another image paragraph, or a heading -- so the words below keep their own separate life.
+This paragraph comes before the picture and stays the anchor whenever the block right after the picture cannot be one -- another image paragraph, or a table -- so the words below keep their own separate life.
 
 ![A front picture][opaque] <!--md-layout:v1 width=35% wrap=front x=50%-->
 

package/dist/kit/conformance/07-rotate-raster.md

@@ -1,7 +1,7 @@
 
 # Rotate a raster
 
-This paragraph comes before the picture and stays the anchor whenever the block right after the picture cannot be one -- another image paragraph, or a heading -- so the words below keep their own separate life.
+This paragraph comes before the picture and stays the anchor whenever the block right after the picture cannot be one -- another image paragraph, or a table -- so the words below keep their own separate life.
 
 ![A turned raster picture][opaque] <!--md-layout:v1 width=35% wrap=box x=75% rotate=25deg-->
 

package/dist/kit/conformance/08-drawing-rotation.md

@@ -1,7 +1,7 @@
 
 # A drawing with its own rotation
 
-This paragraph comes before the picture and stays the anchor whenever the block right after the picture cannot be one -- another image paragraph, or a heading -- so the words below keep their own separate life.
+This paragraph comes before the picture and stays the anchor whenever the block right after the picture cannot be one -- another image paragraph, or a table -- so the words below keep their own separate life.
 
 ![A drawing already turned in its own bytes][rotated] <!--md-layout:v1 width=35% wrap=around x=75%-->
 

package/dist/kit/conformance/09-drawing-ring-interior.expected.json

@@ -60,40 +60,34 @@
       "bottom": 153.98
     },
     {
-      "left": 0,
-      "top": 154,
-      "right": 61.91,
-      "bottom": 184.8
-    },
-    {
-      "left": 115.08,
+      "left": 103.98,
       "top": 154,
-      "right": 353.98,
+      "right": 354,
       "bottom": 184.8
     },
     {
       "left": 0,
       "top": 184.8,
       "right": 354,
-      "bottom": 215.59
+      "bottom": 215.6
     },
     {
       "left": 0,
-      "top": 215.59,
+      "top": 215.6,
       "right": 354,
-      "bottom": 246.39
+      "bottom": 246.4
     },
     {
       "left": 0,
-      "top": 246.39,
+      "top": 246.4,
       "right": 354,
-      "bottom": 277.19
+      "bottom": 277.2
     },
     {
       "left": 0,
-      "top": 277.19,
+      "top": 277.2,
       "right": 354,
-      "bottom": 307.98
+      "bottom": 308
     },
     {
       "left": 0,
@@ -105,13 +99,19 @@
       "left": 0,
       "top": 338.8,
       "right": 354,
-      "bottom": 369.59
+      "bottom": 369.6
+    },
+    {
+      "left": 0,
+      "top": 369.6,
+      "right": 354,
+      "bottom": 400.4
     },
     {
       "left": 0,
-      "top": 369.59,
+      "top": 400.4,
       "right": 354,
-      "bottom": 400.39
+      "bottom": 431.2
     }
   ],
   "glyphWidths": {

package/dist/kit/conformance/09-drawing-ring-interior.md

@@ -1,7 +1,7 @@
 
 # An unfilled circle's interior
 
-This paragraph comes before the picture and stays the anchor whenever the block right after the picture cannot be one -- another image paragraph, or a heading -- so the words below keep their own separate life.
+This paragraph comes before the picture and stays the anchor whenever the block right after the picture cannot be one -- another image paragraph, or a table -- so the words below keep their own separate life.
 
 ![A ring drawing with an empty interior][ring] <!--md-layout:v1 width=45% wrap=around x=25%-->
 

package/dist/kit/conformance/10-both-sides.md

@@ -1,7 +1,7 @@
 
 # Both-sides wrapping
 
-This paragraph comes before the picture and stays the anchor whenever the block right after the picture cannot be one -- another image paragraph, or a heading -- so the words below keep their own separate life.
+This paragraph comes before the picture and stays the anchor whenever the block right after the picture cannot be one -- another image paragraph, or a table -- so the words below keep their own separate life.
 
 ![A centred picture][opaque] <!--md-layout:v1 width=22% wrap=around x=50%-->
 

package/dist/kit/conformance/11-neighbour-skips-image.md

@@ -1,7 +1,7 @@
 
 # The neighbour search skips another image paragraph
 
-This paragraph comes before the picture and stays the anchor whenever the block right after the picture cannot be one -- another image paragraph, or a heading -- so the words below keep their own separate life.
+This paragraph comes before the picture and stays the anchor whenever the block right after the picture cannot be one -- another image paragraph, or a table -- so the words below keep their own separate life.
 
 ![The picture under test][diamond] <!--md-layout:v1 width=35% wrap=around x=20%-->
 

package/dist/kit/conformance/{12-heading-barrier.expected.json → 12-rule-barrier.expected.json}

@@ -1,5 +1,5 @@
 {
-  "document": "12-heading-barrier.md",
+  "document": "12-rule-barrier.md",
   "measurer": {
     "font": "normal 400 17.6px/30.8px Geist, system-ui, sans-serif",
     "letterSpacing": 0,

package/dist/kit/conformance/{12-heading-barrier.md → 12-rule-barrier.md}

@@ -1,11 +1,11 @@
 
-# The neighbour search stops at a heading
+# The neighbour search stops at a rule
 
 This paragraph comes before the picture and stays the anchor whenever the block right after the picture cannot be one -- another image paragraph, or a heading -- so the words below keep their own separate life.
 
 ![The picture under test][opaque] <!--md-layout:v1 width=35% wrap=around x=75%-->
 
-## A heading right after the picture
+***
 
 This paragraph comes after the picture and is its ordinary anchor whenever nothing else stands in the way, wrapping beside it line by line the way the fixture is built to show plainly.
 

package/dist/kit/conformance/README.md

@@ -5,10 +5,12 @@ standard](https://rapier.website/markdown-standard): inline (no layout comment),
 with a real alpha silhouette, `wrap=box`, `behind`, `front`, `rotate=` on a plain raster, a foreign
 SVG "drawing" already turned in its own bytes, a ring drawing whose unfilled interior takes a line of
 text, both-sides wrapping around a centred picture, the neighbour search skipping a second, unrelated
-picture, a heading after a picture, and RTL (Arabic) text.
+picture, a rule after a picture (a barrier, so the paragraph before it anchors), and RTL (Arabic) text.
 
-Headings can anchor images. `12-heading-barrier.expected.json` records an earlier paragraph
-anchor; that historical measurement is not a normative neighbour-selection expectation.
+The fixtures were captured at a 30.8 px line (`measurer.lineHeight`, 1.75 × the 17.6 px body); the reference
+scale's line is now 28 px at M. The line height is an input to the comparison, so the recorded lines stay
+self-consistent. In `01-inline` and `12-rule-barrier` the sentence "another image paragraph, or a heading" is
+measured anchor text and stays as recorded; headings do anchor pictures.
 
 ## What each document's JSON carries
 
@@ -59,7 +61,10 @@ anchor; that historical measurement is not a normative neighbour-selection expec
 
 ## The expectations
 
-`<name>.expected.json` is compared against the exported page's own reflow within 1.5 px; a missing one is a failure. `profileHint` is hand-computed from how each fixture's picture bytes were built ("Generation notes" below) and is restored by hand if a file is regenerated.
+`<name>.expected.json` is compared against the exported page's own reflow within 1.5 px; a missing one is a failure.
+Rows 5–13 of `09-drawing-ring-interior` come from the kit's own planner with the recorded measurer: the word-deferral
+rule moves "ordinary" whole into the ring's wide slot, and the exported page wraps with a native `shape-outside` float,
+which exposes no per-slot line boxes to record. `profileHint` is hand-computed from how each fixture's picture bytes were built ("Generation notes" below) and is restored by hand if a file is regenerated.
 
 ## Running the comparison
 
@@ -72,31 +77,17 @@ Prints two separate tables (preservation and presentation are different claims):
 
 - **Preservation** — does each fixture's own layout comment round-trip exactly through
   `parseLayout`/`formatLayout`. No measurer, no font: either exactly right, or a real bug. 12/12.
-- **Presentation** — does the planned line count and each line's left/right agree with the recorded
-  fact, within `--tolerance` pixels (default 2). This depends entirely on the measurer supplied;
+- **Presentation** — does the planned line count, each flowed line's row (its top) and each line's left/right
+  agree with the recorded fact, within `--tolerance` pixels (default 2). A wrong row is DIFFERS. This depends entirely on the measurer supplied;
   `run.mjs`'s own default (`measurer.mjs`) replays Rapier's real Pretext trace wherever one was
-  captured, falling back to the character-glyph sum only where none exists. Recorded result (not a current-run receipt): **3/13
-  AGREE outright** (`04-wrap-box`, `10-both-sides`, `12-heading-barrier` — every
-  one a case where the compared edge is pure obstacle-slot geometry, unaffected by text fidelity
-  either way), **10 CLOSE, 0 DIFFERS**, each CLOSE row's cause named rather than left as "close
-  enough": `01-inline`/`02-width-x-align`/`05-behind`/`06-front` have no real trace at all (see
-  `measurements` above) so still rest on the character-sum fallback; `03-wrap-around-silhouette`,
-  `11-neighbour-skips-image` and `13-rtl-text` run Pretext for real during export (`13-rtl-text` at
-  100% — every query of its own answered from the real trace) yet still carry a small, constant
-  left-edge delta (9.64px) that is a picture-obstacle *geometry* fact, not a text one: their
-  `profileHint` is a hand-computed, quantized alpha-band descriptor for a picture Rapier's own export
-  never serializes an occupancy descriptor for, and that descriptor's own precision — not the
-  measurer — is the residual gap. `07-rotate-raster` and `08-drawing-rotation` have right-edge geometry deltas of 4.48px and 5.31px, with no measurer calls. `09-drawing-ring-interior` plans the recorded 14 lines, but one row
-  differs by a whole slot (115.08px left, 292.09px right): its recorded trace, taken before a word
-  that must break inside itself was given the widest slot of its row, cuts "ordinary" into "ordinar"
-  and "y" in the ring's narrow left slot, where the planner now leaves that slot empty and sets the
-  word whole in the wide one (`layout/line-plan.mjs`). Its `expected.json` still holds the earlier cut;
-  it is regenerated from a browser export, not by hand. Before this
-  measurer existed (a per-character glyph-sum with no real trace at all), the same run reported 4
-  AGREE / 8 CLOSE / 1 DIFFERS — `13-rtl-text` disagreed by a whole line (7 expected, 8 planned): real
-  Arabic shaping (ligatures, diacritic combination) changes a run's total measured width in a way an
-  isolated-character sum cannot reproduce, and that was enough to move one word to the next line. The
-  real trace above fixes exactly that: `13-rtl-text` now plans the correct 7 lines.
+  captured, falling back to the character-glyph sum only where none exists. Result: **3/13
+AGREE outright** (`04-wrap-box`, `10-both-sides`, `12-rule-barrier`, each a case where the compared edge is
+pure obstacle-slot geometry), **10 CLOSE, 0 DIFFERS**. `01-inline`, `02-width-x-align`, `05-behind` and `06-front`
+have no real trace (see `measurements` above) and rest on the character-sum fallback. `03-wrap-around-silhouette`,
+`11-neighbour-skips-image` and `13-rtl-text` run Pretext for real yet carry a constant 9.64px left-edge delta, a
+picture-obstacle geometry fact: their `profileHint` is a hand-computed, quantized alpha-band descriptor. `09` carries
+7.8px of the same kind. `07-rotate-raster` and `08-drawing-rotation` have right-edge geometry deltas of 4.48px and
+5.31px, with no measurer calls.
 
 ## Generation notes (how the pictures were built)
 

package/dist/kit/conformance/run.mjs

@@ -77,18 +77,22 @@ for (const expected of documents) {
 	if (!plan) { rows.push({document: expected.document, verdict: 'ERROR', detail: 'flowLines returned null (no plan fits)'}); continue; }
 
 	const lineCountAgrees = plan.lines.length === expected.lines.length;
-	let maxLeftDelta = 0, maxRightDelta = 0;
+	let maxLeftDelta = 0, maxRightDelta = 0, maxTopDelta = 0;
 	for (let i = 0; i < Math.min(plan.lines.length, expected.lines.length); i++) {
 		const got = plan.lines[i], want = expected.lines[i];
+		// Flowed lines are line boxes; an unflowed line's recorded top is its glyphs' own.
+		if (expected.anchorFlowed) maxTopDelta = Math.max(maxTopDelta, Math.abs(got.y - want.top));
 		// Flowed lines compare slot geometry (x+width); unflowed lines compare the measured tight extent.
 		const right = expected.anchorFlowed ? got.x + got.width : got.x + measurer.measure(font, got.fragments.map(f => f.text).join(''));
 		maxLeftDelta = Math.max(maxLeftDelta, Math.abs(got.x - want.left));
 		maxRightDelta = Math.max(maxRightDelta, Math.abs(right - want.right));
 	}
-	const withinTolerance = lineCountAgrees && maxLeftDelta <= args.tolerance && maxRightDelta <= args.tolerance;
+	// A line that keeps its edges but lands on another row is a different layout.
+	const rowsAgree = maxTopDelta <= args.tolerance;
+	const withinTolerance = lineCountAgrees && rowsAgree && maxLeftDelta <= args.tolerance && maxRightDelta <= args.tolerance;
 	rows.push({
 		document: expected.document,
-		verdict: withinTolerance ? 'AGREE' : lineCountAgrees ? 'CLOSE' : 'DIFFERS',
+		verdict: withinTolerance ? 'AGREE' : lineCountAgrees && rowsAgree ? 'CLOSE' : 'DIFFERS',
 		expectedLines: expected.lines.length, gotLines: plan.lines.length,
 		maxLeftDelta: Math.round(maxLeftDelta * 100) / 100, maxRightDelta: Math.round(maxRightDelta * 100) / 100,
 		hits: measurer.stats.hits - before.hits, misses: measurer.stats.misses - before.misses,
@@ -109,16 +113,14 @@ console.log(`\n${agree}/${rows.length} documents AGREE within ${args.tolerance}p
 console.log(`Measurer: ${measurer.stats.hits} queries answered from Rapier's own real browser trace, ${measurer.stats.misses} fell back to a character-glyph sum (no kerning/shaping).`);
 console.log(`A row's own hits/misses can undercount its real coverage: several fixtures share one identical anchor sentence, and Pretext's own per-process`);
 console.log(`segment cache (agent/vendor/pretext/measurement.js) serves a repeated (font, segment) query straight from that cache without calling`);
-console.log(`measureText again at all -- real data, just not counted against the SECOND document to ask for it. Three named, separate reasons a row still`);
+console.log(`measureText again at all -- real data, just not counted against the SECOND document to ask for it. Two named, separate reasons a row still`);
 console.log(`reads CLOSE rather than AGREE, none of them "close enough": (a) no real trace exists at all for 01-inline/02-width-x-align/05-behind/06-front`);
-console.log(`-- their picture pushes no flow obstacle, so layout/interchange.js's own prepare() never calls Pretext for this paragraph during export (see`);
+console.log(`-- their picture pushes no flow obstacle, so kit/render.mjs's exported projector's prepare() never calls Pretext for this paragraph during export (see`);
 console.log(`measurer.mjs) -- the from-scratch character-sum approximation disagrees with real shaping by a bounded, named amount; (b) 03/11/13 DO run`);
 console.log(`Pretext for real (hits > 0, 13-rtl-text at 100% -- every query answered from the real trace) yet still carry a small, constant left-edge delta`);
 console.log(`(9.64px today, a constant from before this measurer existed) -- a picture-obstacle geometry fact, not a text one: these`);
 console.log(`fixtures' profileHint is a hand-computed, quantized alpha band descriptor for a raster Rapier's own export never serialized an occupancy`);
-console.log(`descriptor for (conformance/README.md, "profileHint"), and that descriptor's own precision -- not this lane's measurer -- is the residual gap; (c) 09 plans the recorded 14 lines but one row`);
-console.log(`differs by a whole slot: its recorded trace cuts a word in the ring's narrow left slot, and the planner now gives a word that must break inside itself`);
-console.log(`the widest slot of its row (layout/line-plan.mjs) -- the recorded lines are the earlier planner's.`);
+console.log(`descriptor for (conformance/README.md, "profileHint"), and that descriptor's own precision -- not this lane's measurer -- is the residual gap; 09's 7.8px rows are the same kind of fact.`);
 if (measurer.stats.missedQueries.length) {
 	console.log(`\nFirst ${Math.min(10, measurer.stats.missedQueries.length)} of ${measurer.stats.misses} missed (font, text) queries (fell back to the character sum):`);
 	for (const {font, text} of measurer.stats.missedQueries.slice(0, 10)) console.log(`  ${JSON.stringify(text)}  (${font})`);