rapier-markdown-kit 1.1.56 → 1.1.58

package/LICENSE

@@ -25,7 +25,12 @@ grammar, marks and reference style (`spec/md-layout.mjs`, `spec/md-marks.mjs`, `
 (`layout/model.mjs`, `layout/line-plan.mjs`), the Will grammar (`agent/will.mjs`), the picture appendix reader and writer
 (`spec/md-assets.mjs`), the two shared-page reference readers (`tools/read-shared-page.mjs`,
 `tools/read-shared-page.py`), and the host helper `packages/rapier-embed/embed.mjs`. The vendored Pretext (`agent/vendor/pretext`) and micromark carry their
-own MIT notices. Everything else in Rapier is AGPL-3.0-only (see `LICENSE`).
+own MIT notices. The edit-ledger module (`kit/rapier-ledger.mjs`, `kit/ledger/*.mjs`) and
+its editor compatibility import (`editor/journal-records.mjs`) are also covered. The
+record validator/replayer and text-only conflict merger were moved, not copied,
+into that module; the Notes index merger and the rest of the agent/editor remain
+AGPL-3.0-only. The wrapper's carrier-staging helper
+(`skills/rapier-html/package-files.mjs`) is MIT. Everything else in Rapier is AGPL-3.0-only (see `LICENSE`).
 
 The picture appendix reader and writer used to be part of `images/assets.mjs`, a file that also
 holds JPEG XL/raster header inspection and SVG sanitizing -- both of which reach the editor's own

package/README.md

@@ -77,7 +77,9 @@ round-trip the actual HTTP output.
 | `rapier-markdown-kit/will` | The Will/1 grammar (a separate, optional standard): the markers around an agent's intent regions. |
 | `rapier-markdown-kit/assets` | The picture appendix: the reference definitions a document's pictures live in. It never decodes a picture. |
 | `rapier-markdown-kit/style.css` | The reference style: type, lists, tables, tasks, pictures and the document's other markup, scoped to `.md-render`. |
-| `rapier-markdown-kit` | All five in one import. |
+| `rapier-markdown-kit/rapier-ledger` | The MIT edit-ledger format, replay, authorship projection and offline merge. |
+| `rapier-markdown-kit/ledger/carried` | Checked optional parts for pages and saved Markdown. |
+| `rapier-markdown-kit` | The modules above as named namespaces. |
 
 Every convention is plain Markdown or an HTML comment other readers ignore. Laying lines out as Rapier does takes
 the host's font metrics (below).
@@ -281,3 +283,156 @@ value the editor's release reads.
 
 Each module has one home in the Rapier source (`spec/`, `layout/`, `agent/`), where Rapier itself reads it; `dist/`
 is that closure copied byte for byte, and `style.css` is the same `spec/markdown-style.css` Rapier bundles.
+
+
+## rapier-ledger
+
+The edit ledger and its carried parts. MIT, no dependencies; part of
+`rapier-markdown-kit`. The editor and this module use the **same** record validator,
+splice replayer, root transition and interval transport. This is not a second history store.
+
+```js
+import {exportLedger, readLedger, authorship, merge} from 'rapier-markdown-kit/rapier-ledger';
+import {writeDocument, readDocument} from 'rapier-markdown-kit/ledger/carried';
+
+const ledger = exportLedger({
+  text: 'Hello', records: [], documentAuthority: 'example-document', complete: true,
+});
+const saved = writeDocument('Hello', {ledger});
+const reopened = readDocument(saved);
+const verified = readLedger(reopened.ledger, reopened.text);
+console.assert(verified.text === 'Hello');
+const clean = writeDocument(verified.text, {authorship: authorship(ledger)});
+console.assert(readDocument(clean).ledger === null);
+const together = merge(ledger, reopened.ledger);
+console.assert(together.text === 'Hello');
+```
+
+## The format at launch
+
+`rapier-ledger/1` is a plain JSON object:
+
+```
+{format, documentAuthority, start: {text, revision, root, sha256}, records,
+ head: {revision, root, sha256}, complete, sha256}
+records[]: {transaction, splices: [{pos, removed, inserted}], beforeHash, afterHash}
+transaction: {id, documentAuthority, baseRevision, revision, actor: {kind, id},
+ transport, operation, requestId, sourceTransactionId, affectedBlockIds,
+ parent, reverts, reapplies, createdAt}
+```
+
+`format` is `rapier-ledger/1`. `start.text` is the exact text before the first
+retained record. Every outgoing record carries its own splices, including Undo and
+Redo. Offsets and ranges count UTF-16 code units; no boundary may cut a surrogate
+pair. Splices execute in their recorded order. UTF-8 checksums preserve CRLF, tabs,
+NUL and non-ASCII text. The canonical text limit is 25 MiB; each record has at most
+64 splices. The existing record validator remains authoritative for field bounds.
+
+`start.sha256` and `head.sha256` hash UTF-8 text. The envelope `sha256` hashes
+canonical JSON of every other envelope field: recursively sorted object keys,
+array order preserved, JSON string/number spelling. Plain finite scalar data only:
+no accessors, sparse arrays, cycles, undefined, negative zero or unpaired surrogates.
+Readers reject unknown envelope/start/head fields, bad checksums, invalid records,
+invalid source boundaries, a replay/root mismatch, or a head different from the
+actual document. `historyEnvelope` additionally proves the editor's Undo/Redo branch.
+
+**Roots are path-dependent.** `textRoot(text)` mints the existing
+`chars:fnv-base36:adler-base36` initial root. Each splice advances it with
+`rootAfter(priorRoot, splice)`, matching the source store. A later root is **not**
+a fresh hash of the whole current text. SHA-256 of the exact checkpoint text is
+separate. This distinction preserves the editor's actual format rather than the
+earlier design shorthand. A nonzero start names a retained checkpoint; it does not
+claim to reconstruct discarded events. `complete: false` also permits a stated
+revision gap from the editor's pruning of cancelling navigation pairs; each
+remaining splice must still replay exactly. It is never a claim about missing edits.
+
+`actor.kind` is `human`, `agent` or `system`. A named agent's `actor.id` is
+`<door>/<host-given name>` (name at most 96 characters, combined id at most 160).
+Without a name, the door stands alone. The name is a **host-supplied claim**, not a
+verified identity. Timestamps are supplied record times, not independently attested.
+Checksums detect inconsistency/corruption, **not forgery**: anyone able to rewrite a
+file can rewrite its checksums and labels. Importing a label never grants a live
+principal's read handles, review authority or undo permissions.
+
+## Optional carried parts
+
+The default is **neither part**. In a self-contained page these inert scripts stand
+beside the document's existing carried source:
+
+| Element | Type and contents | Choice |
+| --- | --- | --- |
+| `#rapier-authorship` | `application/json`, `rapier-authorship/1` | Who wrote what |
+| `#rapier-ledger` | `application/json`, `rapier-ledger/1` | The whole history |
+
+Each body uses the same reversible `encodeCarried`/`decodeCarried` escape as the
+page's source. `writeParts`, `readParts` and `takeParts` implement it. Duplicate,
+executable, malformed or wrong-document parts are refused. If both are present,
+the authorship projection recomputed from the ledger must agree exactly.
+
+`rapier-authorship/1` is `{format, sha256, runs}`. `sha256` hashes the **current**
+text. Runs are `[start, end, actorKind, actorId, at]`, in order, nonoverlapping and
+covering every current character. A start without earlier authorship is attributed
+to `system/unattributed`, time zero. Insertions take the inserting record's actor
+and time; deleted runs disappear. Thus the projection contains **no removed text**.
+An authorship-only import becomes a clearly incomplete insertion ledger; future
+attribution is again derived from that one ledger, never a mutable blame database.
+
+A Markdown file carries the same optional JSON at EOF, outside its exact source:
+
+```
+
+
+<!-- rapier-carried/1
+{"ledger":...,"authorship":...}
+-->
+
+```
+
+The writer escapes `<` and `>` in that JSON. This versioned EOF marker is reserved;
+an unfinished marker is refused, not silently imported as prose. The reader strips
+only that exact suffix, validates it against the remaining exact text, and treats a
+leading BOM as file metadata. Other Markdown readers ignore the comment. Plain
+saves without a choice are unchanged byte for byte. For executable code, use a web
+page to carry metadata rather than appending a Markdown comment to program source.
+
+The existing proposal page's `#rapier-base` is independent: `text/markdown`, with
+`data-revision`, `data-sha256`, `data-by` and `data-at`, carries the proposal's
+baseline. It is **not** reconstructed from an optional ledger, and this module does
+not implement the separate proposal-tool/CLI workflow.
+
+## Merging copies without a server
+
+`merge(first, second)` locates a common checkpoint with the same root **and exact
+text**, then transports the second copy's record splices over the first's through
+the shared interval transport. It preserves the first's ancestry and incoming
+actors/times, minting local revision/root links. Both the public reader and the
+editor's restore reader can replay the result. Both merge orders yield the same
+text for independently edited nonoverlapping ranges; their ordered ledgers need
+not be identical. Full and conflict receipts make repeated imports idempotent.
+
+Overlaps fall back to the existing text three-way merge. Unresolved alternatives
+are carried in the existing `note-conflict:v1` envelope, never silently selected.
+Different Will `keep` regions require conflict review even when one copy was
+unchanged. `review.required` names an unresolved result; a UI must not auto-accept
+it. Rapier offers carried-copy imports from Compare through its existing review,
+checks the live document again at commit, and installs the proven ledger before
+publishing its receipt or opening the durable-save barrier. A rejected or stale
+proposal mutates nothing. A failed install rolls the source and undo window back.
+Copies without a proven common checkpoint are refused by this API.
+
+## Host integration and retention
+
+The embed helper accepts `agentName`; the checked `rapier-connect` message carries
+`agent: {name}`. WebMCP uses the registration owner's supplied client name. Modern
+MCP uses the request's client metadata, outside tool arguments; a legacy stateless
+request without a supplied name stays unnamed. MCP editor snapshots include the
+server's retained journal only in editor metadata, not in model-facing tool results.
+The browser proves a replay suffix before preserving remote writers under local
+revision links; missing remote events never become an invented complete history.
+
+Rapier retains its existing 500-record / 4-MiB in-memory window. A carried file can
+outlive that window; reopening may trim it again. The module preserves an explicitly
+incomplete start. Full history includes removed text and can be much larger than
+the current document; it is opt-in for each outgoing file, never a persistent
+preference. Authorship is also opt-in. Neither option implies signatures, identity
+verification, infinite retention, a relay server or automatic synchronization.

package/dist/kit/index.mjs

@@ -5,3 +5,4 @@ export * from './model.mjs';
 export * from './will.mjs';
 export * from './assets.mjs';
 export * from './render-entry.mjs';
+export * as ledger from './rapier-ledger.mjs';

package/dist/kit/ledger/authorship.mjs

@@ -0,0 +1,59 @@
+// SPDX-License-Identifier: MIT
+import {readLedger, exportLedger, textRoot, rootAfter} from './format.mjs';
+import {_rapierTransformSplices} from './journal-records.mjs';
+import {sha256} from './hash.mjs';
+import {plainData, documentText, nonnegative, exactKeys, fault} from './data.mjs';
+function coalesce(runs) {
+  const out = [];
+  for (const run of runs) {
+    if (run[0] === run[1]) continue;
+    const last = out.at(-1);
+    if (last && last[1] === run[0] && last.slice(2).every((value, i) => value === run[i + 2])) last[1] = run[1];
+    else out.push(run.slice());
+  }
+  return out;
+}
+export function authorship(input) {
+  const {ledger, text} = readLedger(input);
+  let runs = ledger.start.text ? [[0, ledger.start.text.length, 'system', 'unattributed', 0]] : [];
+  for (const record of ledger.records) for (const row of record.splices) {
+    const cut = row.pos + row.removed.length, delta = row.inserted.length - row.removed.length, before = [], after = [];
+    for (const run of runs) {
+      if (run[0] < row.pos) before.push([run[0], Math.min(run[1], row.pos), ...run.slice(2)]);
+      if (run[1] > cut) after.push([Math.max(run[0], cut) + delta, run[1] + delta, ...run.slice(2)]);
+    }
+    const tx = record.transaction;
+    runs = coalesce([...before, [row.pos, row.pos + row.inserted.length, tx.actor.kind, tx.actor.id, tx.createdAt], ...after]);
+  }
+  return {format: 'rapier-authorship/1', sha256: sha256(text), runs};
+}
+export function readAuthorship(input, text) {
+  documentText(text); const value = plainData(input);
+  if (!exactKeys(value, ['format','sha256','runs']) || value.format !== 'rapier-authorship/1' || value.sha256 !== sha256(text) || !Array.isArray(value.runs)) throw fault('authorship is not for this text');
+  let cursor = 0;
+  for (const run of value.runs) {
+    if (!Array.isArray(run) || run.length !== 5 || run[0] !== cursor || !nonnegative(run[1]) || run[1] <= cursor || run[1] > text.length ||
+        !['human','agent','system'].includes(run[2]) || typeof run[3] !== 'string' || !run[3] || run[3].length > 160 || !nonnegative(run[4]) ||
+        /[\uD800-\uDFFF]/u.test(text.slice(cursor, run[1]))) throw fault('invalid authorship run');
+    cursor = run[1];
+  }
+  if (cursor !== text.length) throw fault('authorship does not cover the text');
+  return value;
+}
+// Authorship-only imports become an incomplete insertion ledger. There is no mutable blame database.
+export function ledgerFromAuthorship(input, text, documentAuthority) {
+  const value = readAuthorship(input, text), records = [];
+  let current = '', root = textRoot('');
+  for (const [start, end, kind, id, createdAt] of value.runs) {
+    const row = {pos: start, removed: '', inserted: text.slice(start, end)}, revision = records.length + 1;
+    const beforeHash = root; root = rootAfter(root, row);
+    current = _rapierTransformSplices(current, [row]);
+    records.push({beforeHash, afterHash: root, splices: [row], transaction: {
+      id: documentAuthority.slice(0, 48) + ':authorship:' + revision.toString(36), documentAuthority,
+      baseRevision: revision - 1, revision, actor: {kind, id}, transport: 'platform', operation: 'authorship.import',
+      requestId: null, sourceTransactionId: null, affectedBlockIds: [], parent: records.at(-1)?.transaction.id ?? null,
+      reverts: null, reapplies: null, createdAt,
+    }});
+  }
+  return exportLedger({text: current, records, documentAuthority, revision: records.length, root, complete: false});
+}

package/dist/kit/ledger/carried.mjs

@@ -0,0 +1,69 @@
+// SPDX-License-Identifier: MIT
+import {readLedger} from './format.mjs';
+import {authorship as projectAuthorship, readAuthorship} from './authorship.mjs';
+import {canonicalJSON, fault} from './data.mjs';
+export function encodeCarried(text) {
+  return String(text).replace(/[\\\r\0]|<[/!]/g, m => m === '\\' ? '\\\\' : m === '\r' ? '\\r' : m === '\0' ? '\\0' : m === '</' ? '\\/' : '\\!');
+}
+export function decodeCarried(text) {
+  return String(text).replace(/\\([\\/!r0])/g, (_, c) => c === '\\' ? '\\' : c === 'r' ? '\r' : c === '0' ? '\0' : c === '/' ? '</' : '<!');
+}
+export function validateParts(text, {ledger = null, authorship = null} = {}) {
+  // A file's leading BOM is metadata, as in the editor's source intake.
+  const canonical = text.charCodeAt(0) === 0xfeff ? text.slice(1) : text;
+  const history = ledger === null ? null : readLedger(ledger, canonical).ledger;
+  const runs = authorship === null ? null : readAuthorship(authorship, canonical);
+  if (history && runs && canonicalJSON(projectAuthorship(history)) !== canonicalJSON(runs)) throw fault('authorship differs from ledger replay');
+  return {ledger: history, authorship: runs};
+}
+export function writeParts(text, options) {
+  const parts = validateParts(text, options);
+  return Object.entries(parts).filter(([, value]) => value !== null).map(([name, value]) =>
+    '<script type="application/json" id="rapier-' + name + '">' + encodeCarried(JSON.stringify(value)) + '</script>\n').join('');
+}
+// Pure adapter: the browser supplies inert script elements, Node supplies parsed script records.
+export function readParts(text, elements) {
+  const parts = {ledger: null, authorship: null};
+  for (const element of elements) {
+    const name = element.id === 'rapier-ledger' ? 'ledger' : element.id === 'rapier-authorship' ? 'authorship' : null;
+    if (!name) continue;
+    if (parts[name] !== null || element.type !== 'application/json' || (element.tagName && element.tagName.toLowerCase() !== 'script')) throw fault('duplicate or executable carried part');
+    try { parts[name] = JSON.parse(decodeCarried(element.textContent)); }
+    catch (_) { throw fault('invalid carried JSON'); }
+    if (parts[name] === null) throw fault('empty carried part');
+  }
+  return validateParts(text, parts);
+}
+// The wrapper only removes whole script elements. Strings inside other scripts are not carriers.
+export function takeParts(html, text) {
+  const elements = [];
+  const stripped = html.replace(/<script\b([^>]*)>([\s\S]*?)<\/script\s*>/gi, (whole, attrs, content) => {
+    const attributes = [...attrs.matchAll(/(?:^|\s)([\w-]+)\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s>]+))/g)];
+    const ids = attributes.filter(m => m[1].toLowerCase() === 'id').map(m => m[2] ?? m[3] ?? m[4]);
+    if (!ids.some(id => id === 'rapier-ledger' || id === 'rapier-authorship')) return whole;
+    const types = attributes.filter(m => m[1].toLowerCase() === 'type').map(m => m[2] ?? m[3] ?? m[4]);
+    if (ids.length !== 1 || types.length !== 1) throw fault('ambiguous carried part');
+    elements.push({id: ids[0], type: types[0].toLowerCase(), textContent: content}); return '';
+  });
+  if (elements.length && text === null) throw fault('carried history without a document');
+  return {html: stripped, ...readParts(text ?? '', elements)};
+}
+const OPEN = '\n\n<!-- rapier-carried/1\n', CLOSE = '\n-->\n';
+// One optional HTML comment at EOF; every other Markdown reader ignores it. Source is never rewritten.
+export function writeDocument(text, options) {
+  const parts = validateParts(text, options);
+  if (!parts.ledger && !parts.authorship) return text;
+  const json = JSON.stringify(parts).replace(/</g, '\\u003c').replace(/>/g, '\\u003e');
+  return text + OPEN + json + CLOSE;
+}
+export function readDocument(source) {
+  const at = source.lastIndexOf(OPEN);
+  if (at < 0) return {text: source, ledger: null, authorship: null};
+  if (!source.endsWith(CLOSE)) throw fault('unfinished document metadata');
+  let parts;
+  try { parts = JSON.parse(source.slice(at + OPEN.length, -CLOSE.length)); }
+  catch (_) { throw fault('invalid document metadata'); }
+  if (!parts || Object.keys(parts).length !== 2 || !Object.hasOwn(parts, 'ledger') || !Object.hasOwn(parts, 'authorship')) throw fault('invalid document parts');
+  const text = source.slice(0, at);
+  return {text, ...validateParts(text, parts)};
+}

package/dist/kit/ledger/data.mjs

@@ -0,0 +1,33 @@
+// SPDX-License-Identifier: MIT
+// Only plain JSON data enters the public format. Accessors and toJSON are never executed.
+export function fault(message) { return Object.assign(new Error('Ledger: ' + message), {code: 'ledger_invalid'}); }
+export function canonicalJSON(value, depth = 0, active = new Set()) {
+  if (value === null || typeof value === 'boolean') return JSON.stringify(value);
+  if (typeof value === 'string') { if (/[\uD800-\uDFFF]/u.test(value)) throw fault('unpaired surrogate'); return JSON.stringify(value); }
+  if (typeof value === 'number' && Number.isFinite(value) && !Object.is(value, -0)) return JSON.stringify(value);
+  if (!value || typeof value !== 'object' || depth > 64 || active.has(value)) throw fault('not plain JSON data');
+  const array = Array.isArray(value), proto = Object.getPrototypeOf(value);
+  if (!array && proto !== null && (Object.getPrototypeOf(proto) !== null || Object.getOwnPropertyDescriptor(proto, 'constructor')?.value?.name !== 'Object')) throw fault('not a plain object');
+  const descriptors = Object.getOwnPropertyDescriptors(value), keys = Reflect.ownKeys(descriptors);
+  for (const key of keys) {
+    if (array && key === 'length') continue;
+    const field = descriptors[key];
+    if (typeof key !== 'string' || ['__proto__', 'constructor', 'prototype'].includes(key) || !Object.hasOwn(field, 'value') || !field.enumerable) throw fault('non-data property');
+  }
+  if (array && (keys.length !== value.length + 1 || keys.some(k => k !== 'length' && (!/^(0|[1-9]\d*)$/.test(k) || +k >= value.length)))) throw fault('sparse array');
+  active.add(value);
+  const encode = item => canonicalJSON(item, depth + 1, active);
+  const out = array ? '[' + Array.from({length: value.length}, (_, i) => encode(descriptors[i].value)).join(',') + ']'
+    : '{' + keys.sort().map(key => JSON.stringify(key) + ':' + encode(descriptors[key].value)).join(',') + '}';
+  active.delete(value); return out;
+}
+export function plainData(value) { return JSON.parse(canonicalJSON(typeof value === 'string' ? JSON.parse(value) : value)); }
+export function exactKeys(value, keys) {
+  return value && typeof value === 'object' && !Array.isArray(value) && Object.keys(value).length === keys.length && keys.every(key => Object.hasOwn(value, key));
+}
+export function documentText(text) {
+  if (typeof text !== 'string' || /[\uD800-\uDFFF]/u.test(text)) throw fault('document is not whole-character text');
+  if (new TextEncoder().encode(text).length > 25 * 1024 * 1024) throw fault('document exceeds the editor text limit');
+  return text;
+}
+export const nonnegative = value => Number.isSafeInteger(value) && value >= 0 && !Object.is(value, -0);

package/dist/kit/ledger/format.mjs

@@ -0,0 +1,131 @@
+// SPDX-License-Identifier: MIT
+import {_rapierValidLedgerRecord, _rapierRecordSplices, _rapierTransformSplices} from './journal-records.mjs';
+import {textRoot, rootAfter, sha256} from './hash.mjs';
+import {canonicalJSON, plainData, documentText, exactKeys, nonnegative, fault} from './data.mjs';
+export {textRoot, rootAfter};
+const digest = value => sha256(canonicalJSON(value));
+const rootShape = value => typeof value === 'string' && /^\d+:[a-z0-9]+:[a-z0-9]+$/.test(value);
+export function readLedger(input, expectedText) {
+  const ledger = plainData(input);
+  if (!exactKeys(ledger, ['format','documentAuthority','start','records','head','complete','sha256']) || ledger.format !== 'rapier-ledger/1' ||
+      typeof ledger.documentAuthority !== 'string' || !ledger.documentAuthority || ledger.documentAuthority.length > 256 ||
+      typeof ledger.complete !== 'boolean' || !Array.isArray(ledger.records) ||
+      !exactKeys(ledger.start, ['text','revision','root','sha256']) || !exactKeys(ledger.head, ['revision','root','sha256'])) throw fault('invalid envelope');
+  const {sha256: claimed, ...payload} = ledger;
+  if (claimed !== digest(payload)) throw fault('envelope checksum differs');
+  let text = documentText(ledger.start.text), root = ledger.start.root, revision = ledger.start.revision;
+  if (!nonnegative(revision) || !rootShape(root) || (revision === 0 && root !== textRoot(text)) || ledger.start.sha256 !== sha256(text) ||
+      (ledger.complete && revision !== 0)) throw fault('invalid start');
+  const earlier = [];
+  for (const record of ledger.records) {
+    if (!Array.isArray(record.splices) || !record.splices.length || !_rapierValidLedgerRecord(record, earlier.at(-1) || null, earlier,
+        ledger.documentAuthority, 25 * 1024 * 1024, text => new TextEncoder().encode(text).length, !ledger.complete) ||
+        record.transaction.baseRevision < revision || (record.transaction.baseRevision !== revision && ledger.complete) ||
+        (record.transaction.baseRevision === revision && record.beforeHash !== root)) throw fault('record chain differs');
+    // A pruned cancelling pair leaves a stated revision gap, just as in the editor's restore reader.
+    if (record.transaction.baseRevision !== revision) root = record.beforeHash;
+    const next = _rapierTransformSplices(text, record.splices);
+    if (next === null) throw fault('splice does not replay');
+    text = documentText(next);
+    for (const row of record.splices) root = rootAfter(root, row);
+    if (root !== record.afterHash) throw fault('record root differs');
+    revision = record.transaction.revision; earlier.push(record);
+  }
+  if (ledger.head.revision !== revision || ledger.head.root !== root || ledger.head.sha256 !== sha256(text) ||
+      (expectedText !== undefined && text !== expectedText)) throw fault('history does not describe this document');
+  return {ledger, text, root, revision, complete: ledger.complete};
+}
+export function exportLedger({text, records, documentAuthority, revision, root, complete = false, earlier = records} = {}) {
+  documentText(text);
+  if (!Array.isArray(records) || !Array.isArray(earlier)) throw fault('records required');
+  // Inspect before touching properties: exporting must not call accessors on an alleged record.
+  records = plainData(records); earlier = plainData(earlier);
+  const expanded = records.map(record => {
+    const rows = _rapierRecordSplices(record, earlier);
+    if (!rows) throw fault('navigation target was not retained');
+    return {transaction: record.transaction, splices: rows.map(row => ({pos: row.pos, removed: row.removed, inserted: row.inserted})),
+      beforeHash: record.beforeHash, afterHash: record.afterHash};
+  });
+  let startText = text;
+  for (let i = expanded.length - 1; i >= 0; i--) {
+    startText = _rapierTransformSplices(startText, expanded[i].splices, true);
+    if (startText === null) throw fault('history does not reverse from this document');
+  }
+  revision ??= expanded.at(-1)?.transaction.revision ?? 0;
+  root ??= expanded.at(-1)?.afterHash ?? textRoot(text);
+  documentAuthority ??= expanded[0]?.transaction.documentAuthority;
+  const startRevision = expanded[0]?.transaction.baseRevision ?? revision;
+  const payload = {format: 'rapier-ledger/1', documentAuthority,
+    start: {text: startText, revision: startRevision, root: expanded[0]?.beforeHash ?? root, sha256: sha256(startText)},
+    records: expanded, head: {revision, root, sha256: sha256(text)}, complete: complete === true && startRevision === 0 && expanded.every((row, i) => !i || row.transaction.baseRevision === expanded[i - 1].transaction.revision)};
+  const ledger = {...payload, sha256: digest(payload)};
+  readLedger(ledger, text); return ledger;
+}
+// Derived navigation, never a second history. A target older than start is intentionally unavailable.
+export function historyEnvelope(input, segmentIdentity = []) {
+  const {ledger, text} = readLedger(input), ids = new Set(ledger.records.map(row => row.transaction.id));
+  let branch = [], cursor = 0;
+  for (const {transaction: tx} of ledger.records) {
+    const target = tx.reverts || tx.reapplies;
+    if (target) {
+      if (!ids.has(target)) continue;
+      if (tx.reverts && branch[cursor - 1] === target) cursor--;
+      else if (tx.reapplies && branch[cursor] === target) cursor++;
+      else throw fault('invalid navigation order');
+    } else { branch = branch.slice(0, cursor); branch.push(tx.id); cursor = branch.length; }
+  }
+  const byId = new Map(ledger.records.map(row => [row.transaction.id, row]));
+  let traversed = text;
+  for (let i = cursor - 1; i >= 0; i--) {
+    traversed = _rapierTransformSplices(traversed, byId.get(branch[i]).splices, true);
+    if (traversed === null) throw fault('undo branch does not reverse');
+  }
+  traversed = text;
+  for (let i = cursor; i < branch.length; i++) {
+    traversed = _rapierTransformSplices(traversed, byId.get(branch[i]).splices);
+    if (traversed === null) throw fault('redo branch does not replay');
+  }
+  if (ledger.complete) {
+    if (ledger.records.length && !branch.length) throw fault('complete history lost its branch');
+    let active = ledger.start.text;
+    if (!cursor && active !== text) throw fault('complete history start differs');
+    for (let i = 0; i < branch.length; i++) {
+      active = _rapierTransformSplices(active, byId.get(branch[i]).splices);
+      if (active === null || (i + 1 === cursor && active !== text)) throw fault('complete branch differs');
+    }
+  }
+  return {schemaVersion: 4, documentAuthority: ledger.documentAuthority, documentRevision: ledger.head.revision,
+    ledger: ledger.records, branch, cursor, earliestRevision: ledger.start.revision, earliestHash: ledger.start.root,
+    sourceRootId: ledger.head.root, segmentIdentity, historyComplete: ledger.complete,
+    trimReason: ledger.complete ? '' : 'carried_start', trimmedBytes: 0};
+}
+export function agentActorId(door, agent) {
+  if (typeof door !== 'string' || !door || door.length > 160 || /[\u0000-\u001f\u007f]/.test(door)) throw fault('invalid door');
+  if (agent == null) return door;
+  agent = plainData(agent);
+  if (!exactKeys(agent, ['name']) || typeof agent.name !== 'string' || !agent.name.trim() || agent.name.length > 96 ||
+      /[\u0000-\u001f\u007f]/.test(agent.name) || door.length + agent.name.length + 1 > 160) throw fault('invalid host-given name');
+  return door + '/' + agent.name;
+}
+
+// A writer changing representation records that change, rather than attaching an unrelated head.
+export function replaceLedgerText(input, text, {actor = {kind: 'system', id: 'rapier'}, operation = 'document.replace', at} = {}) {
+  const current = readLedger(input); documentText(text);
+  if (current.text === text) return current.ledger;
+  let start = 0, a = current.text.length, b = text.length;
+  while (start < a && start < b && current.text[start] === text[start]) start++;
+  if (start && /[\uDC00-\uDFFF]/.test(current.text[start] || text[start] || '')) start--;
+  while (a > start && b > start && current.text[a - 1] === text[b - 1]) { a--; b--; }
+  if (/[\uDC00-\uDFFF]/.test(current.text[a] || text[b] || '')) { a++; b++; }
+  const splices = [{pos: start, removed: current.text.slice(start, a), inserted: text.slice(start, b)}];
+  const revision = current.revision + 1, root = rootAfter(current.root, splices[0]);
+  const record = {beforeHash: current.root, afterHash: root, splices, transaction: {
+    id: current.ledger.documentAuthority.slice(0, 48) + ':export:' + revision.toString(36),
+    documentAuthority: current.ledger.documentAuthority, baseRevision: current.revision, revision,
+    actor, transport: 'platform', operation, requestId: null, sourceTransactionId: null,
+    affectedBlockIds: [], parent: current.ledger.records.at(-1)?.transaction.id ?? null,
+    reverts: null, reapplies: null, createdAt: at ?? current.ledger.records.at(-1)?.transaction.createdAt ?? 0,
+  }};
+  return exportLedger({text, records: [...current.ledger.records, record], documentAuthority: current.ledger.documentAuthority,
+    revision, root, complete: current.complete});
+}

package/dist/kit/ledger/hash.mjs

@@ -0,0 +1,47 @@
+// SPDX-License-Identifier: MIT
+// The editor's path-dependent root, plus synchronous SHA-256 for file readers (including offline wrappers).
+export function textRoot(text) {
+  let fnv = 0x811c9dc5, a = 1, b = 0;
+  for (let i = 0; i < text.length; i++) {
+    const c = text.charCodeAt(i);
+    fnv = Math.imul(fnv ^ c, 16777619); a = (a + c) % 65521; b = (b + a) % 65521;
+  }
+  return text.length + ':' + (fnv >>> 0).toString(36) + ':' + (((b << 16) | a) >>> 0).toString(36);
+}
+export function rootAfter(root, row) {
+  return textRoot(String(root || '') + ':' + row.pos + ':' + textRoot(row.removed) + ':' + textRoot(row.inserted));
+}
+const K = new Uint32Array([
+  0x428a2f98,0x71374491,0xb5c0fbcf,0xe9b5dba5,0x3956c25b,0x59f111f1,0x923f82a4,0xab1c5ed5,
+  0xd807aa98,0x12835b01,0x243185be,0x550c7dc3,0x72be5d74,0x80deb1fe,0x9bdc06a7,0xc19bf174,
+  0xe49b69c1,0xefbe4786,0x0fc19dc6,0x240ca1cc,0x2de92c6f,0x4a7484aa,0x5cb0a9dc,0x76f988da,
+  0x983e5152,0xa831c66d,0xb00327c8,0xbf597fc7,0xc6e00bf3,0xd5a79147,0x06ca6351,0x14292967,
+  0x27b70a85,0x2e1b2138,0x4d2c6dfc,0x53380d13,0x650a7354,0x766a0abb,0x81c2c92e,0x92722c85,
+  0xa2bfe8a1,0xa81a664b,0xc24b8b70,0xc76c51a3,0xd192e819,0xd6990624,0xf40e3585,0x106aa070,
+  0x19a4c116,0x1e376c08,0x2748774c,0x34b0bcb5,0x391c0cb3,0x4ed8aa4a,0x5b9cca4f,0x682e6ff3,
+  0x748f82ee,0x78a5636f,0x84c87814,0x8cc70208,0x90befffa,0xa4506ceb,0xbef9a3f7,0xc67178f2,
+]);
+const rotate = (x, n) => (x >>> n) | (x << (32 - n));
+export function sha256(text) {
+  const bytes = new TextEncoder().encode(text);
+  const padded = new Uint8Array(Math.ceil((bytes.length + 9) / 64) * 64);
+  padded.set(bytes); padded[bytes.length] = 0x80;
+  const data = new DataView(padded.buffer), bits = bytes.length * 8;
+  data.setUint32(padded.length - 8, Math.floor(bits / 0x100000000)); data.setUint32(padded.length - 4, bits >>> 0);
+  const h = new Uint32Array([0x6a09e667,0xbb67ae85,0x3c6ef372,0xa54ff53a,0x510e527f,0x9b05688c,0x1f83d9ab,0x5be0cd19]), w = new Uint32Array(64);
+  for (let offset = 0; offset < padded.length; offset += 64) {
+    for (let i = 0; i < 16; i++) w[i] = data.getUint32(offset + i * 4);
+    for (let i = 16; i < 64; i++) {
+      const x = w[i - 15], y = w[i - 2];
+      w[i] = w[i - 16] + (rotate(x, 7) ^ rotate(x, 18) ^ (x >>> 3)) + w[i - 7] + (rotate(y, 17) ^ rotate(y, 19) ^ (y >>> 10));
+    }
+    let [a,b,c,d,e,f,g,k] = h;
+    for (let i = 0; i < 64; i++) {
+      const t1 = (k + (rotate(e, 6) ^ rotate(e, 11) ^ rotate(e, 25)) + ((e & f) ^ (~e & g)) + K[i] + w[i]) >>> 0;
+      const t2 = ((rotate(a, 2) ^ rotate(a, 13) ^ rotate(a, 22)) + ((a & b) ^ (a & c) ^ (b & c))) >>> 0;
+      k = g; g = f; f = e; e = (d + t1) >>> 0; d = c; c = b; b = a; a = (t1 + t2) >>> 0;
+    }
+    for (const [i, value] of [a,b,c,d,e,f,g,k].entries()) h[i] += value;
+  }
+  return [...h].map(x => x.toString(16).padStart(8, '0')).join('');
+}

package/dist/kit/ledger/journal-records.mjs

@@ -0,0 +1,139 @@
+// SPDX-License-Identifier: MIT
+
+const _RAPIER_TRANSACTION_ACTOR_LIMIT = 160;
+const _RAPIER_TRANSACTION_OPERATION_LIMIT = 96;
+const _RAPIER_TRANSACTION_REQUEST_LIMIT = 160;
+
+/* Validate every row, not only the final string: a half-pair replacement can produce a whole
+	 character while leaving unencodable fragments in the ledger; two invalid rows can also repair
+	 each other. Refusal is atomic. Pre-existing damage elsewhere stays untouched and editable. */
+function _rapierTransformSplices(text, splices, inverse = false) {
+	try {
+		if (!Array.isArray(splices)) return null;
+		let value = String(text == null ? '' : text);
+		// In Unicode mode a complete pair is one scalar, outside the surrogate range.
+		const whole = text => typeof text === 'string' && !/[\uD800-\uDFFF]/u.test(text);
+		const splitsPair = at => at > 0 && at < value.length &&
+			(value.charCodeAt(at - 1) & 0xFC00) === 0xD800 &&
+			(value.charCodeAt(at) & 0xFC00) === 0xDC00;
+		const rows = inverse ? splices.slice().reverse() : splices;
+		for (const row of rows) {
+			if (!row || !Number.isSafeInteger(row.pos) || row.pos < 0 || Object.is(row.pos, -0)) return null;
+			const pos = row.pos;
+			const removed = inverse ? row.inserted : row.removed;
+			const inserted = inverse ? row.removed : row.inserted;
+			if (!whole(removed) || !whole(inserted) || pos > value.length ||
+					pos + removed.length > value.length || splitsPair(pos) || splitsPair(pos + removed.length) ||
+					value.slice(pos, pos + removed.length) !== removed) return null;
+			value = value.slice(0, pos) + inserted + value.slice(pos + removed.length);
+		}
+		return value;
+	} catch (_) { return null; }
+}
+
+function _rapierRecordSplices(entry, ledger) {
+	try {
+		if (entry && Array.isArray(entry.splices) && entry.splices.length) return entry.splices;
+		const transaction = entry && entry.transaction;
+		const targetId = String(transaction?.reverts || transaction?.reapplies || '');
+		const target = targetId && (ledger || []).find(record => record?.transaction?.id === targetId);
+		if (!target || !Array.isArray(target.splices) || !target.splices.length) return null;
+		return transaction.reverts ? target.splices.slice().reverse().map(row => ({
+			pos: row.pos, removed: row.inserted, inserted: row.removed,
+		})) : target.splices;
+	} catch (_) { return null; }
+}
+
+// A ledger record as the journal and the Notes return validate it below: plain data, nothing
+// undefined anywhere in it. A live record could carry a row whose type or order was not yet known
+// (a block just inserted, before its first render: `type: undefined`), and the validator refused
+// the whole ledger for that one field -- silently at boot, where a refused ledger is cleared, and on
+// the founder's phone as "Rapier could not be reopened: the document history could not be restored"
+// on every return from Notes (24 September). The copy is made once per record; records are frozen,
+// so it never goes stale.
+const _rapierJournalRecord = (() => {
+	const copies = new WeakMap();
+	return record => {
+		let copy = copies.get(record);
+		if (!copy) { copy = JSON.parse(JSON.stringify(record)); copies.set(record, copy); }
+		return copy;
+	};
+})();
+
+function _rapierValidLedgerRecord(record, prior, earlier, documentAuthority, maxDocumentBytes, utf8Length, allowGap = false) {
+	// Recovery records are data, not executable objects. Inspect descriptors without invoking
+	// accessors, and use an ancestor set (not a global seen set) so shared acyclic data stays valid.
+	// Iterative traversal refuses cycles without exhausting the call stack. Proxies/counters that
+	// throw are refused by the same gate rather than escaping into document recovery.
+	try {
+		const active = new Set(), pending = [[record, false]];
+		while (pending.length) {
+			const [value, leaving] = pending.pop();
+			if (leaving) { active.delete(value); continue; }
+			if (value === null || typeof value === 'string' || typeof value === 'boolean') continue;
+			if (typeof value === 'number') { if (!Number.isFinite(value)) return false; continue; }
+			if (!value || typeof value !== 'object' || active.has(value)) return false;
+			const array = Array.isArray(value), proto = Object.getPrototypeOf(value);
+			if (!array && proto !== null && (Object.getPrototypeOf(proto) !== null ||
+					Object.getOwnPropertyDescriptor(proto, 'constructor')?.value?.name !== 'Object')) return false;
+			const keys = Reflect.ownKeys(value);
+			if (array && keys.length !== value.length + 1) return false;
+			active.add(value); pending.push([value, true]);
+			for (const key of keys) {
+				if (array && key === 'length') continue;
+				if (typeof key !== 'string' || key === '__proto__' || key === 'constructor' || key === 'prototype' ||
+						(array && (!Number.isSafeInteger(Number(key)) || Number(key) < 0 ||
+							Number(key) >= value.length || String(Number(key)) !== key))) return false;
+				const field = Object.getOwnPropertyDescriptor(value, key);
+				if (!field || !Object.hasOwn(field, 'value')) return false;
+				pending.push([field.value, false]);
+			}
+		}
+		if (!record || typeof record !== 'object' ||
+				typeof record.beforeHash !== 'string' || !record.beforeHash.length ||
+				typeof record.afterHash !== 'string' || !record.afterHash.length || record.beforeHash === record.afterHash) return false;
+		const own = Array.isArray(record.splices) && record.splices.length;
+		const navigation = !!(record.transaction?.reverts || record.transaction?.reapplies);
+		if ((!own && !navigation) || (own && record.splices.length > 64) ||
+				(record.transaction?.reverts && record.transaction?.reapplies)) return false;
+		const splices = _rapierRecordSplices(record, earlier);
+		if (!splices || splices.length > 64 || !splices.every(row =>
+				row && Number.isSafeInteger(row.pos) && row.pos >= 0 && !Object.is(row.pos, -0) &&
+				typeof row.removed === 'string' && typeof row.inserted === 'string' &&
+				!/[\uD800-\uDFFF]/u.test(row.removed) && !/[\uD800-\uDFFF]/u.test(row.inserted) &&
+				utf8Length(row.removed) <= maxDocumentBytes &&
+				utf8Length(row.inserted) <= maxDocumentBytes)) return false;
+		const transaction = record.transaction;
+		const nullableText = (value, limit, empty = true) => value === null ||
+			(typeof value === 'string' && value.length <= limit && (empty || value.length > 0));
+		if (!transaction || typeof transaction.id !== 'string' || !transaction.id.length ||
+				transaction.id.length > 256 || !Array.isArray(earlier) ||
+				earlier.some(row => row?.transaction?.id === transaction.id) ||
+				typeof transaction.documentAuthority !== 'string' ||
+				transaction.documentAuthority !== documentAuthority ||
+				(transaction.transport !== 'platform' && transaction.transport !== 'webmcp') ||
+				typeof transaction.operation !== 'string' || !transaction.operation.length ||
+				transaction.operation.length > _RAPIER_TRANSACTION_OPERATION_LIMIT ||
+				!nullableText(transaction.requestId, _RAPIER_TRANSACTION_REQUEST_LIMIT) ||
+				!nullableText(transaction.sourceTransactionId, _RAPIER_TRANSACTION_REQUEST_LIMIT) ||
+				!nullableText(transaction.parent, 256, false) ||
+				!nullableText(transaction.reverts, 256, false) ||
+				!nullableText(transaction.reapplies, 256, false) ||
+				!Number.isSafeInteger(transaction.createdAt) || transaction.createdAt < 0 ||
+				!Array.isArray(transaction.affectedBlockIds) || transaction.affectedBlockIds.length > 64 ||
+				!transaction.affectedBlockIds.every(id => Number.isSafeInteger(id) && id >= 0) ||
+				!Number.isSafeInteger(transaction.revision) || transaction.revision < 1 ||
+				!Number.isSafeInteger(transaction.baseRevision) ||
+				transaction.baseRevision + 1 !== transaction.revision ||
+				(prior && (transaction.revision <= prior.transaction.revision ||
+					(transaction.baseRevision === prior.transaction.revision
+						? (transaction.parent !== prior.transaction.id || record.beforeHash !== prior.afterHash)
+						: (!allowGap || transaction.baseRevision <= prior.transaction.revision))))) return false;
+		return !!transaction.actor && typeof transaction.actor.kind === 'string' &&
+			/^(?:human|agent|system)$/.test(transaction.actor.kind) &&
+			typeof transaction.actor.id === 'string' && transaction.actor.id.length > 0 &&
+			transaction.actor.id.length <= _RAPIER_TRANSACTION_ACTOR_LIMIT;
+	} catch (_) { return false; }
+}
+
+export { _RAPIER_TRANSACTION_ACTOR_LIMIT, _RAPIER_TRANSACTION_OPERATION_LIMIT, _RAPIER_TRANSACTION_REQUEST_LIMIT, _rapierTransformSplices, _rapierRecordSplices, _rapierValidLedgerRecord, _rapierJournalRecord};

package/dist/kit/ledger/merge.mjs

@@ -0,0 +1,101 @@
+// SPDX-License-Identifier: MIT
+import {readLedger, exportLedger, rootAfter} from './format.mjs';
+import {_rapierTransformSplices} from './journal-records.mjs';
+import {mergeText} from './text-merge.mjs';
+import {parseWill} from '../../agent/will.mjs';
+import {sha256} from './hash.mjs';
+import {canonicalJSON, fault} from './data.mjs';
+// The same interval transport used by the agent kernel, now shared with the public ledger.
+export function transportInterval(start, end, splices) {
+  let a = start, b = end;
+  for (const row of splices) {
+    if (!Number.isSafeInteger(row.pos) || row.pos < 0) return null;
+    if (row.pos + row.removed.length <= a) {
+      const delta = row.inserted.length - row.removed.length; a += delta; b += delta;
+    } else if (row.pos < b || (a === b && row.pos < a && row.pos + row.removed.length > a)) return null;
+  }
+  return {start: a, end: b};
+}
+function over(row, other) {
+  // Equal-position insertions have no ordering evidence. Review, never a lexical winner.
+  if (!row.removed.length && !other.removed.length && row.pos === other.pos) return null;
+  const range = transportInterval(row.pos, row.pos + row.removed.length, [other]);
+  return range ? {...row, pos: range.start} : null;
+}
+const recordKey = record => sha256(canonicalJSON(record));
+const origin = record => record.transaction.sourceTransactionId?.startsWith('ledger:') ? record.transaction.sourceTransactionId : 'ledger:' + recordKey(record);
+function checkpointList(read) {
+  const list = [{root: read.ledger.start.root, text: read.ledger.start.text, index: 0}], records = read.ledger.records;
+  let text = read.ledger.start.text;
+  for (let i = 0; i < records.length; i++) { text = _rapierTransformSplices(text, records[i].splices); list.push({root: records[i].afterHash, text, index: i + 1}); }
+  return list;
+}
+function kept(text) {
+  const will = parseWill(text);
+  if (will.fault) return {fault: will.fault, text};
+  return will.regions.filter(region => region.law === 'keep').map(region => text.slice(region.start, region.end));
+}
+export function merge(first, second) {
+  const ours = readLedger(first), theirs = readLedger(second);
+  // A reviewed conflict receipt names the complete incoming envelope: it too is idempotent.
+  if (ours.ledger.records.some(record => record.transaction.operation === 'document.merge' && record.transaction.sourceTransactionId === 'ledger:' + theirs.ledger.sha256)) {
+    const clean = !ours.text.includes('<!-- note-conflict:v1 ');
+    return {text: ours.text, ledger: ours.ledger, clean, conflicts: [], review: {required: !clean, base: ours.text, proposed: ours.text}};
+  }
+  const a = checkpointList(ours), b = checkpointList(theirs);
+  let common = null;
+  for (let i = b.length - 1; i >= 0 && !common; i--) {
+    const found = a.findLast(point => point.root === b[i].root && point.text === b[i].text);
+    if (found) common = {ours: found.index, theirs: b[i].index, text: found.text};
+  }
+  if (!common) throw fault('copies have no proven common start');
+  const records = ours.ledger.records.slice(), imported = new Set(records.map(origin));
+  let text = ours.text, root = ours.root;
+  const append = (splices, actor, sourceId, operation, at) => {
+    const next = _rapierTransformSplices(text, splices);
+    if (next === null) throw fault('transported record failed replay');
+    const beforeHash = root, revision = (records.at(-1)?.transaction.revision ?? ours.ledger.start.revision) + 1;
+    for (const row of splices) root = rootAfter(root, row);
+    records.push({beforeHash, afterHash: root, splices, transaction: {
+      id: ours.ledger.documentAuthority.slice(0, 48) + ':merge:' + revision.toString(36), documentAuthority: ours.ledger.documentAuthority,
+      baseRevision: revision - 1, revision, actor, transport: 'platform', operation, requestId: null,
+      sourceTransactionId: sourceId, affectedBlockIds: [], parent: records.at(-1)?.transaction.id ?? null,
+      reverts: null, reapplies: null, createdAt: at,
+    }}); text = next;
+  };
+  let against = ours.ledger.records.slice(common.ours).flatMap(record => record.splices.map(row => ({...row})));
+  const incoming = theirs.ledger.records.slice(common.theirs);
+  // Complete repeats are detected by record content, never the revision ID (copies can reuse IDs).
+  const unseen = incoming.filter(record => !imported.has(origin(record)));
+  const keepDiffers = canonicalJSON(kept(ours.text)) !== canonicalJSON(kept(theirs.text));
+  let conflicted = keepDiffers && unseen.length > 0;
+  if (!conflicted && unseen.length && unseen.length !== incoming.length) conflicted = true; // partial receipt needs a common text merge
+  if (!conflicted) for (const record of unseen) {
+    const moved = [];
+    for (const splice of record.splices) {
+      let row = {...splice}; const nextAgainst = [];
+      for (const other of against) {
+        const next = over(row, other), otherNext = over(other, row);
+        if (!next || !otherNext) { conflicted = true; break; }
+        nextAgainst.push(otherNext); row = next;
+      }
+      if (conflicted) break;
+      moved.push(row); against = nextAgainst;
+    }
+    if (conflicted || _rapierTransformSplices(text, moved) === null) { conflicted = true; break; }
+    append(moved, record.transaction.actor, origin(record), record.transaction.operation, record.transaction.createdAt);
+  }
+  let conflicts = [];
+  if (conflicted) {
+    // Restart from the original local head: partially transported records never leak into a conflict result.
+    records.splice(ours.ledger.records.length); text = ours.text; root = ours.root;
+    const merged = mergeText(keepDiffers ? null : common.text, ours.text, theirs.text, {oursId: 'copy-' + ours.ledger.sha256.slice(0, 16), theirsId: 'copy-' + theirs.ledger.sha256.slice(0, 16)});
+    conflicts = merged.conflicts;
+    if (merged.text !== text) append([{pos: 0, removed: text, inserted: merged.text}], {kind: 'system', id: 'merge'},
+      'ledger:' + theirs.ledger.sha256, 'document.merge', Math.max(0, ...incoming.map(record => record.transaction.createdAt)));
+  }
+  const ledger = exportLedger({text, records, documentAuthority: ours.ledger.documentAuthority, root,
+    revision: records.at(-1)?.transaction.revision ?? ours.revision, complete: ours.complete});
+  const clean = !conflicts.length && !text.includes('<!-- note-conflict:v1 ');
+  return {text, ledger, clean, conflicts, review: {required: !clean, base: ours.text, proposed: text}};
+}

package/dist/kit/ledger/text-merge.mjs

@@ -0,0 +1,345 @@
+// SPDX-License-Identifier: MIT
+// Shared conflict envelopes and exact three-way text merge; Notes and the ledger import this owner.
+function textFault(code, message) { return Object.assign(new Error(message), {code}); }
+export function canonicalNote(text) {
+	if (typeof text !== 'string') throw textFault('note_text', 'A note must be text');
+	for (let i = 0; i < text.length; i++) {
+		const c = text.charCodeAt(i);
+		if (c >= 0xd800 && c <= 0xdbff) {
+			const next = text.charCodeAt(++i);
+			if (!(next >= 0xdc00 && next <= 0xdfff)) throw textFault('note_unicode', 'An unpaired surrogate has no exact UTF-8 bytes');
+		} else if (c >= 0xdc00 && c <= 0xdfff) throw textFault('note_unicode', 'An unpaired surrogate has no exact UTF-8 bytes');
+	}
+	return text;
+}
+
+const TEXT_CONFLICT = '<!-- note-conflict:v1 ';
+const textLine = line => line.replace(/(?:\r\n|\r|\n)$/, '');
+const textBlank = line => /^[ \t]*$/.test(textLine(line));
+const textSpace = unit => /^[ \t\r\n]*$/.test(unit);
+const textList = line => /^( {0,3})(?:[-+*]|\d{1,9}[.)])[ \t]+/.exec(line);
+const textFence = line => /^ {0,3}(`{3,}|~{3,})(.*)$/.exec(line);
+const textRule = line => /^ {0,3}(?:(?:\*[ \t]*){3,}|(?:-[ \t]*){3,}|(?:_[ \t]*){3,})$/.test(line);
+const textHeading = line => /^ {0,3}#{1,6}(?:[ \t]|$)/.test(line);
+const textDefinition = line => /^ {0,3}\[(?:\\.|[^\]\\\r\n])+\]:/.test(line);
+const textStart = line => textHeading(line) || textRule(line) || textFence(line) || /^ {0,3}(?:[-+*]|1[.)])[ \t]+/.test(line) || /^ {0,3}(?:>|<!--|<(?:script|style|pre|textarea)(?:\s|>))/i.test(line);
+
+// Only the exact public envelope is structural; malformed comments and fenced examples stay text.
+function textEnvelopeAt(text, start = 0) {
+	if (!text.startsWith(TEXT_CONFLICT, start)) return null;
+	const headerEnd = text.indexOf(' -->\n\n', start), variants = [];
+	if (headerEnd < 0) return null;
+	let header;
+	try { header = JSON.parse(text.slice(start + TEXT_CONFLICT.length, headerEnd)); } catch { return null; }
+	if (!header || typeof header.id !== 'string' || !Array.isArray(header.variants) || header.variants.length < 2) return null;
+	let at = headerEnd + 6;
+	for (const item of header.variants) {
+		if (!item || typeof item.device !== 'string' || !/^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/.test(item.device) || !Number.isSafeInteger(item.length) || item.length < 0) return null;
+		const label = '**Version from ' + item.device + '**\n\n';
+		if (!text.startsWith(label, at)) return null;
+		at += label.length;
+		const fence = /^(`{3,})markdown\n/.exec(text.slice(at));
+		if (!fence) return null;
+		at += fence[0].length;
+		const value = text.slice(at, at + item.length); at += item.length;
+		const tail = (value.endsWith('\n') ? '' : '\n') + fence[1] + '\n\n';
+		if (!text.startsWith(tail, at)) return null;
+		at += tail.length; variants.push({device: item.device, text: value});
+	}
+	const tail = '<!-- /note-conflict:v1 -->\n';
+	if (!text.startsWith(tail, at)) return null;
+	const end = at + tail.length, block = text.slice(start, end);
+	if (textEnvelope(header.id, variants) !== block) return null;
+	return {kind: 'text', id: header.id, start, end, block, variants};
+}
+
+export function inspectTextConflicts(text, {nested = false} = {}) {
+	canonicalNote(text);
+	const out = []; let at = 0;
+	for (const unit of textUnits(text)) {
+		const found = textEnvelopeAt(unit);
+		if (found && found.end === unit.length) {
+			out.push({...found, start: at, end: at + unit.length});
+			// Nested offsets belong to their alternative's source; custody callers use
+			// the exact block bytes. Ordinary fenced examples remain opaque at every level.
+			if (nested) for (const variant of found.variants) out.push(...inspectTextConflicts(variant.text, {nested}));
+		}
+		at += unit.length;
+	}
+	return out;
+}
+
+export function mapTextConflictVariants(text, mapper) {
+	const conflicts = inspectTextConflicts(text); let out = '', at = 0;
+	for (const block of conflicts) {
+		out += text.slice(at, block.start) + textEnvelope(block.id, block.variants.map(variant => ({
+			device: variant.device, text: canonicalNote(mapper(mapTextConflictVariants(variant.text, mapper), variant.device)),
+		})));
+		at = block.end;
+	}
+	return out + text.slice(at);
+}
+
+// This is a conservative edit boundary scan, never the document's rendering grammar.
+function textUnits(text) {
+	const lines = text.match(/[^\r\n]*(?:\r\n|\r|\n)|[^\r\n]+$/g) || [], out = [], offsets = [0];
+	for (const line of lines) offsets.push(offsets[offsets.length - 1] + line.length);
+	for (let i = 0; i < lines.length;) {
+		const start = i, first = textLine(lines[i]).replace(/^\ufeff/, ''), list = textList(first), fence = textFence(first);
+		const envelope = first.startsWith(TEXT_CONFLICT) ? textEnvelopeAt(text, offsets[i]) : null;
+		if (envelope) {
+			while (i < lines.length && offsets[i] < envelope.end) i++;
+			out.push(lines.slice(start, i).join('')); continue;
+		}
+		if (textBlank(lines[i])) { while (++i < lines.length && textBlank(lines[i])) {} }
+		else if (fence) {
+			const mark = fence[1][0], count = fence[1].length;
+			i++;
+			while (i < lines.length) {
+				const close = new RegExp('^ {0,3}' + (mark === '`' ? '`' : '~') + '{' + count + ',}[ \\t]*$').test(textLine(lines[i++]));
+				if (close) break;
+			}
+		} else if (list) {
+			const indent = list[1].length;
+			i++;
+			while (i < lines.length) {
+				const line = textLine(lines[i]), next = textList(line);
+				if (next && next[1].length <= indent) break;
+				if (textBlank(lines[i])) {
+					let j = i; while (j < lines.length && textBlank(lines[j])) j++;
+					if (j === lines.length || !new RegExp('^(?: {' + (indent + 1) + ',}|\\t)').test(lines[j])) break;
+					i = j; continue;
+				}
+				if (!/^[ \t]/.test(line) && textStart(line)) break;
+				i++;
+			}
+		} else if (/^ {0,3}>/.test(first)) {
+			i++;
+			while (i < lines.length) {
+				if (textBlank(lines[i])) {
+					let j = i; while (j < lines.length && textBlank(lines[j])) j++;
+					if (j === lines.length || !/^ {0,3}>/.test(lines[j])) break;
+					i = j; continue;
+				}
+				if (!/^ {0,3}>/.test(lines[i]) && textStart(textLine(lines[i]))) break;
+				i++;
+			}
+		} else if (/^ {0,3}<!--/.test(first)) {
+			i++;
+			if (!first.includes('-->')) while (i < lines.length && !lines[i++].includes('-->')) {}
+		} else if (/^ {0,3}<(script|style|pre|textarea)(?:\s|>)/i.test(first)) {
+			const tag = /^ {0,3}<([a-z]+)/i.exec(first)[1]; i++;
+			if (!new RegExp('</' + tag + '\\s*>', 'i').test(first)) while (i < lines.length && !new RegExp('</' + tag + '\\s*>', 'i').test(lines[i++])) {}
+		} else if (textHeading(first) || textRule(first)) i++;
+		else {
+			i++;
+			while (i < lines.length && !textBlank(lines[i])) {
+				if (/^ {0,3}(?:=+|-+)[ \t]*$/.test(textLine(lines[i]))) { i++; break; }
+				if (textStart(textLine(lines[i]))) break;
+				i++;
+			}
+			if (textDefinition(first) || /^(?: {4}|\t)/.test(first)) {
+				while (i < lines.length) {
+					let j = i; while (j < lines.length && textBlank(lines[j])) j++;
+					if (j === lines.length || !/^(?: {4}|\t)/.test(lines[j])) break;
+					i = j + 1; while (i < lines.length && !textBlank(lines[i]) && /^(?: {4}|\t)/.test(lines[i])) i++;
+				}
+			}
+		}
+		out.push(lines.slice(start, i).join(''));
+	}
+	return out;
+}
+
+function textEdits(base, side) {
+	const n = base.length, m = side.length;
+	if ((n + 1) * (m + 1) > 1000000) return null;
+	const width = m + 1, score = new Uint32Array((n + 1) * width);
+	for (let i = n - 1; i >= 0; i--) for (let j = m - 1; j >= 0; j--) {
+		const p = i * width + j;
+		score[p] = base[i] === side[j] ? score[p + width + 1] + 1 : Math.max(score[p + width], score[p + 1]);
+	}
+	const walk = () => {
+		const pairs = []; let i = 0, j = 0;
+		while (i < n && j < m) {
+			const value = score[i * width + j]; if (!value) break;
+			if (base[i] === side[j]) { pairs.push([i++, j++]); continue; }
+			if (score[(i + 1) * width + j] >= score[i * width + j + 1]) i++; else j++;
+		}
+		return pairs;
+	};
+	const pairs = walk(), meaningful = pairs.filter(([i]) => !textSpace(base[i]));
+	// Every optimal path must agree on every authored anchor, not just two greedy walks.
+	const seen = new Uint32Array(score.length); seen.fill(0xffffffff); seen[0] = 0;
+	for (let i = 0; i <= n; i++) for (let j = 0; j <= m; j++) {
+		const p = i * width + j, at = seen[p]; if (at === 0xffffffff) continue;
+		const visit = (next, count) => { if (seen[next] !== 0xffffffff && seen[next] !== count) return false; seen[next] = count; return true; };
+		if (i < n && score[p + width] === score[p] && !visit(p + width, at)) return null;
+		if (j < m && score[p + 1] === score[p] && !visit(p + 1, at)) return null;
+		if (i < n && j < m && base[i] === side[j] && score[p] === score[p + width + 1] + 1) {
+			const content = !textSpace(base[i]);
+			if (content && (meaningful[at]?.[0] !== i || meaningful[at]?.[1] !== j)) return null;
+			if (!visit(p + width + 1, at + (content ? 1 : 0))) return null;
+		}
+	}
+	if (seen[n * width + m] !== meaningful.length) return null;
+	const edits = []; let i = 0, j = 0;
+	for (const [bi, sj] of [...pairs, [n, m]]) {
+		if (i !== bi || j !== sj) edits.push({start: i, end: bi, text: side.slice(j, sj).join('')});
+		i = bi + 1; j = sj + 1;
+	}
+	return edits;
+}
+
+function textTick(base, a, b) {
+	const box = value => {
+		const m = /^( {0,3}(?:[-+*]|\d{1,9}[.)])[ \t]+\[)([ xX])(\])/.exec(value);
+		return m && {at: m[1].length, tick: m[2], body: value.slice(0, m[1].length) + ' ' + value.slice(m[1].length + 1)};
+	};
+	const c = box(base); if (!c) return null;
+	// One side ticked, the other added lines: the tick lands on the item found whole among the other side's units. Ambiguity is a conflict.
+	const au = textUnits(a), bu = textUnits(b);
+	if (au.length !== 1 || bu.length !== 1) {
+		const [one, many] = au.length === 1 ? [a, bu] : bu.length === 1 ? [b, au] : [null, null];
+		const x = one === null ? null : box(one);
+		if (!x || x.body !== c.body || x.tick === c.tick) return null;
+		const at = many.map((unit, i) => unit === base ? i : -1).filter(i => i >= 0);
+		if (at.length !== 1) return null;
+		return many.map((unit, i) => i === at[0] ? one : unit).join('');
+	}
+	const x = box(a), y = box(b); if (!x || !y) return null;
+	const body = x.body === y.body ? x.body : x.body === c.body ? y.body : y.body === c.body ? x.body : null;
+	if (body === null) return null;
+	const marked = x.tick !== ' ' && y.tick !== ' ' ? [x.tick, y.tick].sort()[0] : x.tick === c.tick ? y.tick : y.tick === c.tick ? x.tick : null;
+	const at = box(body).at;
+	return marked === null ? null : body.slice(0, at) + marked + body.slice(at + 1);
+}
+
+function textDeviceOptions(options) {
+	const {oursId, theirsId} = options || {};
+	if (![oursId, theirsId].every(id => typeof id === 'string' && /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/.test(id)) || oursId === theirsId) {
+		throw textFault('merge_devices', 'A conflict needs two distinct stable device identifiers');
+	}
+	return [oursId, theirsId];
+}
+
+function textEnvelope(id, variants) {
+	let longest = 2;
+	for (const v of variants) for (const run of v.text.match(/`+/g) || []) longest = Math.max(longest, run.length);
+	const fence = '`'.repeat(longest + 1);
+	let out = TEXT_CONFLICT + JSON.stringify({id, variants: variants.map(v => ({device: v.device, length: v.text.length}))}) + ' -->\n\n';
+	for (const v of variants) {
+		out += '**Version from ' + v.device + '**\n\n' + fence + 'markdown\n' + v.text + (v.text.endsWith('\n') ? '' : '\n') + fence + '\n\n';
+	}
+	return out + '<!-- /note-conflict:v1 -->\n';
+}
+
+function textDeclarations(text) {
+	text = textUnits(text).filter(unit => !textEnvelopeAt(unit)).join('');
+	// A definition can move a destination/title onto the next unindented line, or span its label.
+	const definitions = text.match(/^\ufeff? {0,3}\[(?:\\.|[^\]\\])+\]:[^\r\n]*(?:(?:\r\n|\r|\n)(?![ 	]*(?:\r\n|\r|\n|$))[^\r\n]*)*/gm) || [];
+	const continuations = textUnits(text).filter(unit => /^\ufeff? {0,3}\[\^/.test(unit));
+	return [...definitions, ...continuations, ...(text.match(/<!--[\s\S]*?(?:-->|$)/g) || [])].join('\0');
+}
+
+export function mergeText(base, ours, theirs, options = {}) {
+	canonicalNote(ours); canonicalNote(theirs); if (base !== null) canonicalNote(base);
+	const unchanged = value => ({text: value, clean: !value.includes(TEXT_CONFLICT), conflicts: value.includes(TEXT_CONFLICT) ? [{kind: 'existing-conflict', advisory: true}] : []});
+	if (ours === theirs) return unchanged(ours);
+	if (base === ours) return unchanged(theirs);
+	if (base === theirs) return unchanged(ours);
+	const conflicts = []; let text = '';
+	const conflict = (before, a, b, kind) => {
+		// Shared framing remains ordinary text; only the changed region is a choice.
+		const ab = inspectTextConflicts(a), bb = inspectTextConflicts(b);
+		const au = textUnits(a), bu = textUnits(b); let first = 0, last = 0;
+		while (first < Math.min(au.length, bu.length) && au[first] === bu[first]) first++;
+		while (last < Math.min(au.length, bu.length) - first && au[au.length - 1 - last] === bu[bu.length - 1 - last]) last++;
+		if ((ab.length || bb.length) && (first || last)) {
+			const prefix = au.slice(0, first).join(''), suffix = last ? au.slice(-last).join('') : '';
+			text += prefix;
+			conflict(null, au.slice(first, last ? -last : undefined).join(''), bu.slice(first, last ? -last : undefined).join(''), kind);
+			text += suffix; return;
+		}
+		// A shared unresolved region is an anchor even when its alternatives have grown. Splitting
+		// around it keeps surrounding edits in their own choices instead of quoting an old choice.
+		const overlaps = (x, y) => x.variants.some(v => y.variants.some(w => v.device === w.device && v.text === w.text));
+		const anchor = ab.map(x => ({x, matches: bb.filter(y => overlaps(x, y))})).find(({x, matches}) =>
+			matches.length === 1 && ab.filter(y => overlaps(y, matches[0])).length === 1 &&
+			(x.start || matches[0].start || x.end < a.length || matches[0].end < b.length));
+		if (anchor) {
+			const {x, matches: [y]} = anchor;
+			for (const [av, bv] of [[a.slice(0, x.start), b.slice(0, y.start)], [x.block, y.block], [a.slice(x.end), b.slice(y.end)]]) {
+				if (av === bv) text += av; else conflict(null, av, bv, kind);
+			}
+			return;
+		}
+		const ids = textDeviceOptions(options), candidates = [{device: ids[0], text: a}, {device: ids[1], text: b}];
+		const variants = [...new Map(candidates.flatMap(v => {
+			const block = textEnvelopeAt(v.text);
+			return block && block.end === v.text.length ? block.variants : [v];
+		}).map(v => [JSON.stringify(v), v])).values()].sort((x, y) => x.device < y.device ? -1 : x.device > y.device ? 1 : x.text < y.text ? -1 : x.text > y.text ? 1 : 0);
+		if (text && !/[\r\n]$/.test(text)) text += '\n\n';
+		const start = text.length, block = textEnvelope(String(conflicts.length), variants);
+		conflicts.push({kind, base: before, variants, start, end: start + block.length, block});
+		text += block;
+	};
+	if (base === null) conflict(null, ours, theirs, 'no-ancestor');
+	else if (textDeclarations(ours) !== textDeclarations(base) || textDeclarations(theirs) !== textDeclarations(base)) conflict(base, ours, theirs, 'document-bindings');
+	else {
+		const units = textUnits(base), a = textEdits(units, textUnits(ours)), b = textEdits(units, textUnits(theirs));
+		if (!a || !b) conflict(base, ours, theirs, 'ambiguous-alignment-or-budget');
+		else {
+			const changes = [...a.map(e => ({...e, side: 0})), ...b.map(e => ({...e, side: 1}))].sort((x, y) => x.start - y.start || x.end - y.end || x.side - y.side);
+			let pos = 0;
+			for (let i = 0; i < changes.length;) {
+				const group = [changes[i++]], start = group[0].start; let end = group[0].end;
+				// An insertion can anchor on either side of a blank run; that is still one gap.
+				while (i < changes.length && (changes[i].start < end || group.some(e => {
+					const next = changes[i];
+					// Appending after an unresolved block does not edit any of its alternatives.
+					const afterBlock = (edit, insert) => insert.start === insert.end && insert.start === edit.end && edit.start < edit.end && units.slice(edit.start, edit.end).every(unit => textEnvelopeAt(unit));
+					if (afterBlock(e, next) || afterBlock(next, e)) return false;
+					if (e.start === e.end && next.start <= e.start && e.start <= next.end) return true;
+					if (next.start === next.end && e.start <= next.start && next.start <= e.end) return true;
+					return next.start >= e.end && units.slice(e.start, e.end).every(textSpace) &&
+						units.slice(e.end, next.start).every(textSpace) && units.slice(next.start, next.end).every(textSpace);
+				}))) {
+					group.push(changes[i]); end = Math.max(end, changes[i++].end);
+				}
+				text += units.slice(pos, start).join('');
+				const before = units.slice(start, end).join('');
+				const version = side => {
+					let value = '', at = start;
+					for (const e of group.filter(e => e.side === side)) { value += units.slice(at, e.start).join('') + e.text; at = e.end; }
+					return value + units.slice(at, end).join('');
+				};
+				const av = version(0), bv = version(1);
+				if (av === bv) text += av;
+				else if (av === before) text += bv;
+				else if (bv === before) text += av;
+				else {
+					const tick = end === start + 1 ? textTick(before, av, bv) : null;
+					if (tick !== null) text += tick; else conflict(before, av, bv, 'text');
+				}
+				pos = end;
+			}
+			text += units.slice(pos).join('');
+		}
+	}
+	return {text, clean: conflicts.length === 0 && !text.includes(TEXT_CONFLICT), conflicts};
+}
+
+// A marker is advisory data. The caller supplies its trusted descriptor and current revision.
+export function resolveTextConflict(text, conflict, device) {
+	canonicalNote(text);
+	if (!conflict || !Number.isInteger(conflict.start) || !Number.isInteger(conflict.end) || conflict.start < 0 || conflict.end < conflict.start || text.slice(conflict.start, conflict.end) !== conflict.block) {
+		throw textFault('merge_stale', 'The inspected conflict changed');
+	}
+	const matches = Number.isInteger(device) ? [conflict.variants?.[device]].filter(Boolean) : conflict.variants?.filter(v => v.device === device) || [];
+	const version = matches.length === 1 ? matches[0] : null;
+	if (!version) throw textFault('merge_choice', 'Choose one inspected version');
+	canonicalNote(version.text);
+	return text.slice(0, conflict.start) + version.text + text.slice(conflict.end);
+}
+

package/dist/kit/rapier-ledger.mjs

@@ -0,0 +1,9 @@
+// SPDX-License-Identifier: MIT
+import {exportLedger, replaceLedgerText, readLedger, textRoot, rootAfter, historyEnvelope, agentActorId} from './ledger/format.mjs';
+export {exportLedger, replaceLedgerText, readLedger, textRoot, rootAfter, historyEnvelope, agentActorId};
+import {authorship, readAuthorship, ledgerFromAuthorship} from './ledger/authorship.mjs';
+export {authorship, readAuthorship, ledgerFromAuthorship};
+import {merge, transportInterval} from './ledger/merge.mjs';
+export {merge, transportInterval};
+import {_rapierTransformSplices, _rapierRecordSplices, _rapierValidLedgerRecord} from './ledger/journal-records.mjs';
+export {_rapierTransformSplices, _rapierRecordSplices, _rapierValidLedgerRecord};

package/dist/kit/render.mjs

@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: MIT
 // The document's renderer. DOM, codecs and host state are explicit inputs.
 function createRenderer(runtime) {
-  const {RAPIER_COLOR_CLOSE, RapierPageReturnAddress, RapierTextCodec, _rapierArtifactHighlight, _rapierArtifactLexerScript, _rapierArtifactMarkLexed, _rapierArtifactPreference, _rapierArtifactStyles, _rapierBlobDataUrl, _rapierBuildInterchangeContext, _rapierDocumentNameIsAdmissible, _rapierDrawReadSVGRecipe, _rapierDrawShapeProfileFor, _rapierFillDiagram, _rapierFormatColorOpen, _rapierLanguageClass, _rapierLineStartOffsets, _rapierMarkdownEnvironment, _rapierPortableHtml, _rapierPrepareInterchangeContext, _rapierProjectPortableRoot, _rapierSourceCharEscaped, _rapierSourceLineSpan, crypto, document, escapeRapierHtmlText, globalThis, rapierConfirm, sanitizeRapierHtml} = runtime;
+  const {RAPIER_COLOR_CLOSE, RapierLedgerCarried, RapierPageReturnAddress, RapierTextCodec, _rapierArtifactHighlight, _rapierArtifactLexerScript, _rapierArtifactMarkLexed, _rapierArtifactPreference, _rapierArtifactStyles, _rapierBlobDataUrl, _rapierBuildInterchangeContext, _rapierDocumentNameIsAdmissible, _rapierLedgerParts, _rapierDrawReadSVGRecipe, _rapierDrawShapeProfileFor, _rapierFillDiagram, _rapierFormatColorOpen, _rapierLanguageClass, _rapierLineStartOffsets, _rapierMarkdownEnvironment, _rapierPortableHtml, _rapierPrepareInterchangeContext, _rapierProjectPortableRoot, _rapierSourceCharEscaped, _rapierSourceLineSpan, crypto, document, escapeRapierHtmlText, globalThis, rapierConfirm, sanitizeRapierHtml} = runtime;
   let md = runtime.md;
   async function render(source, options = {}) {
     if (typeof source !== 'string') throw new TypeError('Document source must be a string');
@@ -404,7 +404,9 @@ async function _rapierSharedSourceCarrier(context, root) {
 		'" data-kind="' + esc(context.metadata.docKind) + '" data-sha256="' + await _rapierSharedSourceHash(forms.resolved) +
 		'"' + (forms.ids.length ? ' data-images="' + forms.ids.join(' ') + '"' : '') +
 		(forms.definitions.length ? ' data-image-definitions="' + forms.definitions.map(encodeURIComponent).join(' ') + '"' : '') + '>\n' +
-		forms.carried + '\n</script>\n';
+		forms.carried + '\n</script>\n' +
+		// The optional edit ledger (W/4): carried only when the host binds its owner; a host without one writes none.
+		(RapierLedgerCarried ? RapierLedgerCarried.writeParts(forms.resolved, _rapierLedgerParts(forms.resolved, context.ledger, context.carried)) : '');
 }
 
 function _rapierSharedResolve(text, ids, images, definitions) {
@@ -460,7 +462,8 @@ async function _rapierReadSharedDocument(text, filename) {
 	if (resolved.broken || source.length > RapierTextCodec.maxDocumentBytes || await _rapierSharedSourceHash(source) !== sha256) return invalid();
 	const bom = source.charCodeAt(0) === 0xFEFF;
 	if (RapierTextCodec.normalizeDocument(source) !== (bom ? source.slice(1) : source)) return invalid();
-	return {source, filename: name, kind, bom};
+	const parts = RapierLedgerCarried ? RapierLedgerCarried.readParts(source, Array.from(template.content.querySelectorAll('#rapier-ledger, #rapier-authorship'))) : {};
+	return {source, filename: name, kind, bom, ...parts};
 }
 
 function _rapierSharedPageFallbackCss() {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "rapier-markdown-kit",
-  "version": "1.1.56",
-  "description": "Read, render, write and style Self-contained Markdown: the shared HTML writer, semantic renderer, stylesheet, layout and Will/1. MIT, no npm dependencies.",
+  "version": "1.1.58",
+  "description": "Read, render, write and style Self-contained Markdown, and carry its optional edit ledger: the shared HTML writer, semantic renderer, stylesheet, layout, marks, pictures, Will/1, replay, authorship and offline merge. MIT, no npm dependencies.",
   "keywords": [
     "markdown",
     "self-contained",
@@ -46,7 +46,9 @@
     "./assets": "./dist/kit/assets.mjs",
     "./style.css": "./style.css",
     "./package.json": "./package.json",
-    "./render": "./dist/kit/render-entry.mjs"
+    "./render": "./dist/kit/render-entry.mjs",
+    "./rapier-ledger": "./dist/kit/rapier-ledger.mjs",
+    "./ledger/carried": "./dist/kit/ledger/carried.mjs"
   },
   "repository": {
     "type": "git",