rapier-markdown-kit 1.2.3 → 1.2.5

package/LICENSE

@@ -35,8 +35,9 @@ own MIT notices. The edit-ledger module (`kit/rapier-ledger.mjs`, `kit/ledger/*.
 its editor compatibility import (`editor/journal-records.mjs`) are also covered. The
 record validator/replayer and text-only conflict merger were moved, not copied,
 into that module; the Notes index merger and the rest of the agent/editor remain
-AGPL-3.0-only. The wrapper's carrier-staging helper
-(`skills/rapier-html/package-files.mjs`) is MIT. The kit's MIT-marked facades,
+AGPL-3.0-only. The page wrapper (`skills/rapier-html/wrap.mjs`, `skills/rapier-html/page.mjs`,
+`skills/rapier-html/return-address.mjs`) and its carrier-staging helper
+(`skills/rapier-html/package-files.mjs`) are MIT. The kit's MIT-marked facades,
 `kit/render-entry.mjs`, `kit/render*.mjs`, `kit/export-fonts.mjs`, `kit/print-capitals.mjs`,
 `kit/pdf-vectors.mjs`, `kit/pdf-glyphs.mjs`, `kit/stage.mjs` and MIT-marked conformance
 modules are covered too. These names describe the Rapier-owned files carrying the

package/README.md

@@ -623,7 +623,9 @@ the authorship projection recomputed from the ledger must agree exactly.
 text. Runs are `[start, end, actorKind, actorId, at]`, in order, nonoverlapping and
 covering every current character. A start without earlier authorship is attributed
 to `system/unattributed`, time zero. Insertions take the inserting record's actor
-and time; deleted runs disappear. Thus the projection contains **no removed text**.
+and time, except text an Undo or Redo puts back: a splice inserting exactly the text
+that a splice of the referenced act removed keeps the runs that text had. Deleted
+runs disappear. Thus the projection contains **no removed text**.
 An authorship-only import becomes a clearly incomplete insertion ledger; future
 attribution is again derived from that one ledger, never a mutable blame database.
 
@@ -669,9 +671,19 @@ editor's restore reader can replay the result. Both merge orders yield the same
 text for independently edited nonoverlapping ranges; their ordered ledgers need
 not be identical. Full and conflict receipts make repeated imports idempotent.
 
-Overlaps fall back to the existing text three-way merge. Unresolved alternatives
-are carried in the existing `note-conflict:v1` envelope, never silently selected.
-Different Will `keep` regions require conflict review even when one copy was
+An identical replacement converges with both original acts retained and one physical
+splice. The format identifier stays `rapier-ledger/2`. That unchanged identifier is not
+backward compatibility with an older reader. There is no `rapier-ledger/3`, no
+compatibility reader, and no migration. An older reader rejects the empty physical
+witness with `ledger_invalid` and does not mutate the ledger. Mixed-version sync throws
+`notes_history_unavailable` (`the note and its canonical history cannot be proved`).
+The older participant's store snapshot and remote object count stay unchanged. That
+throw is not a per-note `held` or `caughtUp` result. The same format string is not
+interoperability, and the ledger is not rewritten into the older shape. Reactivating
+any author of that replacement checks the shared text again; undoing that author
+withdraws it once no author remains. A different overlap returns `text_overlap_unpreserved` and the caller's exact
+ledger, including the text merge's alternatives for review, and does not mint a synthetic
+act. Different Will `keep` regions require conflict review even when one copy was
 unchanged. `review.required` names an unresolved result; a UI must not auto-accept
 it. Rapier offers carried-copy imports from Compare through its existing review,
 checks the live document again at commit, and installs the proven ledger before

package/dist/images/gif.mjs

@@ -39,7 +39,9 @@ export function inspectGIF(bytes) {
     at += 9; if (packed & 128) at += 3 * (2 << (packed & 7));
     need(1); if (bytes[at] < 2 || bytes[at] > 8) fail('Invalid GIF code size');
     at++; blocks(); frames++;
-    duration += control ? Math.max(20, (control[4] + control[5] * 256) * 10) : 100;
+    // A delay of 0 or 1 centisecond shows for 100 ms, as the browser draws it (images/playback.mjs times frames the same).
+    const delay = control ? control[4] + control[5] * 256 : 0;
+    duration += delay > 1 ? delay * 10 : 100;
     if (frames > 240 || width * height * frames > 96000000 || duration > 120000) fail('GIF animation exceeds the frame, work or duration budget');
     first ||= {control, image: bytes.subarray(start, at)}; control = null;
   }

package/dist/images/playback.mjs

@@ -31,8 +31,9 @@ export function createMediaPlayback(win, inspectGIF) {
     })();
     admitted.catch(error => {if (!closed) {state.status = 'admission-failed'; state.error = String(error.message).slice(0, 160); changed(state);}});
     // A decoder closes only after its in-flight decode settles; Chrome 155's JPEG XL decoder fails when closed mid-decode.
+    // Its budget place goes with it: a poster or a finished loop holds no decoder.
     let inflight = null;
-    const closeDecoder = () => {ticket++; win.clearTimeout(timer); timer = 0; const old = decoder; decoder = null; if (old) inflight ? inflight.then(() => old.close()) : old.close();};
+    const closeDecoder = () => {ticket++; win.clearTimeout(timer); timer = 0; active.delete(canvas); const old = decoder; decoder = null; if (old) inflight ? inflight.then(() => old.close()) : old.close();};
     const settle = async promise => {
       let timeout;
       try {return await Promise.race([promise, new Promise((_, reject) => {timeout = win.setTimeout(() => reject(new Error('Animation decode timeout')), 5000);})]);}
@@ -72,7 +73,8 @@ export function createMediaPlayback(win, inspectGIF) {
           if (canvas.height !== h) canvas.height = h;
           const ctx = canvas.getContext('2d'); ctx.clearRect(0, 0, w, h); ctx.drawImage(frame, 0, 0);
           if (!state.first && next === 0) state.first = canvas.toDataURL('image/png');
-          const delay = Math.max(20, (frame.duration || 100000) / 1000);
+          // A frame of 10 ms or less shows for 100 ms, as the browser draws an <img> (images/gif.mjs counts the same).
+          const delay = frame.duration > 10000 ? Math.max(20, frame.duration / 1000) : 100;
           duration += delay; if (duration > 120000) throw new Error('Animation exceeds the duration budget');
           state.status = 'ready'; state.frame = next; changed(state);
           if (single) {paused = true; closeDecoder(); return;}
@@ -93,8 +95,8 @@ export function createMediaPlayback(win, inspectGIF) {
       async first() {if (!state.first && !closed) {single = true; next = 0; paused = false; try {await step();} finally {single = false; paused = true; closeDecoder(); if (held) {held = false; this.suspend();}}} return state.first;},
       // Pause keeps the decoder and its frame position; only suspension and removal release it.
       pause() {paused = true; ticket++; win.clearTimeout(timer); timer = 0;},
-      suspend() {if (single) {held = true; return;} paused = true; closeDecoder(); canvas.width = canvas.height = 0; active.delete(canvas); state.status = 'suspended'; changed(state);},
-      close() {closed = true; paused = true; closeDecoder(); canvas.width = canvas.height = 0; active.delete(canvas);},
+      suspend() {if (single) {held = true; return;} paused = true; closeDecoder(); canvas.width = canvas.height = 0; state.status = 'suspended'; changed(state);},
+      close() {closed = true; paused = true; closeDecoder(); canvas.width = canvas.height = 0;},
       get paused() {return paused;}};
   }
   return {raster, inspectGIF, encode, source: '(' + createMediaPlayback.toString() + ')(window, ' + inspectGIF.toString() + ')'};

package/dist/kit/conformance/run.mjs

@@ -115,7 +115,7 @@ console.log(`A row's own hits/misses can undercount its real coverage: several f
 console.log(`segment cache (agent/vendor/pretext/measurement.js) serves a repeated (font, segment) query straight from that cache without calling`);
 console.log(`measureText again at all -- real data, just not counted against the SECOND document to ask for it. Two named, separate reasons a row still`);
 console.log(`reads CLOSE rather than AGREE, none of them "close enough": (a) no real trace exists at all for 01-inline/02-width-x-align/05-behind/06-front`);
-console.log(`-- their picture pushes no flow obstacle, so layout/interchange.js's own prepare() never calls Pretext for this paragraph during export (see`);
+console.log(`-- their picture pushes no flow obstacle, so kit/render.mjs's exported projector's prepare() never calls Pretext for this paragraph during export (see`);
 console.log(`measurer.mjs) -- the from-scratch character-sum approximation disagrees with real shaping by a bounded, named amount; (b) 03/11/13 DO run`);
 console.log(`Pretext for real (hits > 0, 13-rtl-text at 100% -- every query answered from the real trace) yet still carry a small, constant left-edge delta`);
 console.log(`(9.64px today, a constant from before this measurer existed) -- a picture-obstacle geometry fact, not a text one: these`);

package/dist/kit/ledger/authored-origin.mjs

@@ -0,0 +1,49 @@
+// SPDX-License-Identifier: MIT
+// Immutable authored origins shared by causal transport and inverse projection.
+import {_rapierTransformSplices, _rapierValidAuthored} from './journal-records.mjs';
+import {sha256} from './hash.mjs';
+
+// The frontier names only causal maxima. Linear history needs one predecessor,
+// and concurrent predecessors remain separate until an act observes both.
+function authoredFrontier(records, visit = null) {
+  const dependencies = new Map(), frontier = new Set();
+  for (const record of records) {
+    const id = record.transaction.id, basis = record.authored?.basis;
+    if (visit) visit(record, basis ?? [...frontier].sort());
+    if (!basis) { dependencies.set(id, [...frontier]); frontier.clear(); }
+    else {
+      const pending = [...basis], seen = new Set();
+      while (pending.length) {
+        const prior = pending.pop();
+        if (seen.has(prior)) continue;
+        if (!dependencies.has(prior)) throw new RangeError('canonical_origin_invalid');
+        seen.add(prior); frontier.delete(prior); pending.push(...dependencies.get(prior));
+      }
+      dependencies.set(id, basis);
+    }
+    frontier.add(id);
+  }
+  return [...frontier].sort();
+}
+
+export function authoredBasis(records) { return authoredFrontier(records); }
+
+export function authoredPlacements(base, records) {
+  const origins = new Map(); let source = base;
+  authoredFrontier(records, (record, basis) => {
+    origins.set(record.transaction.id, record.authored ?? authoredPlacement(source, record.splices, basis));
+    source = _rapierTransformSplices(source, record.splices);
+    if (source === null) throw new RangeError('canonical_origin_invalid');
+  });
+  return origins;
+}
+
+// Immutable authored placement stays on its own act. Basis IDs refer only to this
+// canonical history; no source snapshot or duplicate history is stored.
+export function authoredPlacement(source, splices, basis) {
+  const origin = {basis: basis.slice().sort(), source: sha256(source), splices: splices.map(row => ({...row}))};
+  if (!_rapierValidAuthored(origin) || _rapierTransformSplices(source, splices) === null)
+    throw new RangeError('canonical_origin_invalid');
+  return origin;
+}
+

package/dist/kit/ledger/authorship.mjs

@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: MIT
 import {readLedger, exportLedger, textRoot, rootAfter} from './format.mjs';
-import {_rapierTransformSplices} from './journal-records.mjs';
+import {_rapierTransformSplices, _rapierHistoryEffects} from './journal-records.mjs';
 import {sha256} from './hash.mjs';
 import {plainData, documentText, nonnegative, exactKeys, fault} from './data.mjs';
 function coalesce(runs) {
@@ -14,16 +14,25 @@ function coalesce(runs) {
   return out;
 }
 export function authorship(input) {
-  const {ledger, text} = readLedger(input);
+  const {ledger, text} = readLedger(input), references = _rapierHistoryEffects(ledger.records).references, removed = new Map();
   let runs = ledger.start.text ? [[0, ledger.start.text.length, 'system', 'unattributed', 0]] : [];
-  for (const record of ledger.records) for (const row of record.splices) {
-    const cut = row.pos + row.removed.length, delta = row.inserted.length - row.removed.length, before = [], after = [];
-    for (const run of runs) {
-      if (run[0] < row.pos) before.push([run[0], Math.min(run[1], row.pos), ...run.slice(2)]);
-      if (run[1] > cut) after.push([Math.max(run[0], cut) + delta, run[1] + delta, ...run.slice(2)]);
+  for (const record of ledger.records) {
+    // An Undo or Redo puts back text the act it references removed: that text keeps the runs it had.
+    const tx = record.transaction, gone = [], kept = (references?.get(tx.id) || []).flatMap(id => removed.get(id) || []);
+    for (const row of record.splices) {
+      const cut = row.pos + row.removed.length, delta = row.inserted.length - row.removed.length, before = [], after = [], inside = [];
+      for (const run of runs) {
+        if (run[0] < row.pos) before.push([run[0], Math.min(run[1], row.pos), ...run.slice(2)]);
+        if (run[1] > cut) after.push([Math.max(run[0], cut) + delta, run[1] + delta, ...run.slice(2)]);
+        if (run[0] < cut && run[1] > row.pos) inside.push([Math.max(run[0], row.pos) - row.pos, Math.min(run[1], cut) - row.pos, ...run.slice(2)]);
+      }
+      if (row.removed) gone.push({text: row.removed, runs: inside});
+      const at = row.inserted ? kept.findIndex(entry => entry.text === row.inserted) : -1;
+      const put = at < 0 ? [[row.pos, row.pos + row.inserted.length, tx.actor.kind, tx.actor.id, tx.createdAt]]
+        : kept.splice(at, 1)[0].runs.map(run => [run[0] + row.pos, run[1] + row.pos, ...run.slice(2)]);
+      runs = coalesce([...before, ...put, ...after]);
     }
-    const tx = record.transaction;
-    runs = coalesce([...before, [row.pos, row.pos + row.inserted.length, tx.actor.kind, tx.actor.id, tx.createdAt], ...after]);
+    removed.set(tx.id, gone);
   }
   return {format: 'rapier-authorship/1', sha256: sha256(text), runs};
 }

package/dist/kit/ledger/data.mjs

@@ -1,10 +1,13 @@
 // SPDX-License-Identifier: MIT
 // Only plain JSON data enters the public format. Accessors and toJSON are never executed.
 export function fault(message) { return Object.assign(new Error('Ledger: ' + message), {code: 'ledger_invalid'}); }
-function fields(value, depth, active, sorted = true) {
+// A plain object's prototype is null or Object's own. Both lookups read descriptors, so no getter runs.
+export const plainPrototype = proto => proto === null || Object.getPrototypeOf(proto) === null &&
+  Object.getOwnPropertyDescriptor(Object.getOwnPropertyDescriptor(proto, 'constructor')?.value || {}, 'name')?.value === 'Object';
+export function fields(value, depth, active, sorted = true) {
   if (!value || typeof value !== 'object' || depth > 64 || active.has(value)) throw fault('not plain JSON data');
-  const array = Array.isArray(value), proto = Object.getPrototypeOf(value);
-  if (!array && proto !== null && (Object.getPrototypeOf(proto) !== null || Object.getOwnPropertyDescriptor(proto, 'constructor')?.value?.name !== 'Object')) throw fault('not a plain object');
+  const array = Array.isArray(value);
+  if (!array && !plainPrototype(Object.getPrototypeOf(value))) throw fault('not a plain object');
   const descriptors = Object.getOwnPropertyDescriptors(value), keys = Reflect.ownKeys(descriptors);
   for (const key of keys) {
     if (array && key === 'length') continue;
@@ -14,7 +17,7 @@ function fields(value, depth, active, sorted = true) {
   if (array && (keys.length !== value.length + 1 || keys.some(k => k !== 'length' && (!/^(0|[1-9]\d*)$/.test(k) || +k >= value.length)))) throw fault('sparse array');
   return {array, descriptors, keys: array ? keys.filter(key => key !== 'length') : sorted ? keys.sort() : keys};
 }
-function scalar(value) {
+export function scalar(value) {
   if (value === null || typeof value === 'boolean') return true;
   if (typeof value === 'string') { if (/[\uD800-\uDFFF]/u.test(value)) throw fault('unpaired surrogate'); return true; }
   return typeof value === 'number' && Number.isFinite(value) && !Object.is(value, -0);

package/dist/kit/ledger/format.mjs

@@ -27,12 +27,34 @@ function* checkedRecords(ledger, prepared) {
   }
   if (ledger.head.revision !== revision || ledger.head.root !== root) throw fault('history does not describe this document');
 }
+// A ledger object read again is proved once: a boot reads one stored history through several records. The proof holds only
+// while that object still carries the exact proved data (its start text compared whole, the rest as canonical JSON), so a
+// changed byte is proved again, and refused. The proof lives as long as the object does.
+const proofs = new WeakMap();
 function readLedgerState(input, expectedText, expectedMetadata) {
   const ledger = plainData(input);
+  // The identifier rapier-ledger/2 is unchanged and is not backward compatible. This reader
+  // admits an empty physical splice whose authored rows name the same replacement. A reader
+  // from before that rule rejects the chain. Mixed-version sync throws notes_history_unavailable
+  // and leaves the older store unchanged; that refusal is not a held or caughtUp result.
   if (!exactKeys(ledger, ['format','documentAuthority','start','records','head','complete','sha256']) || ledger.format !== 'rapier-ledger/2' ||
       typeof ledger.documentAuthority !== 'string' || !ledger.documentAuthority || ledger.documentAuthority.length > 256 ||
       typeof ledger.complete !== 'boolean' || !Array.isArray(ledger.records) ||
       !exactKeys(ledger.start, ['text','revision','root','sha256','metadata']) || !exactKeys(ledger.head, ['revision','root','sha256','metadata'])) throw fault('unsupported or invalid envelope');
+  const shell = canonicalJSON({...ledger, start: {...ledger.start, text: ''}});
+  let proof = typeof input === 'object' ? proofs.get(input) : undefined;
+  if (!proof || proof.shell !== shell || proof.startText !== ledger.start.text) {
+    proof = {shell, startText: ledger.start.text, ...proveLedger(ledger)};
+    if (typeof input === 'object') proofs.set(input, proof);
+  }
+  proofs.set(ledger, proof);
+  const {text, metadata, root, revision, prepared, source} = proof;
+  if (expectedMetadata !== undefined && (!_rapierValidMetadata(expectedMetadata) || canonicalJSON(metadata) !== canonicalJSON(expectedMetadata)))
+    throw fault('metadata does not describe this document');
+  if (expectedText !== undefined && text !== expectedText) throw fault('history does not describe this document');
+  return {value: {ledger, text, metadata: {...metadata}, root, revision, complete: ledger.complete}, prepared, source};
+}
+function proveLedger(ledger) {
   const {sha256: claimed, ...payload} = ledger;
   if (claimed !== digest(payload)) throw fault('envelope checksum differs');
   let text = documentText(ledger.start.text), root = ledger.start.root, revision = ledger.start.revision;
@@ -55,12 +77,9 @@ function readLedgerState(input, expectedText, expectedMetadata) {
     try { authoredHistory(ledger.start.text, ledger.records); } catch (_) { throw fault('authored origin differs'); }
   }
   const metadata = prepared.replayMetadata(ledger.start.metadata);
-  if (!metadata || canonicalJSON(metadata) !== canonicalJSON(ledger.head.metadata) ||
-      (expectedMetadata !== undefined && (!_rapierValidMetadata(expectedMetadata) || canonicalJSON(metadata) !== canonicalJSON(expectedMetadata))))
-    throw fault('metadata does not describe this document');
-  if (ledger.head.revision !== revision || ledger.head.root !== root || ledger.head.sha256 !== sha256(text) ||
-      (expectedText !== undefined && text !== expectedText)) throw fault('history does not describe this document');
-  return {value: {ledger, text, metadata, root, revision, complete: ledger.complete}, prepared, source};
+  if (!metadata || canonicalJSON(metadata) !== canonicalJSON(ledger.head.metadata)) throw fault('metadata does not describe this document');
+  if (ledger.head.revision !== revision || ledger.head.root !== root || ledger.head.sha256 !== sha256(text)) throw fault('history does not describe this document');
+  return {text, metadata, root, revision, prepared, source};
 }
 // A stored copy may hold the head text alone. Its start is that text with every record reversed; readLedger proves it.
 export function ledgerWithStart(input, text) {
@@ -172,9 +191,7 @@ function finish(producer) {
   return step.value;
 }
 export function exportLedger(input) { return finish(produceLedger(input)).ledger; }
-// Both synchronous public export and cooperative recovery use the same producer.
 // Its returned facts were computed while admitting/hashing the exact head, never supplied.
-export function prepareLedger(input) { return finish(produceLedger(input)); }
 export async function prepareLedgerAsync(input, {yield: yieldWork, signal} = {}) {
   const producer = produceLedger(input);
   let step;

package/dist/kit/ledger/history.mjs

@@ -3,8 +3,8 @@
 import {_rapierTransformSplices, _rapierValidMetadata, _rapierTransformMetadata, _rapierMetadataDelta, _rapierHistoryEffects, _rapierMetadataState, _rapierPrepareHistoryRecords} from './journal-records.mjs';
 import {projectInverseSource, HistorySource} from './inverse-source.mjs';
 import {textRootParts, rootAfter} from './hash.mjs';
-import {authoredHistory} from './transport.mjs';
-import {plainData} from './data.mjs';
+import {authoredHistory, authoredPlacements} from './transport.mjs';
+import {plainData, canonicalJSON} from './data.mjs';
 
 const historyFailure = reason => ({ok: false, reason});
 const historyInteger = value => Number.isSafeInteger(value) && value >= 0 && !Object.is(value, -0);
@@ -104,8 +104,11 @@ function prepareHistory(input) {
 				!(tx.createdAt === null || historyInteger(tx.createdAt)) ||
 				(tx.turnId != null && (typeof tx.turnId !== 'string' || !tx.turnId || tx.turnId.length > 160))) return historyFailure('history_invalid');
 			if (tx.baseRevision !== prior) complete = false;
+			const coincidentWitness = !splices.length && record.authored && Array.isArray(record.authored.splices) &&
+				record.authored.splices.some(row => row.removed.length);
 			if (!splices || effect === undefined || (!splices.length &&
-				!Object.values(effect || {}).some(pair => pair.before !== pair.after) && !effects.references.get(tx.id)?.length)) return historyFailure('history_unavailable');
+				!Object.values(effect || {}).some(pair => pair.before !== pair.after) && !effects.references.get(tx.id)?.length &&
+				!coincidentWitness)) return historyFailure('history_unavailable');
 			const row = {record, splices, metadata: effect};
 			rows.push(row); byId.set(tx.id, row); prior = tx.revision;
 		}
@@ -293,10 +296,13 @@ export function historyPlaces(input, blocks) {
 			if (!slices.has(key)) slices.set(key, source.slice(from, to));
 			return slices.get(key);
 		};
+		// One record's act is read once; the blocks it touched share its fields (a whole-document delete touches every block).
+		let act = null;
 		for (const [node, afterRange] of touched) {
 			const beforeRange = ranges.range(node), previous = {...beforeRange, source: cut(beforeSource, 'b', beforeRange.from, beforeRange.to)},
 				after = {...afterRange, source: cut(afterSource, 'a', afterRange.from, afterRange.to)};
-			if (previous.source !== after.source) node.block.acts.push({...historyAct(record), before: previous, after});
+			// A point (where words were deleted) has no words to compare: the act that touched it wrote there.
+			if (previous.source !== after.source || afterRange.from === afterRange.to) node.block.acts.push({...(act ||= historyAct(record)), before: previous, after});
 		}
 	}
 
@@ -334,7 +340,27 @@ export function selectiveUndo(input, actIds, options = {}) {
 	const metadata = _rapierMetadataDelta(prepared.metadata, afterMetadata), effectChanged = selected.size > 0;
 	const sourceEffectChanged = records.some(record => record.splices.length && !prepared.effects.references.get(record.transaction.id)?.length &&
 		prepared.effects.active.has(record.transaction.id) !== projectedEffects.active.has(record.transaction.id));
-	if (!sourceEffectChanged) return {ok: true, splices: [], after: prepared.source, actIds: [...requested],
+	// One shared replacement is visible while any of its authors is active. That
+	// includes an author stored with no second physical splice, and an inverse
+	// whose only effect is to make such an author active again.
+	let coverVisibilityChanged = false;
+	if (!sourceEffectChanged && selected.size) {
+		let origins = null;
+		try { origins = authoredPlacements(prepared.initialSource, records); } catch { origins = null; }
+		const groups = new Map();
+		if (origins) for (const record of records) {
+			const tx = record.transaction, origin = origins.get(tx.id);
+			if (!origin?.splices.some(row => row.removed.length) || tx.reverts || tx.reapplies ||
+				tx.sourceTransactionId || tx.sourceTransactionIds?.length) continue;
+			const key = canonicalJSON({basis: origin.basis, splices: origin.splices});
+			if (!groups.has(key)) groups.set(key, []);
+			groups.get(key).push(tx.id);
+		}
+		const covered = (effects, ids) => ids.some(id => effects.active.has(id));
+		for (const ids of groups.values()) if (ids.length > 1 && covered(prepared.effects, ids) !== covered(projectedEffects, ids))
+			coverVisibilityChanged = true;
+	}
+	if (!sourceEffectChanged && !coverVisibilityChanged) return {ok: true, splices: [], after: prepared.source, actIds: [...requested],
 		sourceTransactionIds: [...selected], metadata, afterMetadata, effectChanged, unchanged: !metadata && !effectChanged,
 		superseded: [], overlaps: []};
 	try {

package/dist/kit/ledger/inverse-source.mjs

@@ -2,6 +2,8 @@
 // Exact source projection shared by canonical history and causal transport.
 // Callers admit and order the records first; this projection retains no state.
 import {_rapierTransformSplices, _rapierHistoryEffects} from './journal-records.mjs';
+import {authoredPlacements} from './authored-origin.mjs';
+import {canonicalJSON} from './data.mjs';
 import {diff} from '../../packages/rapier-diff/index.mjs';
 
 const historyFailure = reason => ({ok: false, reason});
@@ -174,6 +176,24 @@ export function projectInverseSource(prepared, selected, projectedEffects, optio
 	try {
 		let pieces = prepared.initialSource ? [{text: prepared.initialSource, owner: null, lineage: []}] : [];
 		const all = [], byId = new Map(), byAct = new Map(), processed = [], keptInverseAncestors = new Set();
+		const recordsForCover = prepared.records || prepared.rows.map(({record, splices}) => record.splices === splices ? record : {...record, splices});
+		const coverGroups = new Map();
+		let coverOrigins = null;
+		// An empty document is a real causal source. Fresh notes start there, and a
+		// shared replacement authored against that source still has to stay covered.
+		if (typeof prepared.initialSource === 'string' && recordsForCover.some(record => record.authored?.splices?.some(row => row.removed.length))) {
+			try { coverOrigins = authoredPlacements(prepared.initialSource, recordsForCover); } catch { coverOrigins = null; }
+		}
+		const coverIdsFor = id => {
+			const origin = coverOrigins?.get(id);
+			if (!origin?.splices.some(row => row.removed.length)) return null;
+			const key = canonicalJSON({basis: origin.basis, splices: origin.splices});
+			if (!coverGroups.has(key)) coverGroups.set(key, []);
+			const ids = coverGroups.get(key);
+			if (!ids.includes(id)) ids.push(id);
+			return ids;
+		};
+		const coverHeld = hunk => hunk.coverIds?.length > 1 && hunk.coverIds.some(id => projectedEffects.active.has(id));
 		const texts = rows => rows.map(row => row.text || '');
 		const textOf = rows => texts(rows).join('');
 		const lengthOf = (rows, to = rows.length) => { let size = 0; for (let i = 0; i < to; i++) size += rows[i].text?.length || 0; return size; };
@@ -234,8 +254,16 @@ export function projectInverseSource(prepared, selected, projectedEffects, optio
 			return next && effects.active.has(next.actId) && !prepared.effects.references.get(next.actId)?.length;
 		});
 		const reactivate = (actIds, effects) => {
+			// Any author of one shared removal or replacement restores that one physical
+			// hunk, including an author who stored no splice. A later independent act
+			// keeps the bytes it wrote until that act itself is withdrawn.
+			const wanted = new Set(actIds);
+			for (const id of actIds) for (const hunk of all) {
+				if (hunk.reversedHunk || hunk.derived || !hunk.coverIds?.includes(id) || wanted.has(hunk.actId)) continue;
+				if (hunk.coverIds.some(cover => effects.active.has(cover))) wanted.add(hunk.actId);
+			}
 			for (const hunk of all) {
-				if (!actIds.has(hunk.actId) || hunk.derived || prepared.effects.references.get(hunk.actId)?.length) continue;
+				if (!wanted.has(hunk.actId) || hunk.derived || prepared.effects.references.get(hunk.actId)?.length) continue;
 				if (keptInverseAncestors.has(hunk.id)) continue;
 				if (laterSource(hunk, effects) || pieces.some(piece => piece.text && piece.owner === hunk.id) ||
 					(!hunk.inserted && hunk.active)) continue;
@@ -245,8 +273,9 @@ export function projectInverseSource(prepared, selected, projectedEffects, optio
 					// inverse's marker. Its exact ancestry also preserves later inserted runs.
 					const inverse = all.findLast(prior => prior.reversedHunk === hunk.id && pieces.includes(prior.marker));
 					if (!inverse) throw Error('reactivation');
-					if (laterSource(inverse, effects)) continue;
-					restoreHunk(inverse); inverse.active = false;
+					const runs = all.filter(prior => prior.actId === inverse.actId && prior.reversedHunk === hunk.id && pieces.includes(prior.marker));
+					if (runs.some(prior => laterSource(prior, effects))) continue;
+					for (const prior of runs) { restoreHunk(prior); prior.active = false; }
 					hunk.active = true; delete hunk.undoneBy;
 					continue;
 				}
@@ -291,51 +320,65 @@ export function projectInverseSource(prepared, selected, projectedEffects, optio
 			if (references.size) {
 				// Exact inverse rows restore the previous run identities. Retain the inverse's
 				// own transient marker too, so reversing it restores that same ancestry again.
-				const targets = all.filter(hunk => hunk.active && references.has(hunk.actId));
-				let restored = targets.length ? pieces.slice() : null;
-				const inverses = [], priorSplices = options.keepHunk ? [] : null;
-				for (let index = targets.length - 1; restored && index >= 0; index--) {
-					const target = targets[index], first = restored.indexOf(target.marker);
-					if (first < 0) { restored = null; break; }
-					let last = first;
-					for (let at = first; at < restored.length; at++) if (owns(restored[at], target)) last = at;
-					const pos = lengthOf(restored, first);
-					const before = restored.slice(first, last + 1), replacement = [];
-					for (const piece of before) {
-						if (piece === target.marker) replacement.push(...target.before);
-						else if (!owns(piece, target)) replacement.push(piece);
-					}
-					const id = tx.id + '#inverse:' + index, lineage = new Set([id]);
-					for (const piece of before) for (const parent of piece.lineage || piece.mark?.lineage || []) lineage.add(parent);
-					const hunk = {id, actId: tx.id, removed: textOf(before), inserted: textOf(replacement), before, reversedHunk: target.id,
-						chosen: selected.has(tx.id), lineage: [...lineage], supersededBy: new Set(), active: true,
-						restoredMarkers: new Set(replacement.filter(piece => !piece.text))};
-					if (hunk.chosen && options.keepHunk) {
-						const spliceIndex = splices.findIndex(row => row.pos <= pos && row.pos + row.removed.length >= pos);
-						const keep = options.keepHunk({actId: tx.id, spliceIndex: Math.max(0, spliceIndex), hunkIndex: index,
-							splice: {pos, removed: hunk.removed, inserted: hunk.inserted}, beforeSource: textOf(restored), actSource, priorSplices});
-						if (typeof keep !== 'boolean') throw Error('hunk_selection');
-						hunk.chosen = !keep;
+				const invert = targets => {
+					const restored = pieces.slice(), inverses = [], priorSplices = options.keepHunk ? [] : null;
+					for (let index = targets.length - 1; index >= 0; index--) {
+						const target = targets[index], first = restored.indexOf(target.marker);
+						if (first < 0) return null;
+						// Each run of the target's own pieces inverts alone: a later author's pieces between
+						// its runs stay in place, outside every inverse, so reversing it cannot move them.
+						const runs = [];
+						for (let at = first; at < restored.length; at++) if (owns(restored[at], target))
+							if (runs.at(-1)?.[1] === at) runs.at(-1)[1]++; else runs.push([at, at + 1]);
+						for (let run = runs.length - 1; run >= 0; run--) {
+							const [from, to] = runs[run], before = restored.slice(from, to), pos = lengthOf(restored, from);
+							const replacement = run ? [] : target.before;
+							const id = tx.id + '#inverse:' + index + (run ? '.' + run : ''), lineage = new Set([id]);
+							for (const piece of before) for (const parent of piece.lineage || piece.mark?.lineage || []) lineage.add(parent);
+							const hunk = {id, actId: tx.id, removed: textOf(before), inserted: textOf(replacement), before, reversedHunk: target.id,
+								chosen: selected.has(tx.id), lineage: [...lineage], supersededBy: new Set(), active: true,
+								restoredMarkers: new Set(replacement.filter(piece => !piece.text))};
+							if (hunk.chosen && options.keepHunk) {
+								const spliceIndex = splices.findIndex(row => row.pos <= pos && row.pos + row.removed.length >= pos);
+								const keep = options.keepHunk({actId: tx.id, spliceIndex: Math.max(0, spliceIndex), hunkIndex: index,
+									splice: {pos, removed: hunk.removed, inserted: hunk.inserted}, beforeSource: textOf(restored), actSource, priorSplices});
+								if (typeof keep !== 'boolean') throw Error('hunk_selection');
+								hunk.chosen = !keep;
+							}
+							hunk.kept = selected.has(tx.id) && !hunk.chosen;
+							// A semantic owner retaining this inverse also retains the exact ancestors
+							// it restored; effect reactivation must not change them behind that owner.
+							if (hunk.kept) for (let prior = target; prior; prior = byId.get(prior.reversedHunk)) keptInverseAncestors.add(prior.id);
+							hunk.marker = {mark: hunk};
+							const insertion = replacement.map(piece => piece.text ? {...piece,
+								lineage: [...new Set([...(piece.lineage || []), id])],
+								restoredBy: [...(piece.restoredBy || []), id]} : piece);
+							restored.splice(from, to - from, hunk.marker, ...insertion);
+							inverses.push(hunk); priorSplices?.push({pos, removed: hunk.removed, inserted: hunk.inserted});
+						}
 					}
-					hunk.kept = selected.has(tx.id) && !hunk.chosen;
-					// A semantic owner retaining this inverse also retains the exact ancestors
-					// it restored; effect reactivation must not change them behind that owner.
-					if (hunk.kept) for (let prior = target; prior; prior = byId.get(prior.reversedHunk)) keptInverseAncestors.add(prior.id);
-					hunk.marker = {mark: hunk};
-					const insertion = replacement.map(piece => piece.text ? {...piece,
-						lineage: [...new Set([...(piece.lineage || []), id])],
-						restoredBy: [...(piece.restoredBy || []), id]} : piece);
-					restored.splice(first, last + 1 - first, hunk.marker, ...insertion);
-					inverses.push(hunk); priorSplices?.push({pos, removed: hunk.removed, inserted: hunk.inserted});
-				}
-				if (restored && replays(pieces, restored, splices)) {
-					pieces = restored;
-					for (const target of targets) { target.active = false; target.undoneBy = tx.id; }
+					return replays(pieces, restored, splices) ? {restored, inverses} : null;
+				};
+				// An inverse taken while a later edit had replaced some of the act's hunks restored only
+				// the rest. Those replaced hunks survive it: no later projection treats them as undone.
+				// Recorded splices decide. An author who stored no splice still inverts the one
+				// shared hunk; an empty inverse does not match that text change and leaves it.
+				const direct = all.filter(hunk => hunk.active && references.has(hunk.actId));
+				const targets = direct.length ? direct : all.filter(hunk => hunk.active && !hunk.reversedHunk && !hunk.derived &&
+					hunk.coverIds?.some(id => references.has(id)));
+				const free = targets.filter(hunk => ![...hunk.supersededBy].some(id => byId.get(id)?.active));
+				let found = targets.length ? invert(targets) : null, survivors = [];
+				if (!found && free.length && free.length < targets.length && (found = invert(free)))
+					survivors = targets.filter(hunk => !free.includes(hunk));
+				if (found) {
+					pieces = found.restored;
+					for (const target of targets) if (survivors.includes(target)) target.survived = true;
+					else { target.active = false; target.undoneBy = tx.id; }
 					for (const piece of pieces) if (piece.mark) {
 						piece.mark.active = true; delete piece.mark.undoneBy;
 					}
-					for (const hunk of inverses) { all.push(hunk); byId.set(hunk.id, hunk); }
-					byAct.set(tx.id, inverses);
+					for (const hunk of found.inverses) { all.push(hunk); byId.set(hunk.id, hunk); }
+					byAct.set(tx.id, found.inverses);
 					continue;
 				}
 			}
@@ -354,6 +397,7 @@ export function projectInverseSource(prepared, selected, projectedEffects, optio
 					for (const [hunk, active, undoneBy] of priorStates) { hunk.active = active; hunk.undoneBy = undoneBy; }
 				}
 			}
+			if (!references.size) coverIdsFor(tx.id);
 			const priorSplices = options.keepHunk ? [] : null;
 			// An admitted codec finish replaces the complete embedded definition/reference.
 			// Keep its inserted run whole, including byte-identical prefixes of a re-edit;
@@ -395,7 +439,8 @@ export function projectInverseSource(prepared, selected, projectedEffects, optio
 					const lineage = new Set([id]);
 					for (const piece of removed) for (const parent of piece.lineage || piece.mark?.lineage || []) lineage.add(parent);
 					const hunk = {id, actId: tx.id, removed: row.removed, inserted: row.inserted, before: removed, derived,
-						chosen, kept: selected.has(tx.id) && !chosen, lineage: [...lineage], supersededBy: new Set(), active: true};
+						chosen, kept: selected.has(tx.id) && !chosen, lineage: [...lineage], supersededBy: new Set(), active: true,
+						...(coverIdsFor(tx.id) ? {coverIds: coverIdsFor(tx.id)} : {})};
 					hunk.marker = {mark: hunk};
 					all.push(hunk); byId.set(id, hunk);
 					if (!byAct.has(tx.id)) byAct.set(tx.id, []);
@@ -414,9 +459,22 @@ export function projectInverseSource(prepared, selected, projectedEffects, optio
 		let offset = 0;
 		for (const piece of pieces) if (piece.text) { origins.set(piece, offset); offset += piece.text.length; }
 		const superseded = [];
+		// Survival means an inverse left this hunk in place because a later independent
+		// edit still covered it. Once that edit is gone, deactivating its last owner through
+		// any inverse path withdraws every exposed hunk. Undoing only the later
+		// edit reveals the survived insertion and does not discard it.
+		for (const hunk of all) if (hunk.survived) {
+			const covered = [...hunk.supersededBy].some(id => {
+				const next = byId.get(id);
+				return next?.active && projectedEffects.active.has(next.actId) && !prepared.effects.references.get(next.actId)?.length;
+			});
+			const owners = hunk.coverIds?.length ? hunk.coverIds : [hunk.actId];
+			if (!covered && owners.some(id => prepared.effects.active.has(id)) && !owners.some(id => projectedEffects.active.has(id))) hunk.survived = false;
+		}
 		for (let index = all.length - 1; index >= 0; index--) {
 			const hunk = all[index];
-			const inheritedInactive = !hunk.derived && !hunk.kept && !keptInverseAncestors.has(hunk.id) && !projectedEffects.active.has(hunk.actId) &&
+			if (coverHeld(hunk)) continue;
+			const inheritedInactive = !hunk.derived && !hunk.kept && !hunk.survived && !keptInverseAncestors.has(hunk.id) && !projectedEffects.active.has(hunk.actId) &&
 				!prepared.effects.references.get(hunk.actId)?.length;
 			if (!hunk.chosen && !inheritedInactive) continue;
 			hunk.active = prepared.effects.active.has(hunk.actId);
@@ -432,9 +490,13 @@ export function projectInverseSource(prepared, selected, projectedEffects, optio
 			restoreHunk(hunk);
 		}
 		// A hidden withdrawal can have no splice of its own. Reversing that withdrawal
-		// reactivates the original hunk at its retained marker, never at a text search.
-		reactivate(new Set(records.filter(record => !prepared.effects.active.has(record.transaction.id) &&
-			projectedEffects.active.has(record.transaction.id)).map(record => record.transaction.id)), projectedEffects);
+		// reactivates the shared hunk through the inverse that still carries it.
+		// Withdrawing a later act reveals that same hunk while any original author remains.
+		const reactivated = new Set(records.filter(record => !prepared.effects.active.has(record.transaction.id) &&
+			projectedEffects.active.has(record.transaction.id)).map(record => record.transaction.id));
+		for (const hunk of all) if (!hunk.reversedHunk && !hunk.derived && hunk.coverIds?.length > 1 &&
+			hunk.coverIds.some(id => projectedEffects.active.has(id))) reactivated.add(hunk.actId);
+		reactivate(reactivated, projectedEffects);
 		const after = textOf(pieces), changes = [];
 		let cursor = 0, inserted = '';
 		for (const piece of pieces) {