rapier-markdown-kit 1.2.3 → 1.2.6

package/LICENSE

@@ -20,7 +20,7 @@ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 
-Files under this licence carry `SPDX-License-Identifier: MIT` in their first lines: the standard's
+Files under this license carry `SPDX-License-Identifier: MIT` in their first lines: the standard's
 grammar, marks and reference style (`spec/md-layout.mjs`, `spec/md-marks.mjs`, `spec/md-source.mjs`, `spec/flowchart.mjs`, `spec/markdown-style.css`), ink geometry
 (`spec/ink.mjs`),
 the layout model and line planner (`layout/model.mjs`, `layout/line-plan.mjs`, `layout/typography.mjs`, `layout/preparation.mjs`,
@@ -35,14 +35,15 @@ own MIT notices. The edit-ledger module (`kit/rapier-ledger.mjs`, `kit/ledger/*.
 its editor compatibility import (`editor/journal-records.mjs`) are also covered. The
 record validator/replayer and text-only conflict merger were moved, not copied,
 into that module; the Notes index merger and the rest of the agent/editor remain
-AGPL-3.0-only. The wrapper's carrier-staging helper
-(`skills/rapier-html/package-files.mjs`) is MIT. The kit's MIT-marked facades,
+AGPL-3.0-only. The page wrapper (`skills/rapier-html/wrap.mjs`, `skills/rapier-html/page.mjs`,
+`skills/rapier-html/return-address.mjs`) and its carrier-staging helper
+(`skills/rapier-html/package-files.mjs`) are MIT. The kit's MIT-marked facades,
 `kit/render-entry.mjs`, `kit/render*.mjs`, `kit/export-fonts.mjs`, `kit/print-capitals.mjs`,
 `kit/pdf-vectors.mjs`, `kit/pdf-glyphs.mjs`, `kit/stage.mjs` and MIT-marked conformance
 modules are covered too. These names describe the Rapier-owned files carrying the
 MIT notice, not a grant over the editor or third-party code. Other Rapier-owned
-files retain their stated licence; the editor is AGPL-3.0-only (see `LICENSE`).
-Third-party components retain their own copyright and licence notices.
+files retain their stated license; the editor is AGPL-3.0-only (see `LICENSE`).
+Third-party components retain their own copyright and license notices.
 
 The portable font helpers read document definitions and accept explicit host validation and
 subsetting functions. The application binding (`editor/export-fonts.mjs`), captured-font

package/README.md

@@ -4,7 +4,7 @@ Read, render and write Self-contained Markdown in browsers and Node: one `.md` f
 drawings, layout and precise inline typography. Build portable documents for people and agents. Will/1 regions mark what an agent
 may edit, append to or preserve. MIT, no dependencies.
 
-- Typography uses ordinary inline HTML spans with validated size, colour and family. Comments and references
+- Typography uses ordinary inline HTML spans with validated size, color and family. Comments and references
   carry other optional facts; each reader chooses its HTML, style, extension and resource support.
 - One stylesheet renders the document as the editor and its exported page do.
 - The line planner flows text around a picture's real shape; a conformance suite of thirteen documents runs
@@ -93,7 +93,7 @@ DOM objects between document realms.
 
 This **DOM-hosted library** requires a DOM and sanitizer, the Rapier grammar,
 portable image preparation, style access and the named codec/layout ports it uses.
-Those dependencies keep their own licences: the MIT grant here does not relicense a
+Those dependencies keep their own licenses: the MIT grant here does not relicense a
 separately supplied host or vendor. The [editor host binding](https://github.com/jackskip22/rapier/blob/main/src/editor/render-host.js)
 lists the renderer's dependencies. [rapier-server](https://github.com/jackskip22/rapier/blob/main/server/README.md)
 provides a complete local host with a pinned Chromium process. Its Word exporter and filesystem service are AGPL,
@@ -118,7 +118,7 @@ Browser hosts additionally check the exact captured container with an uninstalle
 Without `FontFace`, only the host validator's admission is established; it does not establish
 browser container support. The HTML font helpers do not bundle the application's font importer,
 container codecs or subsetter. Rapier binds its existing materializer and shared importer at `editor/render-host.js` through
-`editor/export-fonts.mjs`; those implementations retain their application licence.
+`editor/export-fonts.mjs`; those implementations retain their application license.
 An embedded family named Geist or Geist Mono remains custom data and takes precedence over the
 factory family. Custom fonts have no optional factory size limit.
 
@@ -140,7 +140,7 @@ family name share the host's font namespace. Print retains its existing factory
 | Import | What it is |
 | --- | --- |
 | `rapier-markdown-kit/layout` | The `md-layout:v1` comment a picture carries: parse it, validate it, write it back. |
-| `rapier-markdown-kit/marks` | Unified typography values, span writer and parser installer; preserved colour/font comments, ink and page breaks. |
+| `rapier-markdown-kit/marks` | Unified typography values, span writer and parser installer; preserved color/font comments, ink and page breaks. |
 | `rapier-markdown-kit/model` | Occupancy profiles and the line planner: the wrapping itself. |
 | `rapier-markdown-kit/typography` | Source-preserving paragraph refinement through `createTypography()`. |
 | `rapier-markdown-kit/will` | The Will/1 grammar (a separate, optional standard): the markers around an agent's intent regions. |
@@ -244,11 +244,11 @@ font-data authority, including a name that collides with a factory face.
 inline span; split block selections and keep their `#`, list markers and separators outside. `typography.parseStyle`
 returns only admitted facts. `typography.install(md)` installs that interpretation on the caller's markdown-it
 parser, and `typographySourceRanges(source, md)` reports original UTF-16 wrapper ranges through that parser.
-These calls neither mutate the source nor load resources. The installer also reads already-authored colour and
+These calls neither mutate the source nor load resources. The installer also reads already-authored color and
 font comments into the same facts; an ordinary open/save must preserve their bytes, not rewrite them as spans.
 
 Sizes accept positive decimal `pt`/`px`, at most 12 fractional digits, up to 1638pt/2184px; 96px = 72pt. New values
-use lowercase units and omit insignificant zeros. Colours become lowercase six-digit RGB hex; opaque integer
+use lowercase units and omit insignificant zeros. Colors become lowercase six-digit RGB hex; opaque integer
 RGB CSSOM values are also read. Families are one validated name, an unquoted CSS generic, or an existing preset
 stack. `sans`, `serif`, `mono`, `system`, `hand` are reserved choice aliases, not quoted custom identities. Styles
 are bounded to 4096 characters, 32 declarations and 64 paired levels. Invalid declarations and unknown properties
@@ -271,7 +271,7 @@ unit, independent of editor zoom. No mapping claims identical glyphs or line bre
 See the original [typography guidance](https://github.com/jackskip22/rapier/blob/main/docs/markdown-standard.md#inline-typography),
 [CommonMark raw HTML](https://spec.commonmark.org/0.31.2/#raw-html), [CSS absolute units](https://www.w3.org/TR/css-values-4/#absolute-lengths),
 [Pandoc spans](https://pandoc.org/MANUAL.html#extension-bracketed_spans) and [Quarto spans](https://quarto.org/docs/authoring/markdown-basics.html#divs-and-spans).
-Those specifications retain their own licences.
+Those specifications retain their own licenses.
 
 ## Render with the reference style
 
@@ -351,9 +351,9 @@ export const exampleSource = [
   'plain code',
   '~~~',
   '',
-  'A centred paragraph.' + formatLayout({align: 'center'}),
+  'A centered paragraph.' + formatLayout({align: 'center'}),
   '',
-  'A ' + formatColorRun(TEXT_COLOR_NAMES.blue, 'blue phrase') + ' keeps its colour.',
+  'A ' + formatColorRun(TEXT_COLOR_NAMES.blue, 'blue phrase') + ' keeps its color.',
   '',
   'And ' + typography.wrap({size: '13.5pt', color: '#175dc4', family: 'serif'}, '**precise words**') + ' keep their emphasis.',
   '',
@@ -499,11 +499,11 @@ Its historical line counts are not a current-engine or font-shaping acceptance g
 `--impl path/to/module.mjs` runs another implementation against the same documents; `--tolerance 2` sets the pixel
 tolerance.
 
-## Licence
+## License
 
-MIT, the full text in `LICENSE`; Rapier-owned modules and the stylesheet keep their MIT line. Pretext's complete licence,
+MIT, the full text in `LICENSE`; Rapier-owned modules and the stylesheet keep their MIT line. Pretext's complete license,
 notice and pinned source inventory are in `dist/agent/vendor/pretext/`. The selected upstream is unreleased main
-`bac1774c0f8b7a92e44b9da43b6d5443d55d0d9b`, despite its package version `0.0.9`. Its upstream licence includes
+`bac1774c0f8b7a92e44b9da43b6d5443d55d0d9b`, despite its package version `0.0.9`. Its upstream license includes
 Chromium/WebKit BSD, Unicode and ICU notices for derived code and generated data; those notices travel with the kit
 and the exported wrapping runtime. The history projection uses the MIT diff core;
 its full grant is in `dist/packages/rapier-diff/LICENSE`. The Rapier editor is AGPL-3.0-only and
@@ -623,7 +623,9 @@ the authorship projection recomputed from the ledger must agree exactly.
 text. Runs are `[start, end, actorKind, actorId, at]`, in order, nonoverlapping and
 covering every current character. A start without earlier authorship is attributed
 to `system/unattributed`, time zero. Insertions take the inserting record's actor
-and time; deleted runs disappear. Thus the projection contains **no removed text**.
+and time, except text an Undo or Redo puts back: a splice inserting exactly the text
+that a splice of the referenced act removed keeps the runs that text had. Deleted
+runs disappear. Thus the projection contains **no removed text**.
 An authorship-only import becomes a clearly incomplete insertion ledger; future
 attribution is again derived from that one ledger, never a mutable blame database.
 
@@ -669,9 +671,19 @@ editor's restore reader can replay the result. Both merge orders yield the same
 text for independently edited nonoverlapping ranges; their ordered ledgers need
 not be identical. Full and conflict receipts make repeated imports idempotent.
 
-Overlaps fall back to the existing text three-way merge. Unresolved alternatives
-are carried in the existing `note-conflict:v1` envelope, never silently selected.
-Different Will `keep` regions require conflict review even when one copy was
+An identical replacement converges with both original acts retained and one physical
+splice. The format identifier stays `rapier-ledger/2`. That unchanged identifier is not
+backward compatibility with an older reader. There is no `rapier-ledger/3`, no
+compatibility reader, and no migration. An older reader rejects the empty physical
+witness with `ledger_invalid` and does not mutate the ledger. Mixed-version sync throws
+`notes_history_unavailable` (`the note and its canonical history cannot be proved`).
+The older participant's store snapshot and remote object count stay unchanged. That
+throw is not a per-note `held` or `caughtUp` result. The same format string is not
+interoperability, and the ledger is not rewritten into the older shape. Reactivating
+any author of that replacement checks the shared text again; undoing that author
+withdraws it once no author remains. A different overlap returns `text_overlap_unpreserved` and the caller's exact
+ledger, including the text merge's alternatives for review, and does not mint a synthetic
+act. Different Will `keep` regions require conflict review even when one copy was
 unchanged. `review.required` names an unresolved result; a UI must not auto-accept
 it. Rapier offers carried-copy imports from Compare through its existing review,
 checks the live document again at commit, and installs the proven ledger before

package/dist/images/gif.mjs

@@ -39,7 +39,9 @@ export function inspectGIF(bytes) {
     at += 9; if (packed & 128) at += 3 * (2 << (packed & 7));
     need(1); if (bytes[at] < 2 || bytes[at] > 8) fail('Invalid GIF code size');
     at++; blocks(); frames++;
-    duration += control ? Math.max(20, (control[4] + control[5] * 256) * 10) : 100;
+    // A delay of 0 or 1 centisecond shows for 100 ms, as the browser draws it (images/playback.mjs times frames the same).
+    const delay = control ? control[4] + control[5] * 256 : 0;
+    duration += delay > 1 ? delay * 10 : 100;
     if (frames > 240 || width * height * frames > 96000000 || duration > 120000) fail('GIF animation exceeds the frame, work or duration budget');
     first ||= {control, image: bytes.subarray(start, at)}; control = null;
   }

package/dist/images/playback.mjs

@@ -31,8 +31,9 @@ export function createMediaPlayback(win, inspectGIF) {
     })();
     admitted.catch(error => {if (!closed) {state.status = 'admission-failed'; state.error = String(error.message).slice(0, 160); changed(state);}});
     // A decoder closes only after its in-flight decode settles; Chrome 155's JPEG XL decoder fails when closed mid-decode.
+    // Its budget place goes with it: a poster or a finished loop holds no decoder.
     let inflight = null;
-    const closeDecoder = () => {ticket++; win.clearTimeout(timer); timer = 0; const old = decoder; decoder = null; if (old) inflight ? inflight.then(() => old.close()) : old.close();};
+    const closeDecoder = () => {ticket++; win.clearTimeout(timer); timer = 0; active.delete(canvas); const old = decoder; decoder = null; if (old) inflight ? inflight.then(() => old.close()) : old.close();};
     const settle = async promise => {
       let timeout;
       try {return await Promise.race([promise, new Promise((_, reject) => {timeout = win.setTimeout(() => reject(new Error('Animation decode timeout')), 5000);})]);}
@@ -72,7 +73,8 @@ export function createMediaPlayback(win, inspectGIF) {
           if (canvas.height !== h) canvas.height = h;
           const ctx = canvas.getContext('2d'); ctx.clearRect(0, 0, w, h); ctx.drawImage(frame, 0, 0);
           if (!state.first && next === 0) state.first = canvas.toDataURL('image/png');
-          const delay = Math.max(20, (frame.duration || 100000) / 1000);
+          // A frame of 10 ms or less shows for 100 ms, as the browser draws an <img> (images/gif.mjs counts the same).
+          const delay = frame.duration > 10000 ? Math.max(20, frame.duration / 1000) : 100;
           duration += delay; if (duration > 120000) throw new Error('Animation exceeds the duration budget');
           state.status = 'ready'; state.frame = next; changed(state);
           if (single) {paused = true; closeDecoder(); return;}
@@ -93,8 +95,8 @@ export function createMediaPlayback(win, inspectGIF) {
       async first() {if (!state.first && !closed) {single = true; next = 0; paused = false; try {await step();} finally {single = false; paused = true; closeDecoder(); if (held) {held = false; this.suspend();}}} return state.first;},
       // Pause keeps the decoder and its frame position; only suspension and removal release it.
       pause() {paused = true; ticket++; win.clearTimeout(timer); timer = 0;},
-      suspend() {if (single) {held = true; return;} paused = true; closeDecoder(); canvas.width = canvas.height = 0; active.delete(canvas); state.status = 'suspended'; changed(state);},
-      close() {closed = true; paused = true; closeDecoder(); canvas.width = canvas.height = 0; active.delete(canvas);},
+      suspend() {if (single) {held = true; return;} paused = true; closeDecoder(); canvas.width = canvas.height = 0; state.status = 'suspended'; changed(state);},
+      close() {closed = true; paused = true; closeDecoder(); canvas.width = canvas.height = 0;},
       get paused() {return paused;}};
   }
   return {raster, inspectGIF, encode, source: '(' + createMediaPlayback.toString() + ')(window, ' + inspectGIF.toString() + ')'};

package/dist/kit/conformance/run.mjs

@@ -115,7 +115,7 @@ console.log(`A row's own hits/misses can undercount its real coverage: several f
 console.log(`segment cache (agent/vendor/pretext/measurement.js) serves a repeated (font, segment) query straight from that cache without calling`);
 console.log(`measureText again at all -- real data, just not counted against the SECOND document to ask for it. Two named, separate reasons a row still`);
 console.log(`reads CLOSE rather than AGREE, none of them "close enough": (a) no real trace exists at all for 01-inline/02-width-x-align/05-behind/06-front`);
-console.log(`-- their picture pushes no flow obstacle, so layout/interchange.js's own prepare() never calls Pretext for this paragraph during export (see`);
+console.log(`-- their picture pushes no flow obstacle, so kit/render.mjs's exported projector's prepare() never calls Pretext for this paragraph during export (see`);
 console.log(`measurer.mjs) -- the from-scratch character-sum approximation disagrees with real shaping by a bounded, named amount; (b) 03/11/13 DO run`);
 console.log(`Pretext for real (hits > 0, 13-rtl-text at 100% -- every query answered from the real trace) yet still carry a small, constant left-edge delta`);
 console.log(`(9.64px today, a constant from before this measurer existed) -- a picture-obstacle geometry fact, not a text one: these`);

package/dist/kit/ledger/authored-origin.mjs

@@ -0,0 +1,49 @@
+// SPDX-License-Identifier: MIT
+// Immutable authored origins shared by causal transport and inverse projection.
+import {_rapierTransformSplices, _rapierValidAuthored} from './journal-records.mjs';
+import {sha256} from './hash.mjs';
+
+// The frontier names only causal maxima. Linear history needs one predecessor,
+// and concurrent predecessors remain separate until an act observes both.
+function authoredFrontier(records, visit = null) {
+  const dependencies = new Map(), frontier = new Set();
+  for (const record of records) {
+    const id = record.transaction.id, basis = record.authored?.basis;
+    if (visit) visit(record, basis ?? [...frontier].sort());
+    if (!basis) { dependencies.set(id, [...frontier]); frontier.clear(); }
+    else {
+      const pending = [...basis], seen = new Set();
+      while (pending.length) {
+        const prior = pending.pop();
+        if (seen.has(prior)) continue;
+        if (!dependencies.has(prior)) throw new RangeError('canonical_origin_invalid');
+        seen.add(prior); frontier.delete(prior); pending.push(...dependencies.get(prior));
+      }
+      dependencies.set(id, basis);
+    }
+    frontier.add(id);
+  }
+  return [...frontier].sort();
+}
+
+export function authoredBasis(records) { return authoredFrontier(records); }
+
+export function authoredPlacements(base, records) {
+  const origins = new Map(); let source = base;
+  authoredFrontier(records, (record, basis) => {
+    origins.set(record.transaction.id, record.authored ?? authoredPlacement(source, record.splices, basis));
+    source = _rapierTransformSplices(source, record.splices);
+    if (source === null) throw new RangeError('canonical_origin_invalid');
+  });
+  return origins;
+}
+
+// Immutable authored placement stays on its own act. Basis IDs refer only to this
+// canonical history; no source snapshot or duplicate history is stored.
+export function authoredPlacement(source, splices, basis) {
+  const origin = {basis: basis.slice().sort(), source: sha256(source), splices: splices.map(row => ({...row}))};
+  if (!_rapierValidAuthored(origin) || _rapierTransformSplices(source, splices) === null)
+    throw new RangeError('canonical_origin_invalid');
+  return origin;
+}
+

package/dist/kit/ledger/authorship.mjs

@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: MIT
 import {readLedger, exportLedger, textRoot, rootAfter} from './format.mjs';
-import {_rapierTransformSplices} from './journal-records.mjs';
+import {_rapierTransformSplices, _rapierHistoryEffects} from './journal-records.mjs';
 import {sha256} from './hash.mjs';
 import {plainData, documentText, nonnegative, exactKeys, fault} from './data.mjs';
 function coalesce(runs) {
@@ -14,16 +14,25 @@ function coalesce(runs) {
   return out;
 }
 export function authorship(input) {
-  const {ledger, text} = readLedger(input);
+  const {ledger, text} = readLedger(input), references = _rapierHistoryEffects(ledger.records).references, removed = new Map();
   let runs = ledger.start.text ? [[0, ledger.start.text.length, 'system', 'unattributed', 0]] : [];
-  for (const record of ledger.records) for (const row of record.splices) {
-    const cut = row.pos + row.removed.length, delta = row.inserted.length - row.removed.length, before = [], after = [];
-    for (const run of runs) {
-      if (run[0] < row.pos) before.push([run[0], Math.min(run[1], row.pos), ...run.slice(2)]);
-      if (run[1] > cut) after.push([Math.max(run[0], cut) + delta, run[1] + delta, ...run.slice(2)]);
+  for (const record of ledger.records) {
+    // An Undo or Redo puts back text the act it references removed: that text keeps the runs it had.
+    const tx = record.transaction, gone = [], kept = (references?.get(tx.id) || []).flatMap(id => removed.get(id) || []);
+    for (const row of record.splices) {
+      const cut = row.pos + row.removed.length, delta = row.inserted.length - row.removed.length, before = [], after = [], inside = [];
+      for (const run of runs) {
+        if (run[0] < row.pos) before.push([run[0], Math.min(run[1], row.pos), ...run.slice(2)]);
+        if (run[1] > cut) after.push([Math.max(run[0], cut) + delta, run[1] + delta, ...run.slice(2)]);
+        if (run[0] < cut && run[1] > row.pos) inside.push([Math.max(run[0], row.pos) - row.pos, Math.min(run[1], cut) - row.pos, ...run.slice(2)]);
+      }
+      if (row.removed) gone.push({text: row.removed, runs: inside});
+      const at = row.inserted ? kept.findIndex(entry => entry.text === row.inserted) : -1;
+      const put = at < 0 ? [[row.pos, row.pos + row.inserted.length, tx.actor.kind, tx.actor.id, tx.createdAt]]
+        : kept.splice(at, 1)[0].runs.map(run => [run[0] + row.pos, run[1] + row.pos, ...run.slice(2)]);
+      runs = coalesce([...before, ...put, ...after]);
     }
-    const tx = record.transaction;
-    runs = coalesce([...before, [row.pos, row.pos + row.inserted.length, tx.actor.kind, tx.actor.id, tx.createdAt], ...after]);
+    removed.set(tx.id, gone);
   }
   return {format: 'rapier-authorship/1', sha256: sha256(text), runs};
 }

package/dist/kit/ledger/data.mjs

@@ -1,10 +1,13 @@
 // SPDX-License-Identifier: MIT
 // Only plain JSON data enters the public format. Accessors and toJSON are never executed.
 export function fault(message) { return Object.assign(new Error('Ledger: ' + message), {code: 'ledger_invalid'}); }
-function fields(value, depth, active, sorted = true) {
+// A plain object's prototype is null or Object's own. Both lookups read descriptors, so no getter runs.
+export const plainPrototype = proto => proto === null || Object.getPrototypeOf(proto) === null &&
+  Object.getOwnPropertyDescriptor(Object.getOwnPropertyDescriptor(proto, 'constructor')?.value || {}, 'name')?.value === 'Object';
+export function fields(value, depth, active, sorted = true) {
   if (!value || typeof value !== 'object' || depth > 64 || active.has(value)) throw fault('not plain JSON data');
-  const array = Array.isArray(value), proto = Object.getPrototypeOf(value);
-  if (!array && proto !== null && (Object.getPrototypeOf(proto) !== null || Object.getOwnPropertyDescriptor(proto, 'constructor')?.value?.name !== 'Object')) throw fault('not a plain object');
+  const array = Array.isArray(value);
+  if (!array && !plainPrototype(Object.getPrototypeOf(value))) throw fault('not a plain object');
   const descriptors = Object.getOwnPropertyDescriptors(value), keys = Reflect.ownKeys(descriptors);
   for (const key of keys) {
     if (array && key === 'length') continue;
@@ -14,7 +17,7 @@ function fields(value, depth, active, sorted = true) {
   if (array && (keys.length !== value.length + 1 || keys.some(k => k !== 'length' && (!/^(0|[1-9]\d*)$/.test(k) || +k >= value.length)))) throw fault('sparse array');
   return {array, descriptors, keys: array ? keys.filter(key => key !== 'length') : sorted ? keys.sort() : keys};
 }
-function scalar(value) {
+export function scalar(value) {
   if (value === null || typeof value === 'boolean') return true;
   if (typeof value === 'string') { if (/[\uD800-\uDFFF]/u.test(value)) throw fault('unpaired surrogate'); return true; }
   return typeof value === 'number' && Number.isFinite(value) && !Object.is(value, -0);

package/dist/kit/ledger/format.mjs

@@ -27,12 +27,34 @@ function* checkedRecords(ledger, prepared) {
   }
   if (ledger.head.revision !== revision || ledger.head.root !== root) throw fault('history does not describe this document');
 }
+// A ledger object read again is proved once: a boot reads one stored history through several records. The proof holds only
+// while that object still carries the exact proved data (its start text compared whole, the rest as canonical JSON), so a
+// changed byte is proved again, and refused. The proof lives as long as the object does.
+const proofs = new WeakMap();
 function readLedgerState(input, expectedText, expectedMetadata) {
   const ledger = plainData(input);
+  // The identifier rapier-ledger/2 is unchanged and is not backward compatible. This reader
+  // admits an empty physical splice whose authored rows name the same replacement. A reader
+  // from before that rule rejects the chain. Mixed-version sync throws notes_history_unavailable
+  // and leaves the older store unchanged; that refusal is not a held or caughtUp result.
   if (!exactKeys(ledger, ['format','documentAuthority','start','records','head','complete','sha256']) || ledger.format !== 'rapier-ledger/2' ||
       typeof ledger.documentAuthority !== 'string' || !ledger.documentAuthority || ledger.documentAuthority.length > 256 ||
       typeof ledger.complete !== 'boolean' || !Array.isArray(ledger.records) ||
       !exactKeys(ledger.start, ['text','revision','root','sha256','metadata']) || !exactKeys(ledger.head, ['revision','root','sha256','metadata'])) throw fault('unsupported or invalid envelope');
+  const shell = canonicalJSON({...ledger, start: {...ledger.start, text: ''}});
+  let proof = typeof input === 'object' ? proofs.get(input) : undefined;
+  if (!proof || proof.shell !== shell || proof.startText !== ledger.start.text) {
+    proof = {shell, startText: ledger.start.text, ...proveLedger(ledger)};
+    if (typeof input === 'object') proofs.set(input, proof);
+  }
+  proofs.set(ledger, proof);
+  const {text, metadata, root, revision, prepared, source} = proof;
+  if (expectedMetadata !== undefined && (!_rapierValidMetadata(expectedMetadata) || canonicalJSON(metadata) !== canonicalJSON(expectedMetadata)))
+    throw fault('metadata does not describe this document');
+  if (expectedText !== undefined && text !== expectedText) throw fault('history does not describe this document');
+  return {value: {ledger, text, metadata: {...metadata}, root, revision, complete: ledger.complete}, prepared, source};
+}
+function proveLedger(ledger) {
   const {sha256: claimed, ...payload} = ledger;
   if (claimed !== digest(payload)) throw fault('envelope checksum differs');
   let text = documentText(ledger.start.text), root = ledger.start.root, revision = ledger.start.revision;
@@ -55,12 +77,9 @@ function readLedgerState(input, expectedText, expectedMetadata) {
     try { authoredHistory(ledger.start.text, ledger.records); } catch (_) { throw fault('authored origin differs'); }
   }
   const metadata = prepared.replayMetadata(ledger.start.metadata);
-  if (!metadata || canonicalJSON(metadata) !== canonicalJSON(ledger.head.metadata) ||
-      (expectedMetadata !== undefined && (!_rapierValidMetadata(expectedMetadata) || canonicalJSON(metadata) !== canonicalJSON(expectedMetadata))))
-    throw fault('metadata does not describe this document');
-  if (ledger.head.revision !== revision || ledger.head.root !== root || ledger.head.sha256 !== sha256(text) ||
-      (expectedText !== undefined && text !== expectedText)) throw fault('history does not describe this document');
-  return {value: {ledger, text, metadata, root, revision, complete: ledger.complete}, prepared, source};
+  if (!metadata || canonicalJSON(metadata) !== canonicalJSON(ledger.head.metadata)) throw fault('metadata does not describe this document');
+  if (ledger.head.revision !== revision || ledger.head.root !== root || ledger.head.sha256 !== sha256(text)) throw fault('history does not describe this document');
+  return {text, metadata, root, revision, prepared, source};
 }
 // A stored copy may hold the head text alone. Its start is that text with every record reversed; readLedger proves it.
 export function ledgerWithStart(input, text) {
@@ -172,9 +191,7 @@ function finish(producer) {
   return step.value;
 }
 export function exportLedger(input) { return finish(produceLedger(input)).ledger; }
-// Both synchronous public export and cooperative recovery use the same producer.
 // Its returned facts were computed while admitting/hashing the exact head, never supplied.
-export function prepareLedger(input) { return finish(produceLedger(input)); }
 export async function prepareLedgerAsync(input, {yield: yieldWork, signal} = {}) {
   const producer = produceLedger(input);
   let step;

package/dist/kit/ledger/history.mjs

@@ -3,8 +3,8 @@
 import {_rapierTransformSplices, _rapierValidMetadata, _rapierTransformMetadata, _rapierMetadataDelta, _rapierHistoryEffects, _rapierMetadataState, _rapierPrepareHistoryRecords} from './journal-records.mjs';
 import {projectInverseSource, HistorySource} from './inverse-source.mjs';
 import {textRootParts, rootAfter} from './hash.mjs';
-import {authoredHistory} from './transport.mjs';
-import {plainData} from './data.mjs';
+import {authoredHistory, authoredPlacements} from './transport.mjs';
+import {plainData, canonicalJSON} from './data.mjs';
 
 const historyFailure = reason => ({ok: false, reason});
 const historyInteger = value => Number.isSafeInteger(value) && value >= 0 && !Object.is(value, -0);
@@ -104,8 +104,11 @@ function prepareHistory(input) {
 				!(tx.createdAt === null || historyInteger(tx.createdAt)) ||
 				(tx.turnId != null && (typeof tx.turnId !== 'string' || !tx.turnId || tx.turnId.length > 160))) return historyFailure('history_invalid');
 			if (tx.baseRevision !== prior) complete = false;
+			const coincidentWitness = !splices.length && record.authored && Array.isArray(record.authored.splices) &&
+				record.authored.splices.some(row => row.removed.length);
 			if (!splices || effect === undefined || (!splices.length &&
-				!Object.values(effect || {}).some(pair => pair.before !== pair.after) && !effects.references.get(tx.id)?.length)) return historyFailure('history_unavailable');
+				!Object.values(effect || {}).some(pair => pair.before !== pair.after) && !effects.references.get(tx.id)?.length &&
+				!coincidentWitness)) return historyFailure('history_unavailable');
 			const row = {record, splices, metadata: effect};
 			rows.push(row); byId.set(tx.id, row); prior = tx.revision;
 		}
@@ -293,10 +296,13 @@ export function historyPlaces(input, blocks) {
 			if (!slices.has(key)) slices.set(key, source.slice(from, to));
 			return slices.get(key);
 		};
+		// One record's act is read once; the blocks it touched share its fields (a whole-document delete touches every block).
+		let act = null;
 		for (const [node, afterRange] of touched) {
 			const beforeRange = ranges.range(node), previous = {...beforeRange, source: cut(beforeSource, 'b', beforeRange.from, beforeRange.to)},
 				after = {...afterRange, source: cut(afterSource, 'a', afterRange.from, afterRange.to)};
-			if (previous.source !== after.source) node.block.acts.push({...historyAct(record), before: previous, after});
+			// A point (where words were deleted) has no words to compare: the act that touched it wrote there.
+			if (previous.source !== after.source || afterRange.from === afterRange.to) node.block.acts.push({...(act ||= historyAct(record)), before: previous, after});
 		}
 	}
 
@@ -334,7 +340,27 @@ export function selectiveUndo(input, actIds, options = {}) {
 	const metadata = _rapierMetadataDelta(prepared.metadata, afterMetadata), effectChanged = selected.size > 0;
 	const sourceEffectChanged = records.some(record => record.splices.length && !prepared.effects.references.get(record.transaction.id)?.length &&
 		prepared.effects.active.has(record.transaction.id) !== projectedEffects.active.has(record.transaction.id));
-	if (!sourceEffectChanged) return {ok: true, splices: [], after: prepared.source, actIds: [...requested],
+	// One shared replacement is visible while any of its authors is active. That
+	// includes an author stored with no second physical splice, and an inverse
+	// whose only effect is to make such an author active again.
+	let coverVisibilityChanged = false;
+	if (!sourceEffectChanged && selected.size) {
+		let origins = null;
+		try { origins = authoredPlacements(prepared.initialSource, records); } catch { origins = null; }
+		const groups = new Map();
+		if (origins) for (const record of records) {
+			const tx = record.transaction, origin = origins.get(tx.id);
+			if (!origin?.splices.some(row => row.removed.length) || tx.reverts || tx.reapplies ||
+				tx.sourceTransactionId || tx.sourceTransactionIds?.length) continue;
+			const key = canonicalJSON({basis: origin.basis, splices: origin.splices});
+			if (!groups.has(key)) groups.set(key, []);
+			groups.get(key).push(tx.id);
+		}
+		const covered = (effects, ids) => ids.some(id => effects.active.has(id));
+		for (const ids of groups.values()) if (ids.length > 1 && covered(prepared.effects, ids) !== covered(projectedEffects, ids))
+			coverVisibilityChanged = true;
+	}
+	if (!sourceEffectChanged && !coverVisibilityChanged) return {ok: true, splices: [], after: prepared.source, actIds: [...requested],
 		sourceTransactionIds: [...selected], metadata, afterMetadata, effectChanged, unchanged: !metadata && !effectChanged,
 		superseded: [], overlaps: []};
 	try {