rapier-markdown-kit 1.2.7 → 1.2.9

package/dist/kit/ledger/hash.mjs

@@ -1,9 +1,7 @@
 // SPDX-License-Identifier: MIT
-// The editor's path-dependent root, plus synchronous SHA-256 for file readers (including offline wrappers).
 export function textRoot(text) {
   return textRootParts([text]);
 }
-// The same UTF-16 root over shared source pieces, without joining a historical body.
 export function textRootParts(parts) {
   let fnv = 0x811c9dc5, a = 1, b = 0, length = 0;
   for (const text of parts) {
@@ -30,7 +28,6 @@ const K = new Uint32Array([
   0x748f82ee,0x78a5636f,0x84c87814,0x8cc70208,0x90befffa,0xa4506ceb,0xbef9a3f7,0xc67178f2,
 ]);
 const rotate = (x, n) => (x >>> n) | (x << (32 - n));
-// One bounded SHA-256 compression state for file bytes and encoded source text.
 export function sha256State() {
   const h = new Uint32Array([0x6a09e667,0xbb67ae85,0x3c6ef372,0xa54ff53a,0x510e527f,0x9b05688c,0x1f83d9ab,0x5be0cd19]);
   const w = new Uint32Array(64), block = new Uint8Array(64);
@@ -82,14 +79,11 @@ export function sha256State() {
     get bytes() { return bytes; },
   };
 }
-// UTF-16 chunks share that byte state. Retain a trailing high surrogate so a
-// caller can split a character between updates without changing its UTF-8 digest.
 export function createSHA256() {
   const hash = sha256State(), encoded = new Uint8Array(65536), encoder = new TextEncoder();
   let high = '', finished = false;
   const write = text => {
     for (let at = 0; at < text.length;) {
-      // Bound both the substring and byte allocation; encodeInto never cuts a scalar.
       let end = Math.min(text.length, at + 32768);
       if (end < text.length && (text.charCodeAt(end - 1) & 0xfc00) === 0xd800 && (text.charCodeAt(end) & 0xfc00) === 0xdc00) end--;
       const part = encoder.encodeInto(text.slice(at, end), encoded);
@@ -117,4 +111,14 @@ export function sha256Parts(parts) {
   for (const part of parts) hash.update(part);
   return hash.digest();
 }
-export function sha256(text) { return createSHA256().update(text).digest(); }
+const LONG_TEXT = 65536, DIGESTS = new Map();
+export function sha256(text) {
+  if (typeof text !== 'string' || text.length < LONG_TEXT) return createSHA256().update(text).digest();
+  let digest = DIGESTS.get(text);
+  if (digest === undefined) {
+    digest = createSHA256().update(text).digest();
+    if (DIGESTS.size >= 4) DIGESTS.delete(DIGESTS.keys().next().value);
+  } else DIGESTS.delete(text);
+  DIGESTS.set(text, digest);
+  return digest;
+}

package/dist/kit/ledger/history.mjs

@@ -1,5 +1,4 @@
 // SPDX-License-Identifier: MIT
-// Transient projections and selective inverses of the existing canonical journal.
 import {_rapierTransformSplices, _rapierValidMetadata, _rapierTransformMetadata, _rapierMetadataDelta, _rapierHistoryEffects, _rapierMetadataState, _rapierPrepareHistoryRecords} from './journal-records.mjs';
 import {projectInverseSource, HistorySource} from './inverse-source.mjs';
 import {textRootParts, rootAfter} from './hash.mjs';
@@ -41,16 +40,12 @@ export function groupHistoryActs(acts) {
 	return groups;
 }
 
-// A picture's codec replacement travels with its original navigation step.
-// Match every complete replacement exactly before moving any source bytes.
 export function pictureHistorySplices(input, target, redo) {
 	const {records} = input;
 	const id = target?.transaction?.id, at = records.indexOf(target);
 	if (!id || at < 0 || target.transaction.operation === 'document.finish-picture' || !Array.isArray(target.splices)) return null;
 	const later = records.slice(at + 1).filter(row => row?.transaction?.operation === 'document.finish-picture' && Array.isArray(row.splices) && row.splices.length);
 	if (!later.length) return null;
-	// A caller may hold a persistent source tree: request its text only when
-	// a later picture replacement can actually affect this navigation step.
 	const source = input.source;
 	const own = new Set(later.filter(row => row.transaction.sourceTransactionId === id));
 	const step = redo ? target.splices : target.splices.slice().reverse().map(row => ({pos: row.pos, removed: row.inserted, inserted: row.removed}));
@@ -78,9 +73,6 @@ export function pictureHistorySplices(input, target, redo) {
 	try { return plan(true); } catch (_) { return null; }
 }
 
-// Keep only the latest source observation. Inactive live documents must not retain
-// every revision's source tree. The weak key also lets the latest input be collected.
-// Mutable caller data is compared/captured before this cache can be consulted.
 let preparedHistories = new WeakMap();
 function prepareHistory(input) {
 	try {
@@ -123,7 +115,6 @@ function prepareHistory(input) {
 			row.beforeSource = initial; row.beforeMetadata = initialMetadata;
 		}
 		const earliestRevision = records[0]?.transaction.baseRevision ?? revision;
-		// The window's owner may name its root (the source store mints it once per text); otherwise hash the initial text.
 		let root = earliestRevision === 0 ? (typeof input.earliestRoot === 'string' && input.earliestRoot || textRootParts(initial.parts())) : null,
 			rootRevision = earliestRevision;
 		for (const {record, splices} of rows) {
@@ -131,8 +122,6 @@ function prepareHistory(input) {
 			if (hashed && (![record.beforeHash, record.afterHash].every(value =>
 				typeof value === 'string' && /^\d+:[a-z0-9]+:[a-z0-9]+$/.test(value)) ||
 				(splices.length ? record.beforeHash === record.afterHash : record.beforeHash !== record.afterHash))) return historyFailure('history_invalid');
-			// Revision gaps begin a new path root; a continuous revision-zero prefix
-			// still binds every untouched source byte through the initial text root.
 			if (record.transaction.baseRevision !== rootRevision) root = null;
 			if (hashed) {
 				if (root !== null && record.beforeHash !== root) return historyFailure('history_invalid');
@@ -155,12 +144,18 @@ function prepareHistory(input) {
 	} catch (_) { return historyFailure('history_invalid'); }
 }
 
+function settle(result, value) {
+	Object.defineProperty(result, 'initialSource', {value, writable: true, enumerable: true, configurable: true});
+	return value;
+}
+
 export function replayHistory(input) {
 	const prepared = prepareHistory(input);
 	if (!prepared.ok) return prepared;
-	const {source, initialSource, metadata, initialMetadata, revision, earliestRevision, complete, rows, effects} = prepared;
+	const {source, metadata, initialMetadata, revision, earliestRevision, complete, rows, effects} = prepared;
 	const acts = rows.filter(({record}) => !effects.pictures.has(record.transaction.id)).map(({record}) => historyAct(record, effects));
-	return {ok: true, source, initialSource, metadata: {...metadata}, initialMetadata: {...initialMetadata}, revision, earliestRevision, complete, acts,
+	return {ok: true, source, get initialSource() { return settle(this, prepared.initialSource); }, set initialSource(value) { settle(this, value); },
+		metadata: {...metadata}, initialMetadata: {...initialMetadata}, revision, earliestRevision, complete, acts,
 		effectiveActIds: effects.effectiveActIds.slice(), groups: groupHistoryActs(acts)};
 }
 
@@ -218,7 +213,6 @@ export function historyProjection(input, {from = 0, to = input?.source?.length,
 	return projectHistoryRange(prepared, from, to, actId);
 }
 
-// Several ranges share one proved source snapshot for this call.
 export function historyProjections(input, ranges) {
 	const prepared = prepareHistory(input);
 	if (!prepared.ok) return prepared;
@@ -227,8 +221,6 @@ export function historyProjections(input, ranges) {
 		projectHistoryRange(prepared, from, to, actId))};
 }
 
-// Block intervals stay ordered under reverse splices. A fixed balanced tree can
-// shift an untouched suffix lazily and visit only intervals crossing the edit.
 function historyBlockIndex(projected) {
 	const items = projected.map(block => ({block, range: {from: block.from, to: block.to}, shift: 0}))
 		.sort((a, b) => a.range.from - b.range.from);
@@ -278,8 +270,6 @@ export function historyPlaces(input, blocks) {
 		const {record, splices, beforeSource, afterSource} = prepared.rows[index], touched = new Map();
 		for (let at = splices.length - 1; at >= 0; at--) ranges.move(splices[at], node => {
 			if (touched.has(node) || prepared.effects.pictures.has(record.transaction.id)) return;
-			// Earlier splices in this reverse walk only shifted this interval. Recover
-			// its coordinates at the record's after-state before recording the first touch.
 			let after = {...node.range};
 			for (let prior = at + 1; prior < splices.length; prior++) {
 				const row = splices[prior];
@@ -290,37 +280,31 @@ export function historyPlaces(input, blocks) {
 			}
 			touched.set(node, after);
 		});
-		// Blocks one splice covers share its range (a whole-document delete maps every block to all it removed): slice each range once.
 		const slices = new Map(), cut = (source, side, from, to) => {
 			const key = side + from + ':' + to;
 			if (!slices.has(key)) slices.set(key, source.slice(from, to));
 			return slices.get(key);
 		};
-		// One record's act is read once; the blocks it touched share its fields (a whole-document delete touches every block).
 		let act = null;
 		for (const [node, afterRange] of touched) {
 			const beforeRange = ranges.range(node), previous = {...beforeRange, source: cut(beforeSource, 'b', beforeRange.from, beforeRange.to)},
 				after = {...afterRange, source: cut(afterSource, 'a', afterRange.from, afterRange.to)};
-			// A point (where words were deleted) has no words to compare: the act that touched it wrote there.
 			if (previous.source !== after.source || afterRange.from === afterRange.to) node.block.acts.push({...(act ||= historyAct(record)), before: previous, after});
 		}
 	}
 
 	const acts = prepared.rows.filter(({record}) => !prepared.effects.pictures.has(record.transaction.id)).map(({record}) => historyAct(record));
-	// Native Redo consumes its Undo as navigation while keeping that receipt in
-	// the reading history. All material withdrawals use the canonical blockers,
-	// including independent inverses holding the same original act suppressed.
 	const reversed = new Set();
 	for (const {record} of prepared.rows) if (prepared.effects.active.has(record.transaction.id) && !record.transaction.reapplies)
 		for (const id of prepared.effects.references.get(record.transaction.id) || []) reversed.add(id);
 
 	for (const block of projected) block.acts.reverse();
-	return {ok: true, source: prepared.source, initialSource: prepared.initialSource, revision: prepared.revision,
+	return {ok: true, source: prepared.source, get initialSource() { return settle(this, prepared.initialSource); },
+		set initialSource(value) { settle(this, value); }, revision: prepared.revision,
 		earliestRevision: prepared.earliestRevision, complete: prepared.complete, acts, blocks: projected,
 		reversed: acts.filter(act => reversed.has(act.id)).map(act => act.id)};
 }
 
-// Runs retain only exact replacement ancestry. A later replacement owns an ambiguous hunk whole.
 export function selectiveUndo(input, actIds, options = {}) {
 	const prepared = prepareHistory(input);
 	if (!prepared.ok) return prepared;
@@ -340,9 +324,6 @@ export function selectiveUndo(input, actIds, options = {}) {
 	const metadata = _rapierMetadataDelta(prepared.metadata, afterMetadata), effectChanged = selected.size > 0;
 	const sourceEffectChanged = records.some(record => record.splices.length && !prepared.effects.references.get(record.transaction.id)?.length &&
 		prepared.effects.active.has(record.transaction.id) !== projectedEffects.active.has(record.transaction.id));
-	// One shared replacement is visible while any of its authors is active. That
-	// includes an author stored with no second physical splice, and an inverse
-	// whose only effect is to make such an author active again.
 	let coverVisibilityChanged = false;
 	if (!sourceEffectChanged && selected.size) {
 		let origins = null;

package/dist/kit/ledger/inverse-source.mjs

@@ -1,6 +1,4 @@
 // SPDX-License-Identifier: MIT
-// Exact source projection shared by canonical history and causal transport.
-// Callers admit and order the records first; this projection retains no state.
 import {_rapierTransformSplices, _rapierHistoryEffects} from './journal-records.mjs';
 import {authoredPlacements} from './authored-origin.mjs';
 import {canonicalJSON} from './data.mjs';
@@ -11,8 +9,6 @@ const historyBoundary = (source, at) => Number.isSafeInteger(at) && at >= 0 && !
 	!(at > 0 && at < source.length && (source.charCodeAt(at - 1) & 0xFC00) === 0xD800 &&
 	(source.charCodeAt(at) & 0xFC00) === 0xDC00);
 
-// Persistent AVL pieces retain original strings and coordinates. A revision costs
-// only the edited paths; reading a range visits its leaves, never earlier bodies.
 const sourceLeaf = (text, from = 0, to = text.length) => to > from
 	? {text, from, length: to - from, height: 1} : null;
 const sourceHeight = node => node?.height || 0;
@@ -101,8 +97,6 @@ export class HistorySource {
 		for (const text of parts) for (let at = 0; at < text.length;) {
 			if (!leaf) return false;
 			const length = Math.min(leaf.length - offset, text.length - at), from = leaf.from + offset;
-			// Untouched runs share their string and coordinates. Only changed fragments
-			// require a text comparison; no full-body join is needed to prove the plan.
 			if ((leaf.text !== text || from !== at) && leaf.text.slice(from, from + length) !== text.slice(at, at + length)) return false;
 			offset += length; at += length;
 			if (offset === leaf.length) { leaf = leaves.next().value; offset = 0; }
@@ -113,8 +107,6 @@ export class HistorySource {
 		const [left, rest] = sourceSplit(this.#root, pos), [, right] = sourceSplit(rest, length);
 		return new HistorySource('', sourceJoin(sourceJoin(left, sourceLeaf(text)), right));
 	}
-	// Undoing an admitted repair is observation: its after-state can join a scalar
-	// across the deleted run. Prove the forward boundaries on the reconstructed view.
 	before(splices) {
 		let source = this;
 		for (let index = splices.length - 1; index >= 0; index--) {
@@ -151,8 +143,6 @@ function minimalHistorySplice(before, after, pos = 0) {
 	return {pos: pos + first, removed: before.slice(first, a), inserted: after.slice(first, b)};
 }
 
-// Split recorded replacements only at exact unchanged word or line tokens.
-// Shared letters inside changed words do not establish surviving ownership.
 function historyHunks(row) {
 	if (row.removed === row.inserted) return [];
 	if (!row.removed || !row.inserted) return [{...row}];
@@ -166,8 +156,6 @@ function historyHunks(row) {
 }
 
 
-// Rows are already proved source placements, optionally carrying sourceIndices from
-// causal projection. Multiple inverse blockers can change history with no source edit.
 export function projectInverseSource(prepared, selected, projectedEffects, options = {}) {
 	const records = prepared.records || prepared.rows.map(({record, splices}) => record.splices === splices ? record : {...record, splices});
 	if (!records.some(record => !prepared.effects.references.get(record.transaction.id)?.length &&
@@ -179,8 +167,6 @@ export function projectInverseSource(prepared, selected, projectedEffects, optio
 		const recordsForCover = prepared.records || prepared.rows.map(({record, splices}) => record.splices === splices ? record : {...record, splices});
 		const coverGroups = new Map();
 		let coverOrigins = null;
-		// An empty document is a real causal source. Fresh notes start there, and a
-		// shared replacement authored against that source still has to stay covered.
 		if (typeof prepared.initialSource === 'string' && recordsForCover.some(record => record.authored?.splices?.some(row => row.removed.length))) {
 			try { coverOrigins = authoredPlacements(prepared.initialSource, recordsForCover); } catch { coverOrigins = null; }
 		}
@@ -254,9 +240,6 @@ export function projectInverseSource(prepared, selected, projectedEffects, optio
 			return next && effects.active.has(next.actId) && !prepared.effects.references.get(next.actId)?.length;
 		});
 		const reactivate = (actIds, effects) => {
-			// Any author of one shared removal or replacement restores that one physical
-			// hunk, including an author who stored no splice. A later independent act
-			// keeps the bytes it wrote until that act itself is withdrawn.
 			const wanted = new Set(actIds);
 			for (const id of actIds) for (const hunk of all) {
 				if (hunk.reversedHunk || hunk.derived || !hunk.coverIds?.includes(id) || wanted.has(hunk.actId)) continue;
@@ -269,8 +252,6 @@ export function projectInverseSource(prepared, selected, projectedEffects, optio
 					(!hunk.inserted && hunk.active)) continue;
 				const marker = pieces.indexOf(hunk.marker);
 				if (marker < 0) {
-					// A zero-row withdrawal can release source still carried by another
-					// inverse's marker. Its exact ancestry also preserves later inserted runs.
 					const inverse = all.findLast(prior => prior.reversedHunk === hunk.id && pieces.includes(prior.marker));
 					if (!inverse) throw Error('reactivation');
 					const runs = all.filter(prior => prior.actId === inverse.actId && prior.reversedHunk === hunk.id && pieces.includes(prior.marker));
@@ -302,8 +283,6 @@ export function projectInverseSource(prepared, selected, projectedEffects, optio
 			processed.push(record);
 			const picture = prepared.effects.pictures.get(tx.id);
 			if (picture) {
-				// The new codec bytes keep the exact inserted run's ownership. Do not
-				// cross a later edit, combine authors, or create another reversible act.
 				for (const row of splices) {
 					boundary(row.pos + row.removed.length);
 					const start = boundary(row.pos), end = boundary(row.pos + row.removed.length);
@@ -318,15 +297,11 @@ export function projectInverseSource(prepared, selected, projectedEffects, optio
 				continue;
 			}
 			if (references.size) {
-				// Exact inverse rows restore the previous run identities. Retain the inverse's
-				// own transient marker too, so reversing it restores that same ancestry again.
 				const invert = targets => {
 					const restored = pieces.slice(), inverses = [], priorSplices = options.keepHunk ? [] : null;
 					for (let index = targets.length - 1; index >= 0; index--) {
 						const target = targets[index], first = restored.indexOf(target.marker);
 						if (first < 0) return null;
-						// Each run of the target's own pieces inverts alone: a later author's pieces between
-						// its runs stay in place, outside every inverse, so reversing it cannot move them.
 						const runs = [];
 						for (let at = first; at < restored.length; at++) if (owns(restored[at], target))
 							if (runs.at(-1)?.[1] === at) runs.at(-1)[1]++; else runs.push([at, at + 1]);
@@ -346,8 +321,6 @@ export function projectInverseSource(prepared, selected, projectedEffects, optio
 								hunk.chosen = !keep;
 							}
 							hunk.kept = selected.has(tx.id) && !hunk.chosen;
-							// A semantic owner retaining this inverse also retains the exact ancestors
-							// it restored; effect reactivation must not change them behind that owner.
 							if (hunk.kept) for (let prior = target; prior; prior = byId.get(prior.reversedHunk)) keptInverseAncestors.add(prior.id);
 							hunk.marker = {mark: hunk};
 							const insertion = replacement.map(piece => piece.text ? {...piece,
@@ -359,10 +332,6 @@ export function projectInverseSource(prepared, selected, projectedEffects, optio
 					}
 					return replays(pieces, restored, splices) ? {restored, inverses} : null;
 				};
-				// An inverse taken while a later edit had replaced some of the act's hunks restored only
-				// the rest. Those replaced hunks survive it: no later projection treats them as undone.
-				// Recorded splices decide. An author who stored no splice still inverts the one
-				// shared hunk; an empty inverse does not match that text change and leaves it.
 				const direct = all.filter(hunk => hunk.active && references.has(hunk.actId));
 				const targets = direct.length ? direct : all.filter(hunk => hunk.active && !hunk.reversedHunk && !hunk.derived &&
 					hunk.coverIds?.some(id => references.has(id)));
@@ -399,16 +368,12 @@ export function projectInverseSource(prepared, selected, projectedEffects, optio
 			}
 			if (!references.size) coverIdsFor(tx.id);
 			const priorSplices = options.keepHunk ? [] : null;
-			// An admitted codec finish replaces the complete embedded definition/reference.
-			// Keep its inserted run whole, including byte-identical prefixes of a re-edit;
-			// the previous picture stays in `before` for Undo, not as mixed live ownership.
 			const hunks = row => pictureInsertions.get(tx.id)?.some(text => row.inserted.includes(text)) ? [{...row}] : historyHunks(row);
 			for (let rowIndex = 0; rowIndex < splices.length; rowIndex++) {
 				const original = splices[rowIndex];
 				let rows;
 				if (options.splitSplice) {
 					const beforeSource = textOf(pieces), parts = options.splitSplice({actId: tx.id, beforeSource, splice: original});
-					// Semantic boundaries only refine this act's exact bytes, never its history.
 					if (!Array.isArray(parts) || _rapierTransformSplices(beforeSource, parts) !== _rapierTransformSplices(beforeSource, [original]))
 						throw Error('hunk_projection');
 					rows = parts.flatMap(hunks);
@@ -421,14 +386,11 @@ export function projectInverseSource(prepared, selected, projectedEffects, optio
 					const start = boundary(row.pos), end = boundary(row.pos + row.removed.length);
 					let at = start.last, count = Math.max(0, end.first - at);
 					if (!row.removed.length) {
-						// A new insertion at a replacement's left boundary stays before that replacement.
 						const marker = pieces.slice(start.first, start.last).findIndex(item => item.mark?.inserted.length);
 						at = marker < 0 ? start.last : start.first + marker; count = 0;
 					}
 					const removed = pieces.slice(at, at + count);
 					if (textOf(removed) !== row.removed) throw Error('replay');
-					// A semantic owner may retain a drawing hunk while prose in that same act undoes.
-					// The predicate only selects transient hunks; every original row still replays.
 					if (chosen && options.keepHunk) {
 						const keep = options.keepHunk({actId: tx.id, spliceIndex: rowIndex, hunkIndex: index,
 							splice: {pos: row.pos, removed: row.removed, inserted: row.inserted}, beforeSource: textOf(pieces), actSource, priorSplices});
@@ -459,10 +421,6 @@ export function projectInverseSource(prepared, selected, projectedEffects, optio
 		let offset = 0;
 		for (const piece of pieces) if (piece.text) { origins.set(piece, offset); offset += piece.text.length; }
 		const superseded = [];
-		// Survival means an inverse left this hunk in place because a later independent
-		// edit still covered it. Once that edit is gone, deactivating its last owner through
-		// any inverse path withdraws every exposed hunk. Undoing only the later
-		// edit reveals the survived insertion and does not discard it.
 		for (const hunk of all) if (hunk.survived) {
 			const covered = [...hunk.supersededBy].some(id => {
 				const next = byId.get(id);
@@ -486,12 +444,8 @@ export function projectInverseSource(prepared, selected, projectedEffects, optio
 					reason: hunk.active ? 'later_edit' : 'already_undone'});
 				continue;
 			}
-			// Restoring an inverse can restore a deletion marker without any owned text.
 			restoreHunk(hunk);
 		}
-		// A hidden withdrawal can have no splice of its own. Reversing that withdrawal
-		// reactivates the shared hunk through the inverse that still carries it.
-		// Withdrawing a later act reveals that same hunk while any original author remains.
 		const reactivated = new Set(records.filter(record => !prepared.effects.active.has(record.transaction.id) &&
 			projectedEffects.active.has(record.transaction.id)).map(record => record.transaction.id));
 		for (const hunk of all) if (!hunk.reversedHunk && !hunk.derived && hunk.coverIds?.length > 1 &&

package/dist/kit/ledger/journal-records.mjs

@@ -5,14 +5,10 @@ const _RAPIER_TRANSACTION_ACTOR_LIMIT = 160;
 const _RAPIER_TRANSACTION_OPERATION_LIMIT = 96;
 const _RAPIER_TRANSACTION_REQUEST_LIMIT = 160;
 
-/* Validate every row, not only the final string: a half-pair replacement can produce a whole
-	 character while leaving unencodable fragments in the ledger; two invalid rows can also repair
-	 each other. Refusal is atomic. Pre-existing damage elsewhere stays untouched and editable. */
 function _rapierTransformSplices(text, splices, inverse = false) {
 	try {
 		if (!Array.isArray(splices)) return null;
 		let value = String(text == null ? '' : text);
-		// In Unicode mode a complete pair is one scalar, outside the surrogate range.
 		const whole = text => typeof text === 'string' && !/[\uD800-\uDFFF]/u.test(text);
 		const splitsPair = at => at > 0 && at < value.length &&
 			(value.charCodeAt(at - 1) & 0xFC00) === 0xD800 &&
@@ -81,7 +77,6 @@ function _rapierTransformMetadata(value, effect, inverse = false) {
 	return next;
 }
 
-// An origin binds transported placement to exact authored rows and their causal basis.
 function _rapierValidAuthored(origin) {
 	if (!_rapierPlainLedgerData(origin) || !origin || Array.isArray(origin) ||
 		Object.keys(origin).length !== 3 || !Array.isArray(origin.basis) ||
@@ -95,9 +90,6 @@ function _rapierValidAuthored(origin) {
 		!/[\uD800-\uDFFF]/u.test(row.removed) && !/[\uD800-\uDFFF]/u.test(row.inserted));
 }
 
-// The lookup is an observation of one call's supplied records. Material rows keep
-// their existing borrowed-row API; an inverse owns fresh rows. Navigation only
-// follows strictly earlier revisions, including when an unadmitted list is unordered.
 function _rapierRecordIndex(records) {
 	const byId = new Map(), splices = new Map(), metadata = new Map();
 	for (const record of records) {
@@ -139,8 +131,6 @@ function _rapierRecordSplices(entry, ledger) {
 	} catch (_) { return null; }
 }
 
-// Source identifies a retained checkpoint even when host revision numbers differ.
-// The History Slider compares now → earlier: that answer is the earlier → now walk, inverted.
 function journalOperations(before, after, journal) {
 	if (typeof before !== 'string' || typeof after !== 'string' || !Array.isArray(journal)) return;
 	if (before === after) return [];
@@ -151,15 +141,34 @@ function journalOperations(before, after, journal) {
 
 function journalWalk(before, after, journal) {
 	try {
-		let text = after;
+		const pieces = [after];
 		const lookup = _rapierRecordIndex(journal), groups = [];
+		let length = after.length;
+		const locate = at => { let index = 0; for (; index < pieces.length - 1 && at >= pieces[index].length; index++) at -= pieces[index].length; return [index, at]; };
+		const codeAt = at => { const [index, offset] = locate(at); return pieces[index].charCodeAt(offset); };
+		const read = (from, to) => { let out = ''; for (let [index, offset] = locate(from); from < to && index < pieces.length; index++, offset = 0) { const part = pieces[index].slice(offset, offset + to - from); out += part; from += part.length; } return out; };
+		const cut = at => { const [index, offset] = locate(at); if (offset > 0 && offset < pieces[index].length) pieces.splice(index, 1, pieces[index].slice(0, offset), pieces[index].slice(offset)); };
+		const whole = text => typeof text === 'string' && !/[\uD800-\uDFFF]/u.test(text);
+		const splitsPair = at => at > 0 && at < length && (codeAt(at - 1) & 0xFC00) === 0xD800 && (codeAt(at) & 0xFC00) === 0xDC00;
 		for (let index = journal.length - 1; index >= 0; index--) {
 			const rows = lookup.splices(journal[index]);
-			const prior = _rapierTransformSplices(text, rows, true);
-			if (prior === null) return;
+			if (!Array.isArray(rows)) return;
+			for (const row of rows.slice().reverse()) {
+				if (!row || !Number.isSafeInteger(row.pos) || row.pos < 0 || Object.is(row.pos, -0)) return;
+				const pos = row.pos, removed = row.inserted, inserted = row.removed;
+				if (!whole(removed) || !whole(inserted) || pos > length || pos + removed.length > length ||
+						splitsPair(pos) || splitsPair(pos + removed.length) || read(pos, pos + removed.length) !== removed) return;
+				cut(pos); cut(pos + removed.length);
+				let [first] = locate(pos), count = 0;
+				if (pos === length) first = pieces.length;
+				else if (locate(pos)[1] !== 0) first++;
+				for (let left = removed.length; left > 0; count++) left -= pieces[first + count].length;
+				pieces.splice(first, count, ...(inserted ? [inserted] : []));
+				length += inserted.length - removed.length;
+				for (let at = pieces.length - 1; at >= 0; at--) if (!pieces[at] && pieces.length > 1) pieces.splice(at, 1);
+			}
 			groups.push(rows);
-			if (prior === before) return groups.reverse().flat().map(({pos, removed, inserted}) => ({pos, removed, inserted}));
-			text = prior;
+			if (length === before.length && pieces.join('') === before) return groups.reverse().flat().map(({pos, removed, inserted}) => ({pos, removed, inserted}));
 		}
 	} catch (_) { return; }
 }
@@ -167,14 +176,11 @@ function journalWalk(before, after, journal) {
 function _rapierRecordMetadata(entry, ledger) {
 	try {
 		if (Object.hasOwn(entry, 'metadata')) return _rapierValidMetadataEffect(entry.metadata) ? entry.metadata : undefined;
-		// An expanded record owns its complete effect; only compact navigation inherits one.
 		if (Array.isArray(entry.splices)) return null;
 		return _rapierRecordIndex(ledger || []).metadata(entry);
 	} catch (_) { return undefined; }
 }
 
-// A codec replacement owns only one inserted definition and its reference. Its
-// source act remains the picture's author; an arbitrary edit cannot claim upkeep.
 function _rapierPictureFinish(record, original, earlier, lookup) {
 	const tx = record?.transaction, rows = record?.splices;
 	if (tx?.operation !== 'document.finish-picture' || !tx.sourceTransactionId || tx.sourceTransactionIds ||
@@ -221,9 +227,6 @@ function _rapierPictureFinish(record, original, earlier, lookup) {
 	});
 }
 
-// Every active inverse keeps its original targets suppressed. Independent inverses
-// can share a target; withdrawing one restores it only after the last blocker leaves.
-// This includes assignments hidden by later choices. No second history is retained.
 function _rapierWalkHistoryEffects(records, lookup, visit = null, observe = null) {
 	try {
 		if (!Array.isArray(records)) return {ok: false};
@@ -238,9 +241,6 @@ function _rapierWalkHistoryEffects(records, lookup, visit = null, observe = null
 				if (was !== node.active) for (const ref of node.references) pending.push([ref, node.active ? 1 : -1]);
 			}
 		};
-		// Most admission needs only the final effect graph. A backwards pass proves it
-		// in linear work; prefix activity is asked only by native Redo, picture custody,
-		// or a metadata assignment. The explicit stack also bounds long inverse chains.
 		const activity = new Map();
 		const active = id => {
 			if (visit) return nodes.get(id).active;
@@ -258,8 +258,6 @@ function _rapierWalkHistoryEffects(records, lookup, visit = null, observe = null
 			return activity.get(id);
 		};
 		const lastUndo = new Map(), contexts = new Map(), order = [];
-		// Native Redo names an original act. Its inverse target is the last Undo
-		// in the author's proved causal view, not an unrelated later arrival.
 		const contextOf = origin => {
 			if (!origin) return null;
 			if (!_rapierValidAuthored(origin)) throw Error('origin');
@@ -338,8 +336,6 @@ function _rapierHistoryEffects(records, visit = null) {
 	return _rapierWalkHistoryEffects(records, null, visit);
 }
 
-// Every transition constrains the two initial metadata scalars. This proves each
-// inverse's result once, before the caller supplies the exact initial metadata.
 function _rapierMetadataProof(lookup) {
 	const values = {}, required = {}, assignments = {filename: [], docKind: []};
 	const requireInitial = (key, value) => {
@@ -355,7 +351,6 @@ function _rapierMetadataProof(lookup) {
 			values[key] = pair.after;
 			if (!refs.length) assignments[key].push({id: record.transaction.id, value: pair.after});
 		}
-		// Source-only rows cannot change a previously proved metadata assignment.
 		if (!effect && !refs.length) return;
 		for (const key of ['filename', 'docKind']) {
 			const expected = assignments[key].findLast(row => active(row.id));
@@ -385,7 +380,6 @@ function _rapierMetadataState(initial, records, effects = _rapierHistoryEffects(
 	} catch (_) { return null; }
 }
 
-// Prove each recorded transition and each inverse's semantic result, not only the final values.
 function _rapierReplayMetadata(initial, records) {
 	if (!_rapierValidMetadata(initial)) return null;
 	try {
@@ -405,16 +399,9 @@ function _rapierHasHistoryEffect(record, earlier = []) {
 	return _rapierHistoryEffects([...earlier, {...record, transaction: {...tx, id}}]).ok;
 }
 
-// A cached observation owns every byte-bearing record. Mutable graphs are compared
-// through descriptors on every call; only a proved, recursively frozen graph can
-// bypass that walk. Per-object weak entries keep one latest copy, not a revision log.
 const _rapierPrepareHistoryRecords = (() => {
 	const copies = new WeakMap();
-	// Repeated queries share the latest proved snapshot. A live but inactive input
-	// does not need to retain its record/effect indexes; immutable copies remain weak.
 	let prepared = new WeakMap();
-	// Object.freeze does not freeze Map/Set entries. Keep those collections inside
-	// the preparation and expose only immutable values through reading closures.
 	const view = collection => Object.freeze({size: collection.size, has: key => collection.has(key),
 		...(collection instanceof Map ? {get: key => collection.get(key)} : {}),
 		keys: () => collection.keys(), values: () => collection.values(), entries: () => collection.entries(),
@@ -456,8 +443,6 @@ const _rapierPrepareHistoryRecords = (() => {
 			frame.previous = previous?.copy;
 			frame.height = 0;
 			if (previous?.frozen) {
-				// A frozen shell fixes its descriptors, but every mutable child is still
-				// observed afresh. Fixed scalar fields need no second Unicode/data proof.
 				frame.frozen = frame.immutable = true;
 				frame.descriptors = previous.descriptors; frame.fields = previous.fields;
 				frame.out = null; frame.leaving = true; active.add(value); pending.push(frame);
@@ -467,8 +452,6 @@ const _rapierPrepareHistoryRecords = (() => {
 				}
 				continue;
 			}
-			// Check frozen-ness before capturing descriptors. A caller freezing a mutable
-			// input later cannot retroactively certify an earlier view of its properties.
 			frame.frozen = frame.immutable = Object.isFrozen(value);
 			const array = Array.isArray(value), proto = Object.getPrototypeOf(value);
 			if (!array && !plainPrototype(proto)) throw Error('history_data');
@@ -535,12 +518,6 @@ const _rapierPrepareHistoryRecords = (() => {
 	};
 })();
 
-// A ledger record as the journal and the Notes return validate it below: plain data, nothing
-// undefined anywhere in it. A live record could carry a row whose type or order is not yet known (a
-// block just inserted, before its first render: `type: undefined`), and the validator would refuse
-// the whole ledger for that one field -- silently at boot, where a refused ledger is cleared, and
-// as "Rapier could not be reopened: the document history could not be restored" on a return from
-// Notes. The copy is made once per record; records are frozen, so it never goes stale.
 const _rapierJournalRecord = (() => {
 	const copies = new WeakMap();
 	return record => {
@@ -551,10 +528,6 @@ const _rapierJournalRecord = (() => {
 })();
 
 function _rapierValidLedgerRecord(record, prior, earlier, documentAuthority, maxDocumentBytes, utf8Length, allowGap = false) {
-	// Recovery records are data, not executable objects. Inspect descriptors without invoking
-	// accessors, and use an ancestor set (not a global seen set) so shared acyclic data stays valid.
-	// Iterative traversal refuses cycles without exhausting the call stack. Proxies/counters that
-	// throw are refused by the same gate rather than escaping into document recovery.
 	try {
 		if (!_rapierPlainLedgerData(record) || !Array.isArray(earlier)) return false;
 		const own = Array.isArray(record?.splices), lookup = own ? null : _rapierRecordIndex(earlier);
@@ -566,8 +539,6 @@ function _rapierValidLedgerRecord(record, prior, earlier, documentAuthority, max
 	} catch (_) { return false; }
 }
 
-// Both callers proved plain data themselves: the public single-row validator above,
-// or the private owned-snapshot preparation. No caller-supplied trusted flag exists.
 function _rapierCheckLedgerRecord(record, prior, documentAuthority, maxDocumentBytes, utf8Length, allowGap,
 	{splices, metadata, semantic, duplicate}) {
 	try {
@@ -579,8 +550,6 @@ function _rapierCheckLedgerRecord(record, prior, documentAuthority, maxDocumentB
 		if ((!own && !navigation) || (own && record.splices.length > 64) ||
 			(record.transaction?.reverts && record.transaction?.reapplies)) return false;
 		const metadataChanged = Object.values(metadata || {}).some(pair => pair.before !== pair.after);
-		// An identical concurrent replacement keeps its authored rows and an empty
-		// physical splice. The origin proof, not this gate, shows the effect is already present.
 		const coincidentWitness = !splices?.length && record.beforeHash === record.afterHash &&
 			record.authored && _rapierValidAuthored(record.authored) && record.authored.splices.some(row => row.removed.length);
 		if (metadata === undefined || (!splices?.length && !metadataChanged && !semantic && !coincidentWitness) ||
@@ -597,7 +566,6 @@ function _rapierCheckLedgerRecord(record, prior, documentAuthority, maxDocumentB
 		const transaction = record.transaction;
 		const nullableText = (value, limit, empty = true) => value === null ||
 			(typeof value === 'string' && value.length <= limit && (empty || value.length > 0));
-		// Identity fields are bounded individually; durable history has no record-count limit.
 		const optional = (value, valid) => value === undefined || valid(value);
 		const identity = (value, limit) => typeof value === 'string' && value.length > 0 && value.length <= limit;
 		if (!transaction || typeof transaction.id !== 'string' || !transaction.id.length ||