Documents: adversarial review fixes (round 7)

src/documents/docs/canvas-engine.md

@@ -671,7 +671,8 @@ This is a functional prototype, not feature-complete relative to the previous ed
 - Page preview uses saved single-section dimensions, margins and gutter, and Noto Sans with run-specific sizes and a real italic face. Letter, A4, Legal and custom sizes are supported. Imported fonts and other unsupported formatting remain preserved without faithful preview. See the conformance record for page defaults, application limits and rejected structures.
 - The toolbar offers left/center/right/justified alignment, preset/custom line-spacing multiples, exact/minimum point heights, and before/after spacing in points. Choosing a line-spacing preset replaces an imported point height with a multiple; Line spacing options can also restore inheritance. Mixed properties are shown individually. A selection ending at the start of another paragraph excludes that paragraph; a caret formats its current paragraph, including empty ones. Splits inherit the paragraph format; merges use the first paragraph's format.
 - Line-spacing multiples use each line’s maximum run ascent/descent from the Noto font tables. Adjacent after/before gaps collapse to the larger value. Before-spacing that cannot fit with its first line is suppressed at a new page; trailing after-spacing does not create blank pages. The terminal-break paragraph-mark and leading-break before-spacing compatibility flags are implemented; the tab compatibility flags are implemented as well. Keep-with-next chains, keep-lines and widow/orphan control use measured line heights. Other compatibility flags and font fallback remain future work.
-- Paragraph spacing is limited to 0–600pt; line spacing to 0.5–5× or 6–600pt. DOCX spacing uses twentieths of a point and multiples use 240ths of a line. Contextual spacing is supported as described above. Justified/distributed alignment and effective automatic or line-unit before/after spacing are rejected before editing.
+- Paragraph spacing is limited to 0–600pt; line spacing to 0.5–5× or 6–600pt. DOCX spacing uses twentieths of a point and multiples use 240ths of a line. Contextual spacing is supported as described above. Effective automatic or line-unit before/after spacing is rejected before editing; justified and distributed alignment are supported (see the conformance record).
+- A page canvas never exceeds 4096 × 4096 device pixels (the canvas limit of Safari on iOS and iPadOS, which otherwise paints a blank page). A page zoomed in on a high-density display beyond that (a Letter page at 200% on a 3x phone) is painted with fewer device pixels per CSS pixel, the same on both axes; pointer, caret and selection geometry are unaffected (`src/engine/canvas-backing.js`).
 - Canvas measurement delegates shaping to the browser. Ligature caret precision, bidirectional layout, broad script coverage and exact native pagination are unfinished.
 - Each input event is an undo transaction; consecutive ordinary typing is not yet grouped into words.
 - The entire document is laid out and repainted after each edit. There is a 200-page preview limit, a 100,000-character limit, a 20MB compressed input limit, and a 50MB expanded ZIP limit. These bounds are not a performance guarantee for large documents.

src/documents/docs/collaboration.md

@@ -58,7 +58,15 @@ equal changes. So:
   paragraph keep one value (Yjs's deterministic winner);
 - tables, styles, list definitions and page settings are atomic registers: concurrent edits to
   different tables or styles merge; to the same table, the last structural change wins while the
-  text people typed in its cells stays (cells are body paragraphs).
+  text people typed in its cells stays (cells are body paragraphs);
+- a table cell's characters and marks are its own in the diff: one matches only the same character
+  of the same cell (the body's still match each other). A row or column added or removed therefore
+  inserts or deletes whole cells, rather than keeping another cell's mark or letters and relabelling
+  them, and text someone types in another cell meanwhile stays in that cell. New paragraphs of a
+  cell are written before its last mark, inside the cell, not where a new row or column would go;
+- a paragraph left in a cell that is gone (split in a cell while someone else deletes its row or
+  column) is read into the cell before it (at a table's start, the one after it; outside a table,
+  the body), without moving anything in the shared text, so it is kept and the table stays whole.
 
 **Reading remote changes.** An update from someone else is applied to the Yjs document (after this
 person's pending changes are written, so the diff never mistakes their text for a deletion), the
@@ -129,7 +137,9 @@ plus a notice; it composes with the document's own Restrict Editing guard.
 **Offline.** Every local change is queued in IndexedDB (memory where unavailable) before it is sent
 and kept until the room accepts it; the title bar shows *Offline · N waiting*; changes go out when
 the connection returns, also after a reload of the same room in this browser (Yjs updates are
-idempotent, so a change delivered twice is harmless). Changes refused for good (access removed)
+idempotent, so a change delivered twice is harmless). Queued changes name the account that made
+them: only that account's next visit to the room sends them, so someone else signed in on the same
+computer neither sends them as theirs nor has them refused and thrown away. Changes refused for good (access removed)
 are dropped and the person is told. In a tab that does not save the file (a guest's), changes the
 room has not received exist nowhere else: closing the tab warns, and leaving the document sends
 them first and asks when they cannot go out.
@@ -212,6 +222,10 @@ Puter's AI (the playground) the pane, its buttons and menu items are not offered
 
 - Concurrent changes to the same table's structure keep one person's structure (atomic register);
   concurrent creation of new list definitions with the same numbering id keeps one definition.
+- Typing into an empty cell (or at the very start of a cell) right where someone else inserts a row
+  or column at the same moment shares one place in the shared text with the new cells; Yjs orders
+  the two insertions by client, so that text can land in one of the new cells. Text typed in a cell
+  someone else deletes stays, in the cell after it.
 - Header, footer and note stories are atomic per story: two people editing one header at once keep
   one person's version.
 - Document-level settings outside the model (Restrict Editing's protection, review settings,