content: content/sanitize — drop invalid blocks tree-wide (799/799)

Enforcement counterpart to validate: removes blocks failing validate's own
per-block id/field checks (reused via content/-block-issues, single-sourced)
so federated/imported input can render safely. Tree-wide; distinct from
normalize (empty vs invalid); keeps valid-shell sections, drops invalid ones.
New suite +12 tests (42 suites total).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

plans/content-on-sx.md

@@ -19,7 +19,7 @@ injected adapter, not core.
 
 ## Status (rolling)
 
-`bash lib/content/conformance.sh` → **787/787** (Phases 1–4 COMPLETE + ~34 extensions, hardened: HTML/SX escaping, Markdown render + import/export incl. tables & frontmatter (full round-trip), CvRDT flat + nested-tree + durable replication, tree-aware validation, snapshot cache, doc metadata, plain-text render, nested block trees + deep editing + flatten + relative reorder, doc stats + summary + multi-doc index, table + callout + media blocks, HTML page wrapper + SEO page, doc composition + id-remap, portable data + wire serialization, block query + transforms + find/replace, TOC + anchored headings + outline, normalization)
+`bash lib/content/conformance.sh` → **799/799** (Phases 1–4 COMPLETE + ~34 extensions, hardened: HTML/SX escaping, Markdown render + import/export incl. tables & frontmatter (full round-trip), CvRDT flat + nested-tree + durable replication, tree-aware validation, snapshot cache, doc metadata, plain-text render, nested block trees + deep editing + flatten + relative reorder, doc stats + summary + multi-doc index, table + callout + media blocks, HTML page wrapper + SEO page, doc composition + id-remap, portable data + wire serialization, block query + transforms + find/replace, TOC + anchored headings + outline, normalization)
 
 ## Ground rules
 
@@ -107,6 +107,7 @@ lib/content/api.sx ── (content/edit) (content/render) (content/history) ─
 - [x] document flatten (`flatten.sx`: content/flatten, un-nest sections; inverse of wrap-section)
 - [x] relative reorder (`move.sx`: content/move-before/after/to-front/to-back by id)
 - [x] document normalization (`normalize.sx`: content/normalize, drop empty blocks/sections)
+- [x] document sanitization (`sanitize.sx`: content/sanitize, drop invalid blocks tree-wide; validate's enforcement partner)
 - [x] global find/replace (`find-replace.sx`: content/find-replace across text-bearing blocks)
 - [x] portable data serialization (`data.sx`: content/to-data + from-data, round-trips tree)
 - [x] wire serialization (`wire.sx`: content/to-wire + from-wire, SX-text on the wire)
@@ -135,6 +136,21 @@ lib/content/api.sx ── (content/edit) (content/render) (content/history) ─
 
 ## Progress log
 
+- 2026-06-07 — Feature: `content/sanitize` — the enforcement counterpart to
+  `validate`. validate *reports* id/field issues; sanitize *removes* the
+  offending blocks (tree-wide) so federated/imported input that failed
+  validation can still be rendered/merged without faulting. Reuses validate's
+  own per-block predicate (`content/-block-issues`) so "what is invalid" stays
+  single-sourced and can't drift. Distinct from `normalize` (which drops *empty*
+  blocks): a section emptied of invalid children is kept (sanitize removes
+  invalid, not empty), but a section whose own shell is invalid (children not a
+  list) is dropped whole. Scope is per-block id/field validity — it does not
+  dedupe ids (cross-block, no single right answer). +12 tests (bad-field /
+  unknown-type / blank-id dropped, deep pruning, invalid-shell section dropped,
+  immutability, render-safe result). 799/799 (42 suites). (This was a genuine
+  remaining gap — validate had no enforcement partner — not filler; saturation
+  note below still holds for the roadmap proper.)
+
 - 2026-06-07 — Audit (markdown round-trip): probed the Markdown text boundary
   for round-trip fidelity. Found one real data-corruption bug — table cells
   containing `|` don't survive `asMarkdown` → `md/import` (recorded under