Merge loops/content into architecture: content-on-sx hardening — tree-wide content/find+has?, tree-wide revision diff, find-replace across all text-bearing fields, in-document prose search (6 commits, 778/778)

plans/content-on-sx.md

@@ -19,7 +19,7 @@ injected adapter, not core.
 
 ## Status (rolling)
 
-`bash lib/content/conformance.sh` → **746/746** (Phases 1–4 COMPLETE + ~34 extensions, hardened: HTML/SX escaping, Markdown render + import/export incl. tables & frontmatter (full round-trip), CvRDT flat + nested-tree + durable replication, tree-aware validation, snapshot cache, doc metadata, plain-text render, nested block trees + deep editing + flatten + relative reorder, doc stats + summary + multi-doc index, table + callout + media blocks, HTML page wrapper + SEO page, doc composition + id-remap, portable data + wire serialization, block query + transforms + find/replace, TOC + anchored headings + outline, normalization)
+`bash lib/content/conformance.sh` → **778/778** (Phases 1–4 COMPLETE + ~34 extensions, hardened: HTML/SX escaping, Markdown render + import/export incl. tables & frontmatter (full round-trip), CvRDT flat + nested-tree + durable replication, tree-aware validation, snapshot cache, doc metadata, plain-text render, nested block trees + deep editing + flatten + relative reorder, doc stats + summary + multi-doc index, table + callout + media blocks, HTML page wrapper + SEO page, doc composition + id-remap, portable data + wire serialization, block query + transforms + find/replace, TOC + anchored headings + outline, normalization)
 
 ## Ground rules
 
@@ -113,6 +113,66 @@ lib/content/api.sx ── (content/edit) (content/render) (content/history) ─
 
 ## Progress log
 
+- 2026-06-07 — Hardening (tree-wide audit): the public facade `content/find` /
+  `content/has?` were top-level-only (`doc-find`/`doc-has?`), so you could
+  `content/edit` an update/delete to a nested block by id (those ops are
+  tree-wide) but couldn't read that same block back by id through the facade — a
+  concrete read/write asymmetry. Added a generic `ct-find-id` to doc.sx (descends
+  into any `children` list, mirroring ct-replace-id/ct-remove-id, no section.sx
+  dependency) plus `doc-find-deep`/`doc-has-deep?`; `content/find`/`content/has?`
+  now point at them. Kept `content/find-top`/`content/has-top?` for the
+  top-level-only lookup. Audited all `doc-find`/`doc-ids`/`ct-index-of` callers:
+  the remaining ones are insert/move (positional, top-level by design) — no other
+  seams. +6 api tests (nested deep find/has, top variants miss nested,
+  edit-then-find round-trip). 778/778.
+
+- 2026-06-07 — Hardening: `content/diff` (and `content/diff-versions`) are now
+  TREE-WIDE. They enumerated ids via `doc-ids`/`doc-find` (top-level only), so a
+  diff between two versions of a document containing sections silently missed
+  every nested-block add/remove/change — the same class of seam as the by-id
+  op-log bug. Now ids come from `doc-tree-ids` and lookups from `doc-deep-find`,
+  so nested changes surface precisely. Section containers are excluded from
+  `:changed` (they hold no own content; a child change reports as that child),
+  while whole-section add/remove still shows in `:added`/`:removed`. Flat-doc
+  diffs are unchanged (deep == top-level with no sections). +9 store tests
+  (nested add = section+child, nested change = child only, nested remove,
+  no-op). 772/772.
+
+- 2026-06-07 — Feature: in-document prose search. `content/search-text` (and
+  `content/search-text-ids`) return every content block, tree-wide, whose
+  `(asText b)` contains a term — so search spans text/heading/code/quote/callout
+  text, image alt, list items and table cells **by construction**: it reuses the
+  one canonical "prose of a block" projection (asText) rather than re-listing
+  fields, so it can't drift from stats/find-replace. Section containers are
+  excluded (a term living only in a section's children returns the child, not the
+  wrapper). +7 query tests (cross-field match, count, single-field, no-match,
+  section exclusion, object return). 763/763.
+
+- 2026-06-07 — Consistency: `find-replace` now rewrites **every** text-bearing
+  field, not just `text`. New `fr-rewrite` dispatches per block type — `alt` of
+  image blocks, each item of list blocks, and every header/cell of table blocks
+  now get rewritten alongside text/heading/code/quote/callout. This closes a real
+  seam: `asText`/stats/word-count already fold image alt, list items, and table
+  cells into a document's prose, so a `content/find-replace` rename that skipped
+  them was inconsistent (a renamed term would still show up in word counts and
+  exports). Flipped the two `image alt untouched` tests to `image alt replaced`;
+  +4 tests (list items ×2, table header + cell). find-replace 16/16, 756/756.
+
+- 2026-06-07 — Consistency: `find-replace` now covers `callout` text. `fr-has-text?`
+  (find-replace.sx) added `callout` to its text-bearing block kinds, matching
+  `asText`/stats/summary which already treat callout bodies as prose. Previously a
+  `content/find-replace` over a doc containing callouts silently skipped them. +2
+  find-replace tests (replace callout text; callout kind untouched by text replace).
+  752/752 (41 suites).
+
+- 2026-06-07 — Hardening: fixed a real layer seam (surfaced in the architecture
+  review) — by-id ops (update/delete) now act TREE-WIDE. `ct-replace-id` /
+  `ct-remove-id` (doc.sx) descend into any block carrying a `children` list, so
+  the persist op-log and `content/edit` correctly reach blocks nested in
+  sections (previously a silent no-op). `doc-move` stays top-level (guarded by
+  doc-find); insert/move remain positional. Inline section detection (no
+  section.sx dep). +4 store regression tests (nested update/delete via op-log +
+  replay-to-seq). Full gate over foundational doc.sx: 750/750.
 - 2026-06-07 — Hardening: audit confirmed the persist op-log (store.sx) carries
   every block type through commit → replay (op-insert carries the block
   instance; updates apply by id). Locked with +4 store tests (callout/media