fix(docs): the review's four rendering defects, and the check that could see one

Review of PR #62 found four live defects and four smaller ones. The most
valuable is the first, because of what it says about the rest.

A TOC entry wrapping a heading whose rendered text already contained a link
emitted <a href="#anchor"><a href="github...">...</a></a>. The parser closes
the outer anchor early, so the entry became an empty unclickable stub and
clicking "src/draw.rs" in the TOC navigated to GitHub. 19 occurrences over 10
pages. Both hrefs resolved perfectly, so the link check, the whole-site link
check and a screenshot pass all missed it -- it answers "does every href
resolve" and this is not that question. So the fix is two things: the TOC keeps
a tag-free variant of each heading, AND a new check asserts no <a> appears
inside another <a>. Proved by reverting the first half: 66 nested anchors
reported, assembly exits 1. Clicking that TOC entry now lands on #src-draw-rs.

esc() escaped & < > but not the quote it was interpolated into title="..."
with. Five shipped bead titles contain one, and Chromium parsed the resulting
tag as having three junk attributes. Now escapes " and ' as well. Today's
corpus being friendly is not a reason to interpolate tracker text unescaped.

Seven pages overflowed at 390px by up to 92%. The reviewer attributed it to the
TOC; the TOC was real but not sufficient, and the first fix measured clean by
getBoundingClientRect while the page still overflowed, because the heading text
overflows its box without widening it. Only per-element scrollWidth names the
culprit: hundreds of snake_case test names as headings. overflow-wrap on the
headings and on .toc a, plus dropping display:table from .tickets, which had
been cancelling the mobile overflow-x guard. 0 of 23 pages overflow at 390 and
1280 now, measured.

table() split rows on every pipe before inline parsing, so `|Time Period|` --
this repo's own quoting syntax, in a corpus whose subject is that syntax -- was
shredded into extra columns. A row that still parses, so no column count could
see it. Now walked, respecting code spans and \|. Proved with a fixture: 9 tds
with the fix, 12 with the old splitter reinstated.

The four smaller ones: the link check counted 48 links it never verified behind
a comment promising they were "checked below" when there was no below -- those
are the links leaving the docs tree, and they are now resolved against the
filesystem, which is why assemble.sh runs the generator LAST, once its siblings
exist. The gotcha jump bar's hardcoded 48 is derived from the emitted anchors,
because it failed closed on deletion and silently on addition, and the list only
grows. context/code/doc-site.md cited improvise-xxxx and so broke the audit the
surrounding paragraph describes; the repo-wide audit is now 189 ids, all
resolving. And the Conventions paragraph's own example path now goes through
inline(), so the sentence demonstrates the linking instead of asserting it.

The ticket index keeps all 180 rows, open bugs and titles included, by the
user's ruling: the data is already public in .beads/issues.jsonl, the page only
makes it legible, and filtering it while the lede links the raw JSONL would be
theatre.

Gates: 1378 rust tests, 26 node --test, 16 playwright (3 skipped, webkit OPFS),
all three check-comment-runs modes, 3460 site links / 0 broken, 0 nested
anchors, 189 bead ids all resolving.

improvise-djoo

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

context/code/doc-site.md

@@ -54,7 +54,10 @@ a narrative.
 
 ## 2. Ticket ids resolve to a page, never to a URL that does not exist
 
-The prose cites `improvise-xxxx` roughly 190 times. On a public site those are
+The prose cites bead ids roughly 190 times — this paragraph deliberately spells
+none, because a document that gives one as an example makes itself a source of
+audit noise, and a placeholder is worse than a real id: it is ID-shaped and
+resolves to nothing. On a public site those citations are
 meaningless strings, and the obvious repair — link them to an issue tracker —
 is unavailable: beads keeps its issues in a Dolt database on a git ref, and
 there is no public issue URL to point at. Inventing one would produce 190
@@ -71,10 +74,26 @@ question without a navigation.
 defect to work around but a fact to render honestly: an id the export does not
 carry is emitted as plain text with a dotted underline and no link, and the
 ticket page lists it as "not exported". The site therefore never links to an
-anchor it did not generate, whatever state the export is in. At the time of
-writing 8 of 178 linkified ids are in that state. A generator that instead
-linked every id it saw would produce a page that is right today and broken the
-first time somebody cites a fresh ticket.
+anchor it did not generate, whatever state the export is in. A generator that
+instead linked every id it saw would produce a page that is right today and
+broken the first time somebody cites a fresh ticket.
+
+**The page publishes every cited id, open bugs and their titles included, and
+that is a decision rather than a default** (user ruling). The data is already
+public in `.beads/issues.jsonl` in a repository anyone can clone; the page only
+makes it legible. An honest open-bug list is a normal thing for an open-source
+project to have, and filtering one while the page's own lede links the raw
+JSONL would be theatre. Note the second-order reason to keep it unfiltered:
+a citation whose row was suppressed would be a link into a page that does not
+answer it, which is the failure this whole section exists to avoid.
+
+**Titles are tracker data and are escaped as attribute values.** Five shipped
+bead titles contain a double quote; interpolated into `title="…"` by an `esc`
+that handled only `&`, `<` and `>`, they broke out of the attribute and the
+browser parsed the remains as three junk attributes. `esc` now escapes `"` and
+`'` as well. Today's corpus being friendly is not a reason to interpolate
+untrusted-shaped text unescaped — the tracker is written by whoever files a
+bug.
 
 ## 3. Source paths link only where the file exists
 
@@ -110,10 +129,29 @@ name that is never generated makes it report 763 missing pages — two different
 diagnoses, because "the page is absent" and "the page is there but the anchor
 is not" call for different repairs.
 
-What it does **not** cover is links that leave the `docs/` subtree — the ones
-to `../index.html` and `../app/`. Those are checked against the assembled
-`site/` tree by hand at the moment, and the honest statement is that a rename
-of the app directory would not be caught here.
+Links that **leave** the `docs/` subtree — `../index.html`, `../app/` — name
+files this script does not generate, so they are resolved against the
+filesystem instead. That is the whole reason `assemble.sh` runs the generator
+**last**: its siblings have to exist before they can be checked. An earlier
+version skipped those 48 links while still counting them as checked, behind a
+comment promising they were "checked below" when there was no below.
+
+**And the link check is not sufficient, which is the more important lesson.**
+It answers one question — does every href resolve — and a defect outside that
+question is invisible to it however carefully it is run. The worked example is
+a nested `<a>`: a TOC entry wrapping a heading whose rendered text already
+contained a link produced `<a href="#anchor"><a href="github…">…</a></a>`, and
+the HTML parser closes the outer anchor early, so the entry became an empty
+unclickable stub and clicking it navigated to GitHub. Both hrefs resolved
+perfectly. It shipped past the link check, past the whole-site link check, and
+past a screenshot pass, and was caught by a reviewer *clicking a link*. The
+repair is therefore two things, not one: the TOC keeps a tag-free variant of
+each heading, **and** a separate check asserts no `<a>` appears inside another
+`<a>` — proved by reverting the first half and watching the second report 66.
+
+The general form: when a check misses a defect, add the check that could have
+seen it rather than only fixing the defect, and ask what *question* the
+existing check was answering.
 
 ## 5. Why a node script and not a generator
 
@@ -142,13 +180,37 @@ may contain a single `*` pair**, because `[^*]+` cannot match
 `**a *b* c**` and the leftover `*` then pairs across the bold — which is how a
 single sentence in gotcha 33 came out as three italic paragraphs.
 
+A third, added later and for the same reason: **a table cell boundary is an
+unescaped pipe outside a code span**, so the row is walked rather than
+`split("|")`. This corpus documents a file format whose own quoting syntax is
+`|Time Period|`, and a sentence containing one inside a table cell would have
+been shredded into extra columns — a row that still parses, so no column count
+could detect it. It was latent when fixed, which is the point: the trigger is
+one ordinary sentence away in a document whose subject is pipe quoting.
+
 ## 6. Navigation
 
 `repo-map.md` is one long document whose gotcha list is numbered 1 to 48, and
 splitting it per gotcha was rejected: the gotchas cross-reference each other
 constantly ("see gotcha 35", "for the reason gotcha 39 watches…"), and a reader
 following those wants a scroll, not 48 page loads. It stays one page, with an
-id on every list item and a compact strip of 48 numbered links under the
-heading. The ids come from the list item's **own number**, not from a counter,
-so an inserted gotcha renumbers the anchors exactly as it renumbers the prose
-that cites them.
+id on every list item and a compact strip of numbered links under the heading.
+The ids come from the list item's **own number**, not from a counter, so an
+inserted gotcha renumbers the anchors exactly as it renumbers the prose that
+cites them.
+
+The strip's contents are **derived from the anchors actually emitted**, never
+from a count. A hardcoded 48 failed in only one direction: deleting a gotcha
+left a link to a missing anchor, which the link check catches, while *adding*
+one produced an unlinked gotcha and a clean build. The list only ever grows, so
+the hardcoded form was silent in precisely the direction it would be used —
+the same shape as an exclusion list that over-matches, failing in the direction
+that looks like success.
+
+**Long unbreakable headings need `overflow-wrap`.** The test-evidence pages are
+hundreds of `snake_case` test names as headings; at phone width seven of them
+overflowed the viewport by up to 92%. The diagnosis is worth keeping because
+the first guess was wrong: `getBoundingClientRect` reported every element
+inside the viewport, because the text overflows its box without widening it.
+Only `scrollWidth` per element names the culprit. Measure the property that
+actually overflowed rather than the one that usually does.