Main Title

`: ```
` · tables with `:---`/`:---:`/`---:`
alignment · task lists (unchecked enabled, checked `disabled`) · ordered lists with
`start` preserved · blockquotes with a copy button · thematic breaks `-`/`*`/`_` ·
footnotes with `title` preview + backlink · reference links with optional titles ·
source citations `[[1,2]]` · 16 emoji shortcodes · images with lazy loading and a
graceful fallback span · "universal patterns" inside inline code
(`(User)-[auth]->(Server)` → a `.pattern-chain` visual) · glossary tooltips from ordinary
Markdown tables.

**[tested]** Not supported / divergent from CommonMark:

| Input | Expected (CommonMark/GFM) | Actual |
|---|---|---|
| `- top` + indented `- child` | nested `` | child becomes a literal `- child

 …` **outside** the list |
| 4-space indented code block | `` | plain `` |
| `~~~` fence | fenced code | literal paragraph text (only `` ` `` fences are handled by the renderer at md.php:3139) |
| Bare `https://example.com` | GFM autolink literal | literal text |
| `` | CommonMark autolink | literal text |
| `&` / `©` | decoded entity | double-escaped to `&amp;` / `&#169;` |
| `\*not emphasis\*` | literal `*not emphasis*` | renders `not emphasis\` — backslash escapes not honoured |
| Setext `Title\n---` | one `
` | text appears **twice**: `Setext H2
` then `
Setext H2` |
| Trailing-two-space hard break | single `
` | `

` under the default `PARAGRAPH_BREAK_STYLE=double-br` |

README claims "nested lists" and "syntax-highlighted code blocks". **Neither is present**:
nested lists break as shown above, and a repo-wide grep for `cdn|unpkg|jsdelivr|cdnjs|highlight`
finds only three external URLs — Tailwind, Google Fonts, Mermaid. No highlighter is loaded;
code is emitted as `` and styled by `md.css` alone.
The wiki must not repeat those two claims.

## 7. Other verified behaviours worth documenting

- **TOC threshold.** `renderTOC()` returns `''` when `count($headings) < 2`. Because
  viewer mode strips the first H1 *before* collecting headings, a document needs
  **at least two headings in addition to its H1** for a TOC to appear. **[tested]**
- **`SPLIT_TITLE_BY_COLON`.** `# Main Title: Subtitle Part` → `Main Title`
  and the subtitle becomes the hero paragraph / meta description. **[tested]**
- **Meta description** is derived from document content, and the first H1 is removed from
  the body and re-rendered by the template as a hero ``.
- **Glossary heuristic.** *Any* table with ≥2 columns and a non-empty first-column header
  is treated as a glossary; every first-column cell value becomes a tooltip term matched
  across the whole document (outside `a`, `code`, `pre`, `script`, `style`, `th` and
  first-column cells). Short or numeric terms therefore produce surprising tooltips —
  **[tested]** a table `| A | B |` made the cell `1` in another table a "glossary term".
  Alias syntax: `Base term (ALIAS)` registers both.
- **Sources.** A `## Sources` / `## Sources List` / `## Источники` / `## Список источников`
  section (H1 or H2, optional manual-number prefix) is stripped from the body and
  re-rendered as a styled list when entries match
  `N. **Title**` newline `- URL: https://…`. Inline citations use `[[1,2,3]]`. **[tested]**
- **File browser.** Columns `File · Dir · Created · Modified · Size` (+ a non-sortable
  download column when `FEATURE_DOWNLOAD_ICON`), `data-sort-default="modified"`
  `data-sort-dir-default="desc"`, client-side search box, scan limits depth ≤ 3 and
  ≤ 10 000 files, skips dotfiles and anything under a dot-directory, and re-checks
  symlink containment per file.
- **Clipboard preview.** `POST md_preview=1&content=…`, 2 MB cap, 403 when
  `DISABLE_CLIPBOARD`, 400 when empty, nothing written to disk.
- **Machine API.** **[tested]** `action=status` → 200 JSON (11 files, per-file versions,
  `counts`, `ini` block); `action=conflicts` → 200 JSON; wrong key → **403**;
  `install` over GET → **405**; unknown action → **400**. Key format
  `mdv_` + 48 hex chars from `random_bytes(24)`, generated by `updater.php` only —
  `md.php` does not create it.
- **Flags off by default.** **[tested]** `?update=true` → 403, `?restore=latest` → 403,
  while the `updater.php` landing page itself is public (200) and sends
  `X-Content-Type-Options: nosniff`.
- **Upload.** **[tested]** field name is `md_file`; `.md` only (`.MD` normalised to `.md`);
  `basename()` applied first, so `../evil.md` lands safely as `evil.md`; rejects leading
  dot, `<>:"|?*`, control chars, > 200 chars, > 2 MB; `dir` traversal or absolute → 400
  `Invalid dir parameter.`; an existing target is renamed to `.bak.Ymd-His`;
  Unicode filenames accepted.
- **Quirk:** `` is hardcoded in the template even for English documents.
- **Quirk:** `window.MDV_CONFIG` is assigned twice in the emitted HTML (a minimal object,
  then the full one). Harmless, redundant.
- **Quirk:** the README's `.md.ini` sample shows `API_KEY`, but the file `md.php` creates
  does not contain it; only `updater.php` writes it.

## 8. Settings panel (client-side, cookie/localStorage persisted)

Sections: Font Size · Line Spacing · Page Width (`reading` / `article` / `wide`) ·
Header Toolbar (per device type; `data-toolbar="width"|"font"`) · File Browser Sort ·
Features ("reload to apply") · Paragraph Break (`double-br` / `single-space` / `margin`) ·
Storage · Index File · Updates · Backup & Restore. The last three are conditional on
`ALLOW_CREATE_INDEX_PHP_LINK`, `ALLOW_UPDATE`, `ALLOW_RESTORE`.
17 feature toggles are surfaced with labels: Auto Numbering, Auto TOC, Footnote Links,
Double Line Breaks, Cypher Patterns, Universal Patterns, Images, Ref Links, Task Lists,
Footnotes, Sub / Sup, Emoji, Split Title, Glossary Tooltips, File List: Show Download Icon,
File: Show Download Button, File: Show Copy Button.

## 9. Competitive position

| | MD.Viewer | docsify | MkDocs (+ Material) | Docusaurus |
|---|---|---|---|---|
| Build step | none | none | `mkdocs build` | `npm run build` |
| Runtime | PHP 8.3+ on any LAMP host | static files + browser JS | Python | Node/React |
| Database | none | none | none | none |
| Server-side rendering | **yes** — HTML arrives complete | no — client-side fetch+render | yes, at build time | yes, at build time |
| Search | client-side filter over a scanned file table | client-side full-text plugin | built-in / lunr | Algolia or local plugin |
| Self-update from GitHub | **built in** (`updater.php`) | no | no | no |
| Versioned backups + rollback | **built in** | no | no | no |
| Machine JSON API for installers | **built in** | no | no | no |
| Per-directory config overrides | **built in** | no | `nav` in one YAML | sidebars JS |
| SEO / no-JS readability | good (server-rendered) | poor (empty shell without JS) | excellent | excellent |
| HTML sanitisation of source | **none** | marked + no raw HTML by default | Python-Markdown, raw HTML escaped by default | MDX — raw HTML is JSX, escapes are explicit |
| Best fit | trusted internal docs on an existing PHP host | quick client-side docs site | versioned public docs | large product docs |

MD.Viewer's real differentiators are the three things no competitor ships: a
**self-updater with backups and rollback**, a **machine JSON API** so a control panel can
drive installation, and **per-directory `.md.ini` overrides**. Its real gap is
sanitisation.
` | text appears **twice**: `Setext H2` then `

Setext H2

` | text appears twice: `
Setext H2
` then `
