nx_imgattr_lib.nx

nx_imgattr_lib.nx -- THE ONE PLACE THAT DECIDES HOW AN <img> IS WRITTEN, AND THE ONE PLACE THAT READS ONE BACK. MEASURED 2026-08-26 ON OUR OWN HEADLINE SURFACE, served live at /compare/koikatsu: <img src='/compare/koikatsu/native_kk396262.png' alt='The card's own portrait -- the oracle we match against' loading='lazy'> The apostrophe came straight out of the .gallery caption DATA and was written raw into a single-quoted attribute. Every real HTML parser ends alt at the two words -The card-, reads the remainder as bogus attribute names, and the stray quote then swallows loading='lazy' as well. The accessible name of that image is -The card-, and the browser hint that keeps 14 large PNGs off the critical path is gone. AND THE PAGE STILL VALIDATED GREEN. nx_page_verify's a11y check counts the byte pattern - alt=- over the whole page and read 15 with-alt of 15 img. A SUBSTRING COUNTER CANNOT SEE ATTRIBUTE SCOPE, so the emitter's defect and the ruler's blindness are ONE defect met twice -- and the ruler's blindness is the half that let it ship and stay shipped. SO THE WRITER AND THE READER LIVE IN ONE LIB. The function that WRITES an img and the function that CHECKS an img share one definition of -an img with a usable alt-, and disagreement between them is impossible by construction rather than by discipline. THE INCUMBENT WAS EXTENDED, NOT DUPLICATED. nx_adnet_slot's aslot_cat_esc is the estate's existing attribute escaper and its lit-flag shape is kept here verbatim. It is changed in exactly one direction: it replaces an apostrophe with a SPACE, which is lossy -- -The card's- becomes -The card s- -- and rule 25 says rewrite it better rather than strip it, so this escaper emits the numeric character reference and KEEPS the byte. NO GUESSED CEILING LIVES HERE. Every buffer this lib fills is sized by the caller from the strings the caller already holds (ia_alt_cap_for / ia_img_cap_for), so there is no bound to tune in either direction and none can silently truncate. The guards remain and ANNOUNCE, for a caller that sizes its own buffer wrong. DECLARED IMPRECISION, so the next reader does not trust this as exact: ia_scan is a LEXICAL scan. It skips comments, script and style bodies, so markup quoted inside those cannot be miscounted, but it does not build a tree -- an img inside a CDATA section or produced by script at runtime is outside what it can see, and it reports on the bytes as served. license_tier: ORIGINAL