The right-rail TOC ships (site/static/css/style.css, gated by body:has(#table-of-contents) at ≥1024px). The next feature is the highlighter — as the reader scrolls, mark the current section in the rail. The reducer contract for it landed independently in docs/toc-rail-reducer-contract.org (internal to the repo) and a JS mirror at experiments/toc-nav-simulator/reducer.mjs; the head-less simulator already grades that reducer against real org-publish HTML fixtures.

What is not settled and this note settles:

1. Data flow between browser events, geometry reads, the pure reducer, and DOM mutations.
2. Boundary responsibilities — what the reducer owns, what the browser adapter owns, what the CSS owns, what the publisher owns.
3. The implicit contract the org to html exporter provides — the guarantees the highlighter relies on, and the guarantees the highlighter must not rely on.
4. Bundle strategy — extend the existing tracker.js so the highlighter ships with the ambient page load, without a new <script> include touched into every template.

The reducer itself is done. This is the wiring diagram + boundary spec + bundle decision.

Six events, one pure reducer, one DOM effect. The reducer is a function (state, event) → state; the adapter is what turns browser noise into events and what turns state changes into class toggles.

The reducer inputs are five numbers and one array: scrollY, headerH, viewportH, documentH, headings[]=. Output is one string (activeId) or null. Nothing else crosses the boundary in either direction.

Two entry points: passive scroll, and explicit navigation. Both go through the same reducer.

The "activeId != last" diamond matters. Without diff-caching, every rAF tick writes to the DOM, which is a 60Hz style recalc for zero visual change. With the cache the write happens exactly at section boundaries.

Five actors. Each owns a strictly non-overlapping surface. The whole feature works because none of them reach across into another's surface.

Reading the arrows: every cross-boundary edge is a single-direction contract, and each is small enough to state in one sentence. If a future change forces an arrow to reverse, it's a spec-bump signal.

Six guarantees the highlighter relies on, and two the highlighter must NOT rely on. These aren't in the org manual as a "contract" per se — they're what org-export-html observably does, and the gap between "observable" and "guaranteed" is where the risk lives.

The site loads six sitewide JS bundles today: tracker.js · page-tags.js · web-vitals-init.js · bot-signal.js · global-pollution.js · event-pixel.js. Any of them could host the highlighter. Options:

Three files land, all in the :site-tracker shadow build:

src/wal_sh/site/toc_rail/core.cljc      ; ~80 lines, port of reducer.mjs
src/wal_sh/site/toc_rail/browser.cljs   ; ~60 lines, adapter
test/wal_sh/site/toc_rail/core_test.cljc ; grades against fixtures/geometry.json

core.cljc exposes (active-id state) and (reachable-limit state) as pure functions. Test harness reads experiments/toc-nav-simulator/fixtures/geometry.json and asserts the CLJC output byte-matches the JS oracle's output for every step of every scenario.

browser.cljs wires:

1. init! — gate + build headings array + attach listeners.
2. on-scroll — rAF-throttle to (active-id ...) to diff-cache to DOM write.
3. on-resize — recompute headings[].top and documentH.
4. on-load — one delayed recompute after web-fonts settle, to catch G8.

Ledger block on land, with the reducer contract's own version as the pinned dependency.

The claim is that this reducer + adapter, added to tracker.js with zero template touches, produces a working highlighter with no regression on any current page. It fails if:

1. The reducer disagrees with reducer.mjs on any fixture scenario (grading harness catches this in CI).
2. Rail links stop scrolling to the right position — implicates scroll-padding-top interacting with the class-toggle timing; test by clicking every link on a long note.
3. Pages without a TOC take a measurable perf hit — the gate at init! should return in <1ms; measure with performance.now() in dev.
4. The tracker's existing scroll.depth event count changes — the two handlers share the rAF-throttle util; a bug here shows up as event-count drift in the daily snapshot.
5. On a page with :CUSTOM_ID: on every heading, the highlighter still misses one anchor — implicates G4 (heading order in ToC vs. DOM order). This is the one that would be a real spec bug.

• docs/toc-rail-reducer-contract.org (repo-internal) — the ClojureScript reducer contract this note wraps
• experiments/toc-nav-simulator/README.org (repo-internal) — the JS mirror + real org-publish fixtures + the G7 anchor-instability finding
• docs/views-projection.org (repo-internal) — bundle-per-page map that §Extend tracker.js references
• tracker-rebuild-spec — the tracker whose rAF-throttle util the adapter reuses
• site/static/css/style.css — the rail CSS (:has() gate + fixed positioning + scroll-padding-top)