Say only what the escape rule pins, and drop the reason a link destination disproves

spec/flavour.md

@@ -94,14 +94,12 @@ container is open, a named error otherwise.
 valid — no attributes. A bare value matches `[A-Za-z0-9_-]+`; any other value is double-quoted
 with JSON string escaping (`\"` `\\` `\n` `\t` `\uXXXX`, …) — total over
 Unicode, and raw newlines never appear inside quotes. A quoted value also escapes `` ` ``, `&`,
-`<` and `|` as `\u0060`, `\u0026`, `\u003c` and `\u007c` — the code span, entity reference,
-autolink, raw HTML and pipe cell's split all bind at or before a directive does, so a raw one
-would reach back out of the value; `*`, `_`, `~`, `[` and `(` resolve after and stay raw. The
-closing `}` is the first one outside quotes, since a quoted value holds `}` unescaped. All values
-are strings at the grammar level; each node's section assigns types. Canonical form orders keys
-alphabetically, spells values bare wherever allowed, escapes inside quotes in the shortest form
-each escape has, and omits empty `{attrs}` except where the `{` itself claims the directive
-(`:hardBreak{}`).
+`<` and `|` as `\u0060`, `\u0026`, `\u003c` and `\u007c`; `*`, `_`, `~`, `[` and `(` resolve after a
+directive binds and stay raw. The closing `}` is the first one outside quotes, since a quoted value
+holds `}` unescaped. All values are strings at the grammar level; each node's section assigns types.
+Canonical form orders keys alphabetically, spells values bare wherever allowed, escapes inside
+quotes in the shortest form each escape has, and omits empty `{attrs}` except where the `{` itself
+claims the directive (`:hardBreak{}`).
 
 **Escaping**: the emitter backslash-escapes whatever literal text would otherwise parse as
 directive syntax — the leading `:` of a would-be directive, `]` inside content, a `{` right
@@ -222,9 +220,8 @@ One header row plus plain inline cells is a pipe table; anything richer is the d
 and every cell carry no attrs and no marks, the first row is all `tableHeader` and the rest all
 `tableCell`, every row has the header's cell count, and every cell holds exactly one attr-less,
 mark-less paragraph — an empty cell holds one empty paragraph — with no `|` anywhere the
-inline layer spells as syntax — a code span, a link destination or title: backslash escapes are
-inert there, so pipe form cannot spell that pipe and the table takes the directive form. A pipe
-table parses back to exactly that shape.
+inline layer spells as syntax — a code span, a link destination or title: pipe form cannot spell
+that pipe and the table takes the directive form. A pipe table parses back to exactly that shape.
 
 ```
 | Part | Qty |

todo.md

@@ -72,12 +72,11 @@ detail is settled at its own milestone.
         the emitter's refusals a corpus home while the directories grow: `corpus/unspellable/`,
         a `.json` beside the `ConvertErrorCode` it must return, the emitter half of `corpus/errors/`.
   - [x] **2c — Inline nodes and marks.** `inline-nodes/` green. `InlineSegment` splits into its
-        two axes — escapability (`attribute` for `:text{text="…"}`, `backslash`, `bracketed`,
-        `none`) and the emphasis role. A lone surrogate in a text node emits verbatim and becomes
-        U+FFFD on any UTF-8 encode, a §2 break plain text still holds open — attribute values
-        already escape it. The pipe form's fallback reads the emitted segments rather than naming
-        the nodes whose attribute values spell a pipe as syntax, so 2e's `\u007c` narrows it in
-        one place.
+        two axes — escapability (`backslash`, `bracketed`, `none`) and the emphasis role. A lone
+        surrogate in a text node emits verbatim and becomes U+FFFD on any UTF-8 encode, a §2 break
+        plain text still holds open — attribute values already escape it. The pipe form's fallback
+        reads the emitted segments rather than naming the nodes whose attribute values spell a pipe
+        as syntax, so 2e's `\u007c` narrows it in one place.
   - [x] **2d — The opaque carry** (§3). Fixtures and emitter together, into
         `corpus/round-trip/opaque-carry/`: an unknown node in both positions, the reserved `adf`
         info string, and the `codeBlock` whose language is `adf` — carried whole ahead of the