Escape the quoted attribute value, and pin the canonical form and the pipe cell's edges

spec/flavour.md

@@ -93,11 +93,14 @@ container is open, a named error otherwise.
 **Attributes**: `{key=value key2="two words"}`. `{attrs}` is optional in every form, and `{}` is
 valid — no attributes. A bare value matches `[A-Za-z0-9_-]+`; any other value is double-quoted
 with JSON string escaping (`\"` `\\` `\n` `\t` `\uXXXX`, …) — total over
-Unicode, and raw newlines never appear inside quotes. The closing `}` is the first one outside
-quotes, since a quoted value holds `}` unescaped. All values are strings at the grammar
-level; each node's section assigns types. Canonical form orders keys alphabetically, spells
-values bare wherever allowed, inside quotes escapes only what it must using the shortest escape
-form, and omits empty `{attrs}` except where the `{` itself claims the directive
+Unicode, and raw newlines never appear inside quotes. A quoted value also escapes `` ` ``, `&`,
+`<` and `|` as `\u0060`, `\u0026`, `\u003c` and `\u007c` — the code span, entity reference,
+autolink, raw HTML and pipe cell's split all bind at or before a directive does, so a raw one
+would reach back out of the value; `*`, `_`, `~`, `[` and `(` resolve after and stay raw. The
+closing `}` is the first one outside quotes, since a quoted value holds `}` unescaped. All values
+are strings at the grammar level; each node's section assigns types. Canonical form orders keys
+alphabetically, spells values bare wherever allowed, escapes inside quotes in the shortest form
+each escape has, and omits empty `{attrs}` except where the `{` itself claims the directive
 (`:hardBreak{}`).
 
 **Escaping**: the emitter backslash-escapes whatever literal text would otherwise parse as
@@ -219,9 +222,9 @@ One header row plus plain inline cells is a pipe table; anything richer is the d
 and every cell carry no attrs and no marks, the first row is all `tableHeader` and the rest all
 `tableCell`, every row has the header's cell count, and every cell holds exactly one attr-less,
 mark-less paragraph — an empty cell holds one empty paragraph — with no `|` anywhere the
-inline layer spells as syntax — a code span, a link destination or title, an inline directive's
-attributes: backslash escapes are inert there, so pipe form cannot spell that pipe and the table
-takes the directive form. A pipe table parses back to exactly that shape.
+inline layer spells as syntax — a code span, a link destination or title: backslash escapes are
+inert there, so pipe form cannot spell that pipe and the table takes the directive form. A pipe
+table parses back to exactly that shape.
 
 ```
 | Part | Qty |
@@ -238,8 +241,8 @@ inline layer's ordinary CommonMark escaping yields the pipe; each cell is the in
 one paragraph, trimmed; canonical form pads cells with single spaces and ends rows with `|`
 (optional in input). Named errors: a delimiter or body row whose cell count differs from the
 header's, and an alignment colon in the delimiter row — ADF holds no column alignment. In a
-pipe cell a hard break is `:hardBreak{}`, a literal `|` is `\|`, and `|` inside a quoted
-attribute value is `\u007c` (JSON has no `\|`).
+pipe cell a hard break is `:hardBreak{}` and a literal `|` is `\|`; a `|` inside a quoted
+attribute value is already `\u007c`, so the split never reaches it.
 
 The directive form nests cells as containers of block content inside `tableRow` containers: