Release 0.13.1

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
FreeBSD packaging: compare ELF header bytes without od's column padding
2026-10-31 05:56:55 -06:00 · 2026-10-30 23:21:58 -04:00 · 2026-10-30 23:21:55 -04:00 · 2026-10-30 22:59:19 -04:00 · 2026-10-30 20:12:24 -04:00 · 2026-10-30 16:08:21 -04:00
127 changed files with 5041 additions and 621 deletions
@@ -24,8 +24,8 @@ permissions:

 jobs:
  windows-arm64:
-    # Immutable supporting workflow revision until the new install contract lands upstream.
-    uses: storytold/craft-common-actions/.github/workflows/windows-arm64.yml@8bb4e5ab95443171104ad88113fe1ef9b0e5ce3f
+    # Intentionally tracked at @main (not SHA-pinned) so org-wide CI improvements, security fixes, and build optimizations propagate without PR churn across all craftapp repos.
+    uses: storytold/craft-common-actions/.github/workflows/windows-arm64.yml@main
    with:
      app-name: deckcraft
      app-dir: DeckCraft
@@ -192,3 +192,8 @@ the `ROADMAP.md` progress log, and update each touched doc's status line and rev
  GitHub profiles). Never hand-edit `contributors.json`.
 - Maintainers refresh the stats with `python3 ../../craftrules/scripts/contributors.py .` (it also
  re-verifies who wrote each `people.toml` entry; `--check` only verifies).
+
+## CI workflows
+- Workflows in `.github/workflows/` call the shared workflows in [`storytold/craft-common-actions`](https://github.com/storytold/craft-common-actions) at `@main`, with their inputs and secrets. No other jobs: if no shared workflow does what's needed, it doesn't go here.
+- Don't add or change CI in a feature or fix PR. If the existing workflows can't build or test a change, link an existing craft-common-actions issue or PR, or open a new issue, or a PR only for a small fix that is safe for every app and does not increase CI time.
+- Some workflow files here still run their own jobs. Don't add to them. Moving a job into craft-common-actions is its own task, never part of another PR, and the job stays here until a shared workflow runs it.
@@ -19,3 +19,8 @@ before modules or other crate items; crate-level `//!` documentation may precede
 - Commit after each landed arc (`M<n>.<k>: what`) and push to `origin main`.
 - Keep `ROADMAP.md`, the progress docs in `docs/` (AGENTS.md §7) and `plan/STATUS.md` current.
 - Don't ask the user questions; record genuinely-theirs decisions in `plan/STATUS.md`.
+
+## CI workflows
+- Workflows in `.github/workflows/` call the shared workflows in [`storytold/craft-common-actions`](https://github.com/storytold/craft-common-actions) at `@main`, with their inputs and secrets. No other jobs: if no shared workflow does what's needed, it doesn't go here.
+- Don't add or change CI in a feature or fix PR. If the existing workflows can't build or test a change, link an existing craft-common-actions issue or PR, or open a new issue, or a PR only for a small fix that is safe for every app and does not increase CI time.
+- Some workflow files here still run their own jobs. Don't add to them. Moving a job into craft-common-actions is its own task, never part of another PR, and the job stays here until a shared workflow runs it.
@@ -222,7 +222,7 @@ dependencies = [
 "objc2-foundation 0.3.2",
 "parking_lot",
 "percent-encoding",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 "wl-clipboard-rs",
 "x11rb",
 ]
@@ -888,13 +888,14 @@ dependencies = [
 [[package]]
 name = "craft-update"
 version = "0.1.0"
-source = "git+https://github.com/storytold/craft-libs?rev=92d392cff132eaf53e13afff77f38b5c11b73aa0#92d392cff132eaf53e13afff77f38b5c11b73aa0"
+source = "git+https://github.com/storytold/craft-libs?rev=04aa1703b32d299e54f78fcde4182f2b393a9116#04aa1703b32d299e54f78fcde4182f2b393a9116"
 dependencies = [
 "chrono",
 "dunce",
 "egui",
 "flate2",
 "getrandom 0.3.4",
+ "image",
 "log",
 "plist",
 "semver",
@@ -983,7 +984,7 @@ checksum = "0c87e182de0887fd5361989c677c4e8f5000cd9491d6d563161a8f3a5519fc7f"

 [[package]]
 name = "deckcraft"
-version = "0.12.0"
+version = "0.13.1"
 dependencies = [
 "arboard",
 "chrono",
@@ -1005,7 +1006,7 @@ dependencies = [

 [[package]]
 name = "deckcraft-anim"
-version = "0.12.0"
+version = "0.13.1"
 dependencies = [
 "deckcraft-geom",
 "deckcraft-model",
@@ -1014,7 +1015,7 @@ dependencies = [

 [[package]]
 name = "deckcraft-av1"
-version = "0.12.0"
+version = "0.13.1"
 dependencies = [
 "deckcraft-bitstream",
 "rayon",
@@ -1023,14 +1024,14 @@ dependencies = [

 [[package]]
 name = "deckcraft-bitstream"
-version = "0.12.0"
+version = "0.13.1"
 dependencies = [
 "craft-media",
 ]

 [[package]]
 name = "deckcraft-cli"
-version = "0.12.0"
+version = "0.13.1"
 dependencies = [
 "deckcraft-engine",
 "deckcraft-mcp",
@@ -1040,14 +1041,14 @@ dependencies = [

 [[package]]
 name = "deckcraft-color"
-version = "0.12.0"
+version = "0.13.1"
 dependencies = [
 "serde",
 ]

 [[package]]
 name = "deckcraft-engine"
-version = "0.12.0"
+version = "0.13.1"
 dependencies = [
 "chrono",
 "deckcraft-anim",
@@ -1073,7 +1074,7 @@ dependencies = [

 [[package]]
 name = "deckcraft-fonts"
-version = "0.12.0"
+version = "0.13.1"
 dependencies = [
 "epaint_default_fonts",
 "harfrust 0.13.3",
@@ -1085,7 +1086,7 @@ dependencies = [

 [[package]]
 name = "deckcraft-format"
-version = "0.12.0"
+version = "0.13.1"
 dependencies = [
 "deckcraft-model",
 "serde",
@@ -1096,7 +1097,7 @@ dependencies = [

 [[package]]
 name = "deckcraft-geom"
-version = "0.12.0"
+version = "0.13.1"
 dependencies = [
 "kurbo",
 "serde",
@@ -1104,7 +1105,7 @@ dependencies = [

 [[package]]
 name = "deckcraft-h264"
-version = "0.12.0"
+version = "0.13.1"
 dependencies = [
 "deckcraft-bitstream",
 "rayon",
@@ -1113,7 +1114,7 @@ dependencies = [

 [[package]]
 name = "deckcraft-hevc"
-version = "0.12.0"
+version = "0.13.1"
 dependencies = [
 "deckcraft-bitstream",
 "rayon",
@@ -1122,21 +1123,21 @@ dependencies = [

 [[package]]
 name = "deckcraft-isobmff"
-version = "0.12.0"
+version = "0.13.1"
 dependencies = [
 "craft-media",
 ]

 [[package]]
 name = "deckcraft-matroska"
-version = "0.12.0"
+version = "0.13.1"
 dependencies = [
 "craft-media",
 ]

 [[package]]
 name = "deckcraft-mcp"
-version = "0.12.0"
+version = "0.13.1"
 dependencies = [
 "deckcraft-engine",
 "deckcraft-render",
@@ -1146,7 +1147,7 @@ dependencies = [

 [[package]]
 name = "deckcraft-media"
-version = "0.12.0"
+version = "0.13.1"
 dependencies = [
 "deckcraft-av1",
 "deckcraft-h264",
@@ -1164,7 +1165,7 @@ dependencies = [

 [[package]]
 name = "deckcraft-metafile"
-version = "0.12.0"
+version = "0.13.1"
 dependencies = [
 "image",
 "kurbo",
@@ -1173,7 +1174,7 @@ dependencies = [

 [[package]]
 name = "deckcraft-model"
-version = "0.12.0"
+version = "0.13.1"
 dependencies = [
 "deckcraft-color",
 "deckcraft-geom",
@@ -1185,15 +1186,15 @@ dependencies = [

 [[package]]
 name = "deckcraft-ogg"
-version = "0.12.0"
+version = "0.13.1"

 [[package]]
 name = "deckcraft-opus"
-version = "0.12.0"
+version = "0.13.1"

 [[package]]
 name = "deckcraft-pdf"
-version = "0.12.0"
+version = "0.13.1"
 dependencies = [
 "craft-pdf",
 "deckcraft-fonts",
@@ -1211,7 +1212,7 @@ dependencies = [

 [[package]]
 name = "deckcraft-pptx"
-version = "0.12.0"
+version = "0.13.1"
 dependencies = [
 "deckcraft-color",
 "deckcraft-engine",
@@ -1227,7 +1228,7 @@ dependencies = [

 [[package]]
 name = "deckcraft-render"
-version = "0.12.0"
+version = "0.13.1"
 dependencies = [
 "deckcraft-anim",
 "deckcraft-color",
@@ -1246,7 +1247,7 @@ dependencies = [

 [[package]]
 name = "deckcraft-text"
-version = "0.12.0"
+version = "0.13.1"
 dependencies = [
 "chrono",
 "deckcraft-color",
@@ -1260,7 +1261,7 @@ dependencies = [

 [[package]]
 name = "deckcraft-ui-egui"
-version = "0.12.0"
+version = "0.13.1"
 dependencies = [
 "craft-ui",
 "craft-update",
@@ -1285,7 +1286,7 @@ dependencies = [

 [[package]]
 name = "deckcraft-vp9"
-version = "0.12.0"
+version = "0.13.1"
 dependencies = [
 "deckcraft-bitstream",
 "rayon",
@@ -1294,7 +1295,7 @@ dependencies = [

 [[package]]
 name = "deckcraft-web"
-version = "0.12.0"
+version = "0.13.1"
 dependencies = [
 "deckcraft-engine",
 "deckcraft-ui-egui",
@@ -1651,7 +1652,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
 dependencies = [
 "libc",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]

 [[package]]
@@ -3013,7 +3014,7 @@ version = "0.50.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7957b9740744892f114936ab4a57b3f487491bbeafaf8083688b16841a4240e5"
 dependencies = [
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]

 [[package]]
@@ -3486,7 +3487,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7d8fae84b431384b68627d0f9b3b1245fcf9f46f6c0e3dc902e9dce64edd1967"
 dependencies = [
 "libc",
- "windows-sys 0.52.0",
+ "windows-sys 0.45.0",
 ]

 [[package]]
@@ -4041,7 +4042,7 @@ dependencies = [
 "errno",
 "libc",
 "linux-raw-sys 0.12.1",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]

 [[package]]
@@ -4098,7 +4099,7 @@ dependencies = [
 "security-framework",
 "security-framework-sys",
 "webpki-root-certs",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]

 [[package]]
@@ -4731,10 +4732,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd"
 dependencies = [
 "fastrand",
- "getrandom 0.3.4",
+ "getrandom 0.4.3",
 "once_cell",
 "rustix 1.1.5",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]

 [[package]]
@@ -5658,7 +5659,7 @@ version = "0.1.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
 dependencies = [
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]

 [[package]]
@@ -6176,7 +6177,7 @@ checksum = "9440ea3e5aeabb0ac63af70daf835274065238cdd0cec83418f417eae38bacee"

 [[package]]
 name = "xtask"
-version = "0.12.0"
+version = "0.13.1"
 dependencies = [
 "serde_json",
 ]
@@ -4,7 +4,7 @@ members = ["crates/*", "apps/*", "xtask"]
 default-members = ["crates/*", "apps/deckcraft", "apps/deckcraft-cli"]

 [workspace.package]
-version = "0.12.0"
+version = "0.13.1"
 edition = "2024"
 license = "MIT OR Apache-2.0"
 rust-version = "1.95"
@@ -61,7 +61,8 @@ vello_common = { version = "0.2", default-features = false }
 image = { version = "0.25", default-features = false, features = ["png", "jpeg", "webp", "gif", "tiff", "bmp"] }
 craft-media = { git = "https://github.com/storytold/craft-libs", rev = "92d392cff132eaf53e13afff77f38b5c11b73aa0", version = "=0.1.0", default-features = false }
 craft-pdf = { git = "https://github.com/storytold/craft-libs", rev = "92d392cff132eaf53e13afff77f38b5c11b73aa0", version = "=0.1.0", default-features = false, features = ["write", "write-simple-text"] }
-craft-update = { git = "https://github.com/storytold/craft-libs", version = "=0.1.0", rev = "92d392cff132eaf53e13afff77f38b5c11b73aa0", features = ["egui"] }
+# craft-update: app-specific pretend versions apply to startup and manual checks.
+craft-update = { git = "https://github.com/storytold/craft-libs", version = "=0.1.0", rev = "04aa1703b32d299e54f78fcde4182f2b393a9116", features = ["egui"] }
 craft-ui = { git = "https://github.com/storytold/craft-libs", rev = "92d392cff132eaf53e13afff77f38b5c11b73aa0", version = "=0.1.0" }
 i_overlay = "9"
 quick-xml = "0.41"
@@ -2,9 +2,18 @@

 **Stage: alpha** · next: beta, ~20 points and ~120–210 h away

+> **Last reviewed:** 2026-10-14 · **Last updated:** 2026-10-27 · **Change:** trivial (progress log: Set Up Slide Show ▸ Keep mouse cursor visible, #1445; stage and scores unchanged) · **Target:** Microsoft PowerPoint for Mac 16.113 (Microsoft 365)
+> **Last reviewed:** 2026-10-14 · **Last updated:** 2026-10-26 · **Change:** trivial (progress log: dragging several selected slides moves them all; previous: trivial, progress log: Edit Points handle drags with Shift, Ctrl/Cmd or Alt/Option set the point type; previous: trivial, progress log: scroll bars on the zoomed slide pane, #1157; previous: minor, native chart payloads stored in bounded ZIP members; previous: major, community PR wave 2026-10-14: ~60 landed items in the progress log, among them the Font, Paragraph, Photo Album, theme colour and font and Date and Time dialogs, presenter and show controls, the SmartArt Text Pane and PPTX corpus slices; breadth 84% after `cargo xtask parity`, ready stays ~55%, stage stays alpha; duplicated rows and headers folded; previous: minor, hours to ~95% per audience added) · **Target:** Microsoft PowerPoint for Mac 16.113 (Microsoft 365)
 > **Last reviewed:** 2026-10-14 · **Last updated:** 2026-10-24 · **Change:** trivial (progress log: Edit Points handle drags with Shift, Ctrl/Cmd or Alt/Option set the point type; previous: trivial, progress log: scroll bars on the zoomed slide pane, #1157; previous: minor, native chart payloads stored in bounded ZIP members; previous: major, community PR wave 2026-10-14: ~60 landed items in the progress log, among them the Font, Paragraph, Photo Album, theme colour and font and Date and Time dialogs, presenter and show controls, the SmartArt Text Pane and PPTX corpus slices; breadth 84% after `cargo xtask parity`, ready stays ~55%, stage stays alpha; duplicated rows and headers folded; previous: minor, hours to ~95% per audience added) · **Target:** Microsoft PowerPoint for Mac 16.113 (Microsoft 365)
+> **Last reviewed:** 2026-10-14 · **Last updated:** 2026-10-29 · **Change:** trivial (progress log: the Picture Styles row leaves room for Crop and Size, #1232; previous: trivial, progress log: Edit Points handle drags with Shift, Ctrl/Cmd or Alt/Option set the point type; previous: trivial, progress log: scroll bars on the zoomed slide pane, #1157; previous: minor, native chart payloads stored in bounded ZIP members; previous: major, community PR wave 2026-10-14: ~60 landed items in the progress log, among them the Font, Paragraph, Photo Album, theme colour and font and Date and Time dialogs, presenter and show controls, the SmartArt Text Pane and PPTX corpus slices; breadth 84% after `cargo xtask parity`, ready stays ~55%, stage stays alpha; duplicated rows and headers folded; previous: minor, hours to ~95% per audience added) · **Target:** Microsoft PowerPoint for Mac 16.113 (Microsoft 365)
+> **Last reviewed:** 2026-10-14 · **Last updated:** 2026-10-24 · **Change:** trivial (progress log: Edit Points handle drags with Shift, Ctrl/Cmd or Alt/Option set the point type; previous: trivial, progress log: scroll bars on the zoomed slide pane, #1157; previous: minor, native chart payloads stored in bounded ZIP members; previous: major, community PR wave 2026-10-14: ~60 landed items in the progress log, among them the Font, Paragraph, Photo Album, theme colour and font and Date and Time dialogs, presenter and show controls, the SmartArt Text Pane and PPTX corpus slices; breadth 84% after `cargo xtask parity`, ready stays ~55%, stage stays alpha; duplicated rows and headers folded; previous: minor, hours to ~95% per audience added) · **Target:** Microsoft PowerPoint for Mac 16.113 (Microsoft 365)
+> **Last reviewed:** 2026-10-14 · **Last updated:** 2026-10-29 · **Change:** trivial (progress log: the Picture Styles row leaves room for Crop and Size, #1232; stage and scores unchanged) · **Target:** Microsoft PowerPoint for Mac 16.113 (Microsoft 365)
+> **Last reviewed:** 2026-10-14 · **Last updated:** 2026-10-29 · **Change:** trivial (accessibility contrast checks now include every text run, paragraph and nested group descendant; parity summary unchanged) · **Target:** Microsoft PowerPoint for Mac 16.113 (Microsoft 365)
 > **Last reviewed:** 2026-10-14 · **Last updated:** 2026-10-24 · **Change:** trivial (progress log: Ctrl+wheel zoom during the slide show, #1286; previous: trivial, scroll bars on the zoomed slide pane, #1157; previous: minor, native chart payloads stored in bounded ZIP members; previous: major, community PR wave 2026-10-14: ~60 landed items in the progress log, among them the Font, Paragraph, Photo Album, theme colour and font and Date and Time dialogs, presenter and show controls, the SmartArt Text Pane and PPTX corpus slices; breadth 84% after `cargo xtask parity`, ready stays ~55%, stage stays alpha; duplicated rows and headers folded; previous: minor, hours to ~95% per audience added) · **Target:** Microsoft PowerPoint for Mac 16.113 (Microsoft 365)
 > **Last reviewed:** 2026-10-14 · **Last updated:** 2026-10-24 · **Change:** trivial (progress log: picture and embedded object fills; previous: trivial, scroll bars on the zoomed slide pane, #1157; previous: minor, native chart payloads stored in bounded ZIP members; previous: major, community PR wave 2026-10-14: ~60 landed items in the progress log, among them the Font, Paragraph, Photo Album, theme colour and font and Date and Time dialogs, presenter and show controls, the SmartArt Text Pane and PPTX corpus slices; breadth 84% after `cargo xtask parity`, ready stays ~55%, stage stays alpha; duplicated rows and headers folded; previous: minor, hours to ~95% per audience added) · **Target:** Microsoft PowerPoint for Mac 16.113 (Microsoft 365)
+> **Last reviewed:** 2026-10-14 · **Last updated:** 2026-10-25 · **Change:** trivial (progress log: a picture in a picture placeholder is cut into the layout's shape; previous: trivial, progress log: Edit Points handle drags with Shift, Ctrl/Cmd or Alt/Option set the point type; previous: trivial, progress log: scroll bars on the zoomed slide pane, #1157; previous: minor, native chart payloads stored in bounded ZIP members; previous: major, community PR wave 2026-10-14: ~60 landed items in the progress log, among them the Font, Paragraph, Photo Album, theme colour and font and Date and Time dialogs, presenter and show controls, the SmartArt Text Pane and PPTX corpus slices; breadth 84% after `cargo xtask parity`, ready stays ~55%, stage stays alpha; duplicated rows and headers folded; previous: minor, hours to ~95% per audience added) · **Target:** Microsoft PowerPoint for Mac 16.113 (Microsoft 365)
+> **Last reviewed:** 2026-10-14 · **Last updated:** 2026-10-25 · **Change:** trivial (progress log: a picture in a picture placeholder is cut into the layout's shape; previous: trivial, progress log: Ctrl+wheel zoom during the slide show, #1286; previous: trivial, scroll bars on the zoomed slide pane, #1157; previous: minor, native chart payloads stored in bounded ZIP members; previous: major, community PR wave 2026-10-14: ~60 landed items in the progress log, among them the Font, Paragraph, Photo Album, theme colour and font and Date and Time dialogs, presenter and show controls, the SmartArt Text Pane and PPTX corpus slices; breadth 84% after `cargo xtask parity`, ready stays ~55%, stage stays alpha; duplicated rows and headers folded; previous: minor, hours to ~95% per audience added) · **Target:** Microsoft PowerPoint for Mac 16.113 (Microsoft 365)
+> **Last reviewed:** 2026-10-14 · **Last updated:** 2026-10-25 · **Change:** trivial (progress log: a picture in a picture placeholder is cut into the layout's shape; previous: trivial, progress log: picture and embedded object fills; previous: trivial, scroll bars on the zoomed slide pane, #1157; previous: minor, native chart payloads stored in bounded ZIP members; previous: major, community PR wave 2026-10-14: ~60 landed items in the progress log, among them the Font, Paragraph, Photo Album, theme colour and font and Date and Time dialogs, presenter and show controls, the SmartArt Text Pane and PPTX corpus slices; breadth 84% after `cargo xtask parity`, ready stays ~55%, stage stays alpha; duplicated rows and headers folded; previous: minor, hours to ~95% per audience added) · **Target:** Microsoft PowerPoint for Mac 16.113 (Microsoft 365)
 > **Last reviewed:** 2026-10-14 · **Last updated:** 2026-10-22 · **Change:** trivial (fill and outline edits reach group members, #1079; stage and scores unchanged) · **Target:** Microsoft PowerPoint for Mac 16.113 (Microsoft 365)
 > **Last reviewed:** 2026-10-14 · **Last updated:** 2026-10-20 · **Change:** trivial (empty chart number-format sections hide values; previous: minor, native chart payloads stored in bounded ZIP members; previous: major, community PR wave 2026-10-14: ~60 landed items in the progress log, among them the Font, Paragraph, Photo Album, theme colour and font and Date and Time dialogs, presenter and show controls, the SmartArt Text Pane and PPTX corpus slices; breadth 84% after `cargo xtask parity`, ready stays ~55%, stage stays alpha; duplicated rows and headers folded; previous: minor, hours to ~95% per audience added) · **Target:** Microsoft PowerPoint for Mac 16.113 (Microsoft 365)
 > **Last reviewed:** 2026-10-14 · **Last updated:** 2026-10-18 · **Change:** minor (Symbol-font characters (U+F0xx) remap to the installed Symbol face's real Unicode on macOS, so they draw from Symbol instead of a look-alike; previous: minor, native chart payloads stored in bounded ZIP members; previous: major, community PR wave 2026-10-14: ~60 landed items in the progress log, among them the Font, Paragraph, Photo Album, theme colour and font and Date and Time dialogs, presenter and show controls, the SmartArt Text Pane and PPTX corpus slices; breadth 84% after `cargo xtask parity`, ready stays ~55%, stage stays alpha; duplicated rows and headers folded; previous: minor, hours to ~95% per audience added) · **Target:** Microsoft PowerPoint for Mac 16.113 (Microsoft 365)
@@ -43,7 +52,7 @@ Calibration is the same as for the full number (see [docs/target-app-parity.md](
 `.pptx`, present, add tables and charts, share as PDF, review. Core workflows work end to end (build a deck, open and save `.pptx`, present with
 transitions, animations, media and presenter view, export PDF), but depth, fidelity and polish
 have known gaps, and PPTX has never been tested on a corpus of real decks. Beta needs ~75% ready
-and no blocking gap in `.pptx`: the real-deck corpus, the round-trip losses (#70, #74, #77),
+and no blocking gap in `.pptx`: the real-deck corpus, the round-trip losses (#70, #74),
 EMF/SVG pictures, the data-loss and startup-crash bugs (#60, #40, #59) and the beta list in
 [docs/roadmap.md](docs/roadmap.md).

@@ -116,11 +125,11 @@ ships 26.
 Ranked; detail and the full beta plan in [docs/roadmap.md](docs/roadmap.md).

 1. **No data loss, no startup crashes:** Close's save prompt (#60), Windows GPU crashes (#40, #59),
-   image paste (#53), editor soak tests. 10–20 h.
+   image paste on Windows (#1414), editor soak tests. 10–20 h.
 2. **PPTX on real decks:** the owned corpus now round-trips comments, links and actions, custom
   shows, rotated groups, inherited placeholders, text effects and body layout, theme effects,
   fills, bevels, connectors, tables, charts, animations, media, sections, masters, 3-D models
-   and animation bounce end. Still open: a corpus of real decks, #70, #74, #77, EMF+ records,
+   and animation bounce end. Still open: a corpus of real decks, #70, #74, EMF+ records,
   MicroType Express font subsets and SVG. 36–64 h.
 3. **Localization:** catalog, system language (#15), zh-Hans, es, fr, de, ja with IME. 27–46 h.
 4. **Output:** vector PDF, printing. 10–16 h.
@@ -137,7 +146,16 @@ app's JSON control channel (`deckcraft --control PORT`).

 | Date | What landed |
 |---|---|
+| 2026-10-29 | Slide Show: going back to the previous slide plays the transition of the slide being left, reversed, as PowerPoint does, instead of the previous slide's own entrance transition (#1531); a jump (Go to Slide, links) still plays the target slide's transition |
+| 2026-10-27 | Set Up Slide Show ▸ Keep mouse cursor visible: a full-screen show no longer hides a still pointer, so the choices of a branching deck stay visible and clickable; the setting is kept with the user's preferences (`ui.json`, `showKeepCursor`), off by default (#1445) |
+| 2026-10-25 | A photo in a picture placeholder is cut into the shape its layout gives the placeholder, as PowerPoint draws it: a layout's round picture placeholder keeps a slide's photo in a circle with the layout's white border, where it came out as a rectangle (the reader only passed `p:sp` placeholders to `inherit_placeholder_geometry`, not `p:pic`) |
+| 2026-10-28 | CLI `run --cmd-file FILE` reads UTF-8 commands in order alongside `--cmd`, skips blank/comment lines, and reports file/line errors before final save/export (#1098) |
+| 2026-10-28 | MCP accepts repeated `--automation-read-root` and `--automation-write-root` flags for access to multiple folders (#1154) |
+| 2026-10-26 | Slide reorder: dragging one of several selected slides in the thumbnail pane or the Slide Sorter moves the whole selection, as one run in deck order and one undo step; the slides stay selected and join the section they land in. `slide.move {ids, to}` does the same from the control channel and MCP; dragging an unselected slide still moves only that slide |
+| 2026-10-26 | A space, digit or punctuation after a symbol-font character (`a:sym`, e.g. a Wingdings arrow typed in a run) draws in the run's own font, as PowerPoint does; it stayed in the symbol font, whose space is about four times as wide (synthetic probe) |
+| 2026-10-29 | Review ▸ Accessibility checks text runs in every paragraph and nested group descendants for low contrast, reporting each affected shape once; the all-black control stays clear |
 | 2026-10-25 | Windows installer: the Start menu shortcut takes the icon embedded in `deckcraft.exe` instead of an MSI `<Icon>`, so a taskbar pin keeps its icon after an update (#1114); a pin that already lost it has to be unpinned and pinned again once |
+| 2026-10-29 | Picture Format: the Picture Styles row shows as many styles as leave room for the groups after it, and its arrow opens all 24. With every style in the row, Crop and Size sat past the ribbon's edge in any window narrower than about 2500 px, so Crop could not be seen without scrolling the ribbon (#1232). In the default 1440 px window Crop, Height and Width are now in view, and from 1600 px the whole tab fits |
 | 2026-10-24 | AutoFormat as you type: a paragraph that starts with `*`, `-`, `--`, `>`, `<>`, `1.`, `1)`, `I.`, `i.`, `A.`, `a.` or `a)` and a space or tab becomes a bulleted or numbered list in that style; Backspace right after puts the typed text back, and Tools ▸ AutoCorrect and `text.autocorrect {lists}` turn it off |
 | 2026-10-24 | Tables: while the caret is in a cell, dragging into another cell selects that range of cells (shaded, merged cells taken in whole), and Shift+arrow grows or shrinks it; formatting applies to the selected cells only, and Delete clears their text and keeps the table |
 | 2026-10-24 | Preferences ▸ Measurement units: inches or centimetres. The Format pane's Size and Position fields, Shape Format ▸ Size on the ribbon, the Slide Size dialog and the ruler show and take the chosen unit; the deck still stores points (#1326) |
@@ -148,6 +166,7 @@ app's JSON control channel (`deckcraft --control PORT`).
 | 2026-10-18 | Find (Ctrl+F): "Find what:" has the keyboard as soon as the dialog opens, and keeps it after Enter finds a match, so the search can be typed and changed without clicking the field (#951) |
 | 2026-10-24 | Columns dialog: Home › Columns › More Columns… and Format Shape › Text Box › Columns… set the number of text columns (1 to 16) and the spacing between them in inches, in one undo step; `format.columns` with no fields opens it, and a key left out keeps the text box's own value |
 | 2026-10-18 | Duplicate (Ctrl+D) repeats a move: duplicate a shape, move the copy, and the next Duplicate places its copy the same distance further on, as in PowerPoint (#966) |
+| 2026-10-26 | Duplicate (Ctrl+D) names the copy as PowerPoint does: a shape with an automatic name ("Rectangle 1") gets the next one ("Rectangle 5", also for the shapes inside a duplicated group), and a name you chose ("Hero") stays as it is instead of becoming "Hero copy" |
 | 2026-10-22 | Slide Show: while animations play, each frame draws only the slide's shapes over the slide's backdrop (background, master and layout graphics), rendered once and ahead of time. A full-slide picture with a glow in the layout re-rendered at every frame held animations to 2–3 frames a second (~390 ms a frame at 1080p); now ~28 ms |
 | 2026-10-22 | Animation Pane ▸ Play From: with an effect selected, the pane's play button starts the canvas preview at that effect, with the effects before it already played. With nothing selected it is still Play All |
 | 2026-10-21 | Opening a .pptx puts the text of shapes without an anchor at the top even when the theme's shape defaults (`spDef`) centre new shapes, as PowerPoint for Mac draws them; checked with a synthetic probe and on a private 166-deck corpus (51 slides closer to PowerPoint's PDF, none further) |
@@ -161,6 +180,7 @@ app's JSON control channel (`deckcraft --control PORT`).
 | 2026-10-20 | Chart number formats with explicit empty positive, negative or zero sections hide the corresponding labels, including all values with three semicolons; a blank whole format still uses General. Synthetic formatter regressions |
 | 2026-10-22 | Chart bars and their legend keys draw the series' own pattern fill (`a:pattFill`, now read and written) and draw nothing for `a:noFill`, with the series outline where it has one, as PowerPoint for Mac does (synthetic probe); they took the palette's colour before. Lines, areas and markers use a pattern's foreground colour |
 | 2026-10-24 | Format Shape and Format Background ▸ Pattern fill: a gallery of the 48 preset patterns PowerPoint offers, drawn in the current colors, with Foreground and Background color menus. Format Shape could only set 25 % in accent 1 on background 1, and Format Background listed 10 presets by their XML names |
+| 2026-10-25 | Format Shape ▸ Fill: Slide background fill shows the slide background through the shape (`shape.fill {background: true}`, saved as `useBgFill`). A shape opened from a file with this fill showed it as Automatic, and the pane offered no way to set it |
 | 2026-10-21 | Reuse Slides: pick which slides of the other presentation to insert from a list (`slide.reuseList`, #1103) |
 | 2026-10-21 | Slide list and slide sorter: Shift+click selects a range of slides and Ctrl+Shift+click adds it to the selection (`slide.selectRange`, #1105) |
 | 2026-10-18 | Native chart sidecar bytes move from JSON arrays into referenced ZIP entries, with shared media byte/item limits and bounded reads; older inline sidecars still load. Synthetic format regressions cover large workbooks and malformed members |
@@ -294,7 +314,15 @@ app's JSON control channel (`deckcraft --control PORT`).

 | Date | Change | Summary |
 |---|---|---|
+| 2026-10-29 | trivial | Progress log: going back in the slide show reverses the left slide's transition (#1531). Scores and milestone names unchanged |
+| 2026-10-29 | trivial | Progress log: the Picture Styles row leaves room for Crop and Size (#1232). Scores and milestone names unchanged |
+| 2026-10-25 | trivial | Progress log: a picture in a picture placeholder takes the layout's shape. Scores and milestone names unchanged |
+| 2026-10-28 | trivial | Progress log: CLI command-file input (#1098). Scores and milestone scope unchanged. |
+| 2026-10-28 | trivial | Progress log: MCP accepts multiple automation read and write roots (#1154). Scores and milestone names unchanged |
+| 2026-10-26 | trivial | Progress log: dragging several selected slides moves them all. Scores and milestone names unchanged |
+| 2026-10-29 | trivial | Review: accessibility contrast checks all runs, paragraphs and nested group descendants; checklist score and headline figures unchanged |
 | 2026-10-25 | trivial | Progress log: Windows shortcut icon survives updates (#1114). Scores and milestone names unchanged |
+| 2026-10-29 | trivial | Progress log: the Picture Styles row leaves room for Crop and Size (#1232). Scores and milestone names unchanged |
 | 2026-10-24 | trivial | Progress log: selecting a range of table cells by dragging. Scores and milestone names unchanged |
 | 2026-10-24 | trivial | Progress log: measurement units in centimetres (#1326). Scores unchanged |
 | 2026-10-22 | trivial | Progress log: Animation Pane ▸ Play From. Scores unchanged |
@@ -312,6 +340,7 @@ app's JSON control channel (`deckcraft --control PORT`).
 | 2026-10-15 | trivial | Progress log: PPTX trigger click-step round trip. Feature scores and milestone names unchanged |
 | 2026-10-16 | trivial | Progress log: PNG export with a transparent background (#784) |
 | 2026-10-16 | trivial | Progress log: a `.ppsx` from the system starts the slide show (#862) |
+| 2026-10-26 | trivial | Progress log: spaces after symbol-font characters |
 | 2026-10-24 | trivial | Progress log: picture and embedded object fills |
 | 2026-10-22 | trivial | Progress log: table text takes the master's other-text style |
 | 2026-10-16 | trivial | Progress log: responsive mouse-wheel navigation on the fitted canvas |
@@ -4,29 +4,24 @@
 use std::path::PathBuf;

 pub struct AutomationArgs {
-    pub read_root: Option<PathBuf>,
-    pub write_root: Option<PathBuf>,
-    read_given: bool,
-    write_given: bool,
+    pub read_roots: Vec<PathBuf>,
+    pub write_roots: Vec<PathBuf>,
 }

 impl AutomationArgs {
    pub fn new(read_root: Option<PathBuf>, write_root: Option<PathBuf>) -> Self {
-        Self { read_root, write_root, read_given: false, write_given: false }
+        Self { read_roots: read_root.into_iter().collect(), write_roots: write_root.into_iter().collect() }
    }

-    /// Returns whether this argument is a root flag. A second occurrence of a flag is an error,
-    /// including when the two spellings (`--flag DIR`, `--flag=DIR`) are mixed.
+    /// Returns whether this argument is a root flag. Both spellings (`--flag DIR` and
+    /// `--flag=DIR`) may be repeated.
    pub fn consume(&mut self, arg: &str, args: &mut impl Iterator<Item = String>) -> Result<bool, String> {
        let (flag, inline) = arg.split_once('=').map_or((arg, None), |(flag, value)| (flag, Some(value)));
-        let (root, given) = match flag {
-            "--automation-read-root" => (&mut self.read_root, &mut self.read_given),
-            "--automation-write-root" => (&mut self.write_root, &mut self.write_given),
+        let roots = match flag {
+            "--automation-read-root" => &mut self.read_roots,
+            "--automation-write-root" => &mut self.write_roots,
            _ => return Ok(false),
        };
-        if *given {
-            return Err(format!("{flag} given twice"));
-        }
        let value = match inline {
            Some(value) => value.to_owned(),
            None => {
@@ -40,8 +35,7 @@ impl AutomationArgs {
        if value.is_empty() {
            return Err(format!("{flag} needs a non-empty folder"));
        }
-        *root = Some(value.into());
-        *given = true;
+        roots.push(value.into());
        Ok(true)
    }
 }
@@ -51,17 +45,16 @@ mod tests {
    use super::*;

    #[test]
-    fn roots_are_taken_once_and_other_arguments_are_left() {
+    fn roots_are_repeated_and_other_arguments_are_left() {
        let mut roots = AutomationArgs::new(None, None);
        let mut args = ["a folder".to_owned(), "deck.pptx".to_owned()].into_iter();
        assert!(roots.consume("--automation-read-root", &mut args).unwrap());
+        assert!(roots.consume("--automation-read-root=other", &mut args).unwrap());
        assert!(roots.consume("--automation-write-root=out", &mut args).unwrap());
        assert!(!roots.consume("--sample", &mut args).unwrap());
-        assert_eq!(roots.read_root, Some("a folder".into()));
-        assert_eq!(roots.write_root, Some("out".into()));
+        assert_eq!(roots.read_roots, [PathBuf::from("a folder"), PathBuf::from("other")]);
+        assert_eq!(roots.write_roots, [PathBuf::from("out")]);
        assert_eq!(args.next().as_deref(), Some("deck.pptx"));
-        assert!(roots.consume("--automation-read-root=other", &mut args).is_err());
-        assert_eq!(roots.read_root, Some("a folder".into()));
    }

    #[test]
@@ -71,8 +64,8 @@ mod tests {
                let mut roots = AutomationArgs::new(Some("read".into()), Some("write".into()));
                let mut args = operand.map(str::to_owned).into_iter();
                assert!(roots.consume(flag, &mut args).is_err(), "{flag} {operand:?}");
-                assert_eq!(roots.read_root, Some("read".into()));
-                assert_eq!(roots.write_root, Some("write".into()));
+                assert_eq!(roots.read_roots, [PathBuf::from("read")]);
+                assert_eq!(roots.write_roots, [PathBuf::from("write")]);
            }
            let mut roots = AutomationArgs::new(None, None);
            assert!(roots.consume(&format!("{flag}="), &mut std::iter::empty()).is_err());
@@ -84,7 +77,7 @@ mod tests {
        let mut roots = AutomationArgs::new(None, None);
        assert!(roots.consume("--automation-read-root=-folder", &mut std::iter::empty()).unwrap());
        assert!(roots.consume("--automation-write-root", &mut ["./-folder".to_owned()].into_iter()).unwrap());
-        assert_eq!(roots.read_root, Some("-folder".into()));
-        assert_eq!(roots.write_root, Some("./-folder".into()));
+        assert_eq!(roots.read_roots, [PathBuf::from("-folder")]);
+        assert_eq!(roots.write_roots, [PathBuf::from("./-folder")]);
    }
 }
@@ -58,7 +58,7 @@ animated GIF with one frame per slide. Other extensions are refused. Prints OUT.
    },
    Subcommand {
        name: "run",
-        usage: "run [--in FILE | --sample] [--cmd COMMAND[=PARAMS]]... [--save OUT] [--export OUT [--export-params JSON]] [--print]",
+        usage: "run [--in FILE | --sample] [--cmd COMMAND[=PARAMS] | --cmd-file FILE]... [--save OUT] [--export OUT [--export-params JSON]] [--print]",
        summary: "run commands on a presentation, then save or export it",
        details: "Runs commands, in order, on one presentation: FILE with --in, the sample presentation with --sample,
 else a new one with an empty title slide. Then --save writes the presentation: .deckcraft keeps
@@ -71,6 +71,15 @@ slide). --export-params passes file.export options as one JSON object, such as
 Each --cmd is one command: COMMAND is a command id, then `=`, then the command's parameters as one
 JSON object. Quote it for the shell. A command that needs no parameters is just its id.

+--cmd-file FILE reads the same commands from a UTF-8 text file, one per line, avoiding shell quoting
+and command-line length limits. Each line can be up to 16 MiB, including commands with embedded
+media data. Blank lines and full-line # comments are ignored, as is surrounding whitespace. CRLF
+line endings and an optional UTF-8 BOM at the start of the file are accepted.
+Repeat --cmd-file or mix it with --cmd: commands execute in the order those options appear.
+File errors name the path; line-reading, JSON and command errors also name the line number.
+
+  deckcraft-cli run --cmd-file commands.txt --cmd slide.next --save result.deckcraft
+
  deckcraft-cli run \\
    --cmd 'slide.new={\"layout\":\"titleOnly\",\"title\":\"Q3 results\"}' \\
    --cmd 'shape.insert={\"preset\":\"roundRect\",\"rect\":[80,160,320,120],\"text\":\"Revenue\"}' \\
@@ -127,16 +136,16 @@ and prints its answer as JSON. COMMAND [PARAMS] runs a command, as run --cmd doe
    },
    Subcommand {
        name: "mcp",
-        usage: "mcp [--connect PORT] [--sample] [--automation-read-root DIR] [--automation-write-root DIR]",
+        usage: "mcp [--connect PORT] [--sample] [--automation-read-root DIR]... [--automation-write-root DIR]...",
        summary: "serve the commands to an agent over MCP on stdio",
        details: "Runs a Model Context Protocol server on stdin and stdout. It works on its own presentation without a
 window, or with --connect PORT (or host:port) on the DeckCraft app started with --control PORT.
 --sample opens the sample presentation.

 --automation-read-root DIR and --automation-write-root DIR confine every file the agent's commands read
-(open, pictures, audio, video) and write (save, export, PDF) to those folders, links followed; a root left
-out grants none of its access. They run the in-process server, so they conflict with --connect (a running
-app is not confined by them).",
+(open, pictures, audio, video) and write (save, export, PDF) to those folders, links followed. Repeat either
+flag to grant access to more folders; a root left out grants none of its access. They run the in-process
+server, so they conflict with --connect (a running app is not confined by them).",
    },
    Subcommand {
        name: "bench",
@@ -180,7 +189,10 @@ A presentation is edited by running commands on it:
  deckcraft-cli run --cmd 'slide.new={{\"title\":\"Q3 results\"}}' --save q3.deckcraft

 `deckcraft-cli help SUBCOMMAND`, or `deckcraft-cli SUBCOMMAND --help`, explains one subcommand;
-`deckcraft-cli help run` explains how to write a command.",
+`deckcraft-cli help run` explains how to write a command.
+
+If an output reader closes early, run, render, render-transition and convert continue; their exit
+status reflects the work, not output delivery. Stop the process to cancel them.",
        list.join("\n")
    )
 }
@@ -7,23 +7,38 @@ mod automation_args;
 mod help;

 use std::process::ExitCode;
+use std::sync::atomic::{AtomicBool, Ordering};

 use deckcraft_engine::Session;
 use serde_json::{Value, json};

+static STDOUT_CLOSED: AtomicBool = AtomicBool::new(false);
+
 macro_rules! outln {
    ($($arg:tt)*) => {{
-        use std::io::Write as _;
-        if let Err(e) = writeln!(std::io::stdout(), $($arg)*) {
+        if !STDOUT_CLOSED.load(Ordering::Relaxed) && let Err(e) = stdout_line(format_args!($($arg)*)) {
            if e.kind() == std::io::ErrorKind::BrokenPipe {
-                std::process::exit(0);
+                STDOUT_CLOSED.store(true, Ordering::Relaxed);
+            } else {
+                eprintln!("deckcraft-cli: can't write to stdout: {e}");
+                std::process::exit(1);
            }
-            eprintln!("deckcraft-cli: can't write to stdout: {e}");
-            std::process::exit(1);
        }
    }};
 }

+fn stdout_line(args: std::fmt::Arguments<'_>) -> std::io::Result<()> {
+    use std::io::Write as _;
+    #[cfg(unix)]
+    let mut stdout = {
+        use std::os::fd::AsFd as _;
+        std::fs::File::from(std::io::stdout().as_fd().try_clone_to_owned()?)
+    };
+    #[cfg(not(unix))]
+    let mut stdout = std::io::stdout();
+    stdout.write_all(format!("{args}\n").as_bytes())
+}
+
 fn main() -> ExitCode {
    let args: Vec<String> = std::env::args().skip(1).collect();
    let rest = args.get(1..).unwrap_or(&[]);
@@ -146,9 +161,13 @@ fn time_ms(runs: usize, mut f: impl FnMut() -> Result<(), String>) -> Result<(f6
        f()?;
        ms.push(t.elapsed().as_secs_f64() * 1000.0);
    }
+    Ok(summarize_ms(ms))
+}
+
+/// Summarize one population of measurements; each maximum must come from that population.
+fn summarize_ms(mut ms: Vec<f64>) -> (f64, f64) {
    ms.sort_by(f64::total_cmp);
-    let median = ms.get(ms.len() / 2).copied().unwrap_or(0.0);
-    Ok((median, ms.last().copied().unwrap_or(0.0)))
+    (ms.get(ms.len() / 2).copied().unwrap_or(0.0), ms.last().copied().unwrap_or(0.0))
 }

 /// Peak resident memory of this process in MiB (Linux `VmHWM`); `None` elsewhere.
@@ -210,9 +229,13 @@ fn bench(args: &[String]) -> Result<(), String> {
        ("open .pptx", time_ms(runs, || open_presentation("bench.pptx", &pptx).map(|_| ()).map_err(e))?),
        ("export .pdf", time_ms(runs, || save_bytes(&doc, "pdf").map(|_| ()).map_err(e))?),
    ];
-    let render_total: f64 = per_slide.iter().map(|m| m.0).sum();
-    let render_max = per_slide.iter().map(|m| m.1).fold(0.0, f64::max);
-    steps.insert(1, ("render all slides (1×)", (render_total, render_max)));
+    let render_all = time_ms(runs, || {
+        for i in 0..slides {
+            deckcraft_engine::render::render_slide(&doc, i, &opts);
+        }
+        Ok(())
+    })?;
+    steps.insert(1, ("render all slides (1×)", render_all));
    let peak = peak_rss_mib();
    if as_json {
        let v = json!({
@@ -450,6 +473,69 @@ fn output_format(path: &str) -> Result<&'static str, String> {
    })
 }

+enum CommandSource {
+    Inline(String),
+    File(String),
+}
+
+const MAX_COMMAND_FILE_LINE_BYTES: usize = 16 * 1024 * 1024;
+
+fn read_command_file_line(reader: &mut impl std::io::BufRead, line: &mut Vec<u8>) -> std::io::Result<bool> {
+    line.clear();
+    loop {
+        let available = reader.fill_buf()?;
+        if available.is_empty() {
+            return Ok(!line.is_empty());
+        }
+        let newline = available.iter().position(|byte| *byte == b'\n');
+        let count = newline.unwrap_or(available.len());
+        line.len().checked_add(count).filter(|length| *length <= MAX_COMMAND_FILE_LINE_BYTES).ok_or_else(|| {
+            std::io::Error::new(std::io::ErrorKind::InvalidData, format!("command line exceeds {MAX_COMMAND_FILE_LINE_BYTES} byte limit"))
+        })?;
+        line.extend_from_slice(&available[..count]);
+        reader.consume(count + usize::from(newline.is_some()));
+        if newline.is_some() {
+            return Ok(true);
+        }
+    }
+}
+
+/// The same command syntax and execution path for --cmd and each command-file line.
+fn run_command(s: &mut Session, command: &str, print: bool) -> Result<(), String> {
+    let (id, params) = match command.split_once('=') {
+        Some((id, j)) => (id, serde_json::from_str::<Value>(j).map_err(|e| format!("{id}: bad JSON: {e}"))?),
+        None => (command, json!({})),
+    };
+    let r = s.execute(id, &params).map_err(|e| e.to_string())?;
+    if print {
+        outln!("{id} → {r}");
+    }
+    Ok(())
+}
+
+fn run_command_file(s: &mut Session, path: &str, print: bool) -> Result<(), String> {
+    use std::io::BufReader;
+
+    let file = std::fs::File::open(path).map_err(|e| format!("{path}: {e}"))?;
+    let mut reader = BufReader::new(file);
+    let mut bytes = Vec::new();
+    let mut line_number = 0usize;
+    loop {
+        line_number = line_number.checked_add(1).ok_or_else(|| format!("{path}: too many lines"))?;
+        if !read_command_file_line(&mut reader, &mut bytes).map_err(|e| format!("{path}:{line_number}: {e}"))? {
+            break;
+        }
+        let line = std::str::from_utf8(&bytes).map_err(|e| format!("{path}:{line_number}: invalid UTF-8: {e}"))?;
+        let line = if line_number == 1 { line.trim_start_matches('\u{feff}') } else { line };
+        let command = line.trim();
+        if command.is_empty() || command.starts_with('#') {
+            continue;
+        }
+        run_command(s, command, print).map_err(|e| format!("{path}:{line_number}: {e}"))?;
+    }
+    Ok(())
+}
+
 fn run(args: &[String]) -> Result<(), String> {
    let mut input = None;
    let mut sample = false;
@@ -463,7 +549,8 @@ fn run(args: &[String]) -> Result<(), String> {
        match a.as_str() {
            "--in" => input = Some(it.next().cloned().ok_or("--in needs a file")?),
            "--sample" => sample = true,
-            "--cmd" => cmds.push(it.next().cloned().ok_or("--cmd needs COMMAND[=PARAMS]")?),
+            "--cmd" => cmds.push(CommandSource::Inline(it.next().cloned().ok_or("--cmd needs COMMAND[=PARAMS]")?)),
+            "--cmd-file" => cmds.push(CommandSource::File(it.next().cloned().ok_or("--cmd-file needs a file")?)),
            "--save" => save = Some(it.next().cloned().ok_or("--save needs a path")?),
            "--export" => export = Some(it.next().cloned().ok_or("--export needs a path")?),
            "--export-params" => {
@@ -486,14 +573,10 @@ fn run(args: &[String]) -> Result<(), String> {
    }
    let mut s = Session::new();
    open(&mut s, input.as_deref(), sample)?;
-    for c in cmds {
-        let (id, p) = match c.split_once('=') {
-            Some((id, j)) => (id.to_string(), serde_json::from_str::<Value>(j).map_err(|e| format!("{id}: bad JSON: {e}"))?),
-            None => (c.clone(), json!({})),
-        };
-        let r = s.execute(&id, &p).map_err(|e| e.to_string())?;
-        if print {
-            outln!("{id} → {r}");
+    for source in cmds {
+        match source {
+            CommandSource::Inline(command) => run_command(&mut s, &command, print)?,
+            CommandSource::File(path) => run_command_file(&mut s, &path, print)?,
        }
    }
    if let Some(p) = save {
@@ -624,7 +707,7 @@ fn mcp(args: &[String]) -> Result<(), String> {
            other => return Err(format!("unknown mcp option `{other}`")),
        }
    }
-    let roots = AutomationRoots::new(roots_args.read_root.as_deref(), roots_args.write_root.as_deref())?;
+    let roots = AutomationRoots::new(&roots_args.read_roots, &roots_args.write_roots)?;
    if roots.is_some() && connect.is_some() {
        return Err("--automation-read-root and --automation-write-root confine the in-process server; a running app is not confined by them, \
 so drop --connect (or use --connect without the roots)"
@@ -641,8 +724,12 @@ so drop --connect (or use --connect without the roots)"
            if let Some(roots) = roots {
                // Every thread of this process, not only the server's: nothing reaches past the roots.
                file_access::confine_process(roots.clone());
-                let show = |root: Option<&std::path::Path>| root.map_or_else(|| "none".to_string(), |r| r.display().to_string());
-                eprintln!("deckcraft-cli: files confined: read root {}, write root {}", show(roots.read_root()), show(roots.write_root()));
+                let show = |roots: Vec<String>| if roots.is_empty() { "none".to_string() } else { roots.join(", ") };
+                eprintln!(
+                    "deckcraft-cli: files confined: read roots {}, write roots {}",
+                    show(roots.read_roots().map(|r| r.display().to_string()).collect()),
+                    show(roots.write_roots().map(|r| r.display().to_string()).collect())
+                );
                h = h.with_automation_roots(Some(roots));
            }
            Box::new(h)
@@ -663,6 +750,16 @@ mod tests {
        a.iter().map(|s| s.to_string()).collect()
    }

+    #[test]
+    fn timing_summary_keeps_median_and_max_from_one_population() {
+        let slide_medians = [8.99, 16.565];
+        let whole_deck = summarize_ms(vec![17.0, 18.0, 16.0]);
+        assert_eq!(whole_deck, (17.0, 18.0));
+        assert!(whole_deck.1 >= whole_deck.0);
+        assert!(slide_medians.iter().sum::<f64>() > whole_deck.1, "fixture must expose summing independent slide medians");
+        assert_eq!(summarize_ms(vec![]), (0.0, 0.0));
+    }
+
    #[test]
    fn render_help_prints_usage_and_writes_nothing() {
        assert!(render(&args(&["--help"])).is_ok());
@@ -20,6 +20,153 @@ fn words(s: &str) -> String {
    s.split_whitespace().collect::<Vec<_>>().join(" ")
 }

+fn command_file_dir(name: &str) -> std::path::PathBuf {
+    let dir = std::env::temp_dir().join(format!("deckcraft-cli-command-file-{name}-{}", std::process::id()));
+    let _ = std::fs::remove_dir_all(&dir);
+    std::fs::create_dir_all(&dir).unwrap();
+    dir
+}
+
+fn inspected_titles(out: &str) -> Vec<String> {
+    let answer = out.lines().last().unwrap().strip_prefix("document.inspect → ").unwrap();
+    let doc: serde_json::Value = serde_json::from_str(answer).unwrap();
+    doc["slides"].as_array().unwrap().iter().map(|s| s["title"].as_str().unwrap().to_string()).collect()
+}
+
+#[test]
+fn command_file_runs_utf8_lines_in_order_and_skips_comments() {
+    let dir = command_file_dir("lines");
+    let file = dir.join("commands with spaces.txt");
+    std::fs::write(
+        &file,
+        "\u{feff}# heading\r\n\r\n  # indented comment\r\n  slide.new={\"title\":\"Résumé = # 测试\"}  \r\nslide.new\r\nslide.new={\"title\":\"Last\"}",
+    )
+    .unwrap();
+    let o = cli(&["run", "--print", "--cmd-file", &file.to_string_lossy(), "--cmd", "document.inspect"]);
+    let out = stdout(&o);
+    let commands: Vec<_> = out.lines().map(|l| l.split_once(" → ").unwrap().0).collect();
+    assert_eq!(commands, ["slide.new", "slide.new", "slide.new", "document.inspect"]);
+    let titles = inspected_titles(&out);
+    assert_eq!(titles.len(), 4);
+    assert_eq!(titles[1], "Résumé = # 测试");
+    assert_eq!(titles[3], "Last");
+    std::fs::remove_dir_all(dir).unwrap();
+}
+
+#[test]
+fn command_files_and_inline_commands_keep_argument_order() {
+    let dir = command_file_dir("mixed");
+    let first = dir.join("first.txt");
+    let second = dir.join("second.txt");
+    let saved = dir.join("result.deckcraft");
+    std::fs::write(&first, "slide.new={\"title\":\"First file\"}\n").unwrap();
+    std::fs::write(&second, "slide.new={\"title\":\"Second file\"}\n").unwrap();
+    let o = cli(&[
+        "run",
+        "--cmd",
+        "slide.new={\"title\":\"Inline first\"}",
+        "--cmd-file",
+        &first.to_string_lossy(),
+        "--cmd",
+        "slide.new={\"title\":\"Inline middle\"}",
+        "--cmd-file",
+        &second.to_string_lossy(),
+        "--cmd",
+        "document.inspect",
+        "--print",
+        "--save",
+        &saved.to_string_lossy(),
+    ]);
+    let out = stdout(&o);
+    let titles = inspected_titles(&out);
+    assert_eq!(&titles[1..], ["Inline first", "First file", "Inline middle", "Second file"]);
+    assert_eq!(out.lines().count(), 5);
+    let reopened = cli(&["run", "--in", &saved.to_string_lossy(), "--cmd", "document.inspect", "--print"]);
+    assert_eq!(inspected_titles(&stdout(&reopened)), titles);
+    std::fs::remove_dir_all(dir).unwrap();
+}
+
+#[test]
+fn a_failed_file_command_stops_later_commands_and_final_outputs() {
+    let dir = command_file_dir("failure");
+    let file = dir.join("commands.txt");
+    let later = dir.join("later-in-file.deckcraft");
+    let inline = dir.join("later-inline.deckcraft");
+    let save = dir.join("saved.deckcraft");
+    let export = dir.join("exported.png");
+    let inline_command = format!("file.saveAs={}", serde_json::json!({"path": inline.to_string_lossy()}));
+    for (command, message) in [("slide.new={", "bad JSON"), ("no.such.command", "unknown command"), ("slide.go={\"index\":999}", "slide")] {
+        let later_command = format!("file.saveAs={}", serde_json::json!({"path": later.to_string_lossy()}));
+        std::fs::write(&file, format!("# header\nslide.new\n{command}\n{later_command}\n")).unwrap();
+        std::fs::write(&save, b"keep saved file").unwrap();
+        std::fs::write(&export, b"keep exported file").unwrap();
+        let o = cli(&[
+            "run",
+            "--print",
+            "--cmd-file",
+            &file.to_string_lossy(),
+            "--cmd",
+            &inline_command,
+            "--save",
+            &save.to_string_lossy(),
+            "--export",
+            &export.to_string_lossy(),
+        ]);
+        let err = stderr(&o);
+        assert!(err.contains(&format!("{}:3:", file.display())) && err.contains(message), "{err}");
+        assert_eq!(String::from_utf8_lossy(&o.stdout).lines().count(), 1, "only the first command ran");
+        assert!(!later.exists() && !inline.exists(), "commands after the failure must not run");
+        assert_eq!(std::fs::read(&save).unwrap(), b"keep saved file");
+        assert_eq!(std::fs::read(&export).unwrap(), b"keep exported file");
+    }
+    std::fs::remove_dir_all(dir).unwrap();
+}
+
+#[test]
+fn command_file_read_errors_name_the_path_and_utf8_line() {
+    let dir = command_file_dir("read-errors");
+    let missing = dir.join("missing.txt");
+    let invalid = dir.join("invalid.txt");
+    let save = dir.join("out.deckcraft");
+    std::fs::write(&invalid, b"slide.new\n\xff\n").unwrap();
+    for file in [&missing, &dir, &invalid] {
+        let o = cli(&["run", "--cmd-file", &file.to_string_lossy(), "--save", &save.to_string_lossy()]);
+        let err = stderr(&o);
+        assert!(err.contains(&file.display().to_string()), "{err}");
+        if file == &invalid {
+            assert!(err.contains(&format!("{}:2:", invalid.display())) && err.contains("UTF-8"), "{err}");
+        }
+        assert!(!save.exists());
+    }
+    assert!(stderr(&cli(&["run", "--cmd-file"])).contains("--cmd-file needs a file"));
+    std::fs::remove_dir_all(dir).unwrap();
+}
+
+#[test]
+fn command_file_rejects_an_oversized_line_before_running_it() {
+    let dir = command_file_dir("line-limit");
+    let file = dir.join("commands.txt");
+    let command = format!("slide.new={{\"title\":\"{}\"}}", "x".repeat(16 * 1024 * 1024));
+    std::fs::write(&file, format!("{command}\nslide.new\n")).unwrap();
+
+    let o = cli(&["run", "--print", "--cmd-file", &file.to_string_lossy()]);
+    let err = stderr(&o);
+    assert!(err.contains(&format!("{}:1:", file.display())) && err.contains("command line exceeds 16777216 byte limit"), "{err}");
+    assert!(o.stdout.is_empty(), "the oversized command must not run");
+    std::fs::remove_dir_all(dir).unwrap();
+}
+
+#[test]
+fn inline_commands_keep_their_existing_syntax_and_errors() {
+    let o = cli(&["run", "--cmd", "slide.new", "--cmd", "slide.new={\"title\":\"Inline = #\"}", "--cmd", "document.inspect", "--print"]);
+    let out = stdout(&o);
+    let titles = inspected_titles(&out);
+    assert_eq!(titles.len(), 3);
+    assert_eq!(titles[2], "Inline = #");
+    assert!(stderr(&cli(&["run", "--cmd", "slide.new={"])).starts_with("deckcraft-cli: slide.new: bad JSON:"));
+    assert!(stderr(&cli(&["run", "--cmd", "no.such.command"])).contains("unknown command `no.such.command`"));
+}
+
 #[test]
 fn an_unknown_subcommand_is_named_before_the_overview() {
    for args in [vec!["frobnicate"], vec!["help", "frobnicate"], vec!["--info", "--help"]] {
@@ -74,6 +221,9 @@ fn run_help_says_what_the_ids_do_not() {
        "Shape ids are looked up on the current slide only.",
        "A command that adds a shape (shape.insert, insert.textBox, insert.table…) selects it.",
        "format.* acts on the selected text or shapes",
+        "--cmd-file FILE reads the same commands from a UTF-8 text file, one per line",
+        "commands execute in the order those options appear.",
+        "If a command fails, run stops there and saves nothing.",
    ] {
        assert!(out.contains(fact), "{fact}: {out}");
    }
@@ -0,0 +1,110 @@
+use std::fs::{self, File};
+use std::os::fd::OwnedFd;
+use std::os::unix::net::UnixStream;
+use std::path::{Path, PathBuf};
+use std::process::{Command, Output, Stdio};
+use std::time::{SystemTime, UNIX_EPOCH};
+
+struct Scratch(PathBuf);
+
+impl Scratch {
+    fn new(name: &str) -> Self {
+        let nonce = SystemTime::now().duration_since(UNIX_EPOCH).unwrap().as_nanos();
+        let path = std::env::temp_dir().join(format!("deckcraft-closed-stdout-{name}-{}-{nonce}", std::process::id()));
+        fs::create_dir(&path).unwrap();
+        Self(path)
+    }
+}
+
+impl Drop for Scratch {
+    fn drop(&mut self) {
+        let _ = fs::remove_dir_all(&self.0);
+    }
+}
+
+fn closed_stdout() -> Stdio {
+    let (writer, reader) = UnixStream::pair().unwrap();
+    drop(reader);
+    Stdio::from(OwnedFd::from(writer))
+}
+
+fn run(dir: &Path, args: &[&str], stdout: Stdio) -> Output {
+    Command::new(env!("CARGO_BIN_EXE_deckcraft-cli")).current_dir(dir).args(args).stdout(stdout).stderr(Stdio::piped()).output().unwrap()
+}
+
+#[test]
+fn broken_pipe_does_not_skip_later_commands_or_save() {
+    let dir = Scratch::new("save");
+    let out = run(
+        &dir.0,
+        &[
+            "run",
+            "--cmd",
+            r#"slide.new={"layout":"titleOnly","title":"First"}"#,
+            "--cmd",
+            r#"slide.new={"layout":"titleOnly","title":"Later"}"#,
+            "--print",
+            "--save",
+            "out.deckcraft",
+        ],
+        closed_stdout(),
+    );
+    assert!(out.status.success(), "exit {:?}: {}", out.status, String::from_utf8_lossy(&out.stderr));
+    let saved = dir.0.join("out.deckcraft");
+    assert!(saved.is_file(), "requested save was skipped");
+    let info = Command::new(env!("CARGO_BIN_EXE_deckcraft-cli")).arg("info").arg(saved).output().unwrap();
+    assert!(info.status.success(), "{}", String::from_utf8_lossy(&info.stderr));
+    let data: serde_json::Value = serde_json::from_slice(&info.stdout).unwrap();
+    let slides = data["slides"].as_array().unwrap();
+    assert!(slides.iter().any(|slide| slide["title"] == "Later"), "later command did not persist: {data}");
+}
+
+#[test]
+fn broken_pipe_does_not_hide_a_later_command_failure() {
+    let dir = Scratch::new("command-failure");
+    let out = run(
+        &dir.0,
+        &["run", "--cmd", r#"slide.new={"title":"First"}"#, "--cmd", r#"slide.go={"index":999}"#, "--print", "--save", "out.deckcraft"],
+        closed_stdout(),
+    );
+    assert!(!out.status.success(), "a later command failure returned success");
+    assert!(!dir.0.join("out.deckcraft").exists(), "failed run unexpectedly saved");
+    assert!(String::from_utf8_lossy(&out.stderr).contains("no slide 999"), "missing command failure diagnostic");
+}
+
+#[test]
+fn broken_pipe_does_not_hide_a_save_failure() {
+    let dir = Scratch::new("save-failure");
+    fs::create_dir(dir.0.join("out.deckcraft")).unwrap();
+    let out = run(&dir.0, &["run", "--cmd", r#"slide.new={"title":"First"}"#, "--print", "--save", "out.deckcraft"], closed_stdout());
+    assert!(!out.status.success(), "a failed save returned success");
+    assert!(!out.stderr.is_empty(), "missing save failure diagnostic");
+}
+
+#[test]
+fn broken_pipe_does_not_skip_later_rendered_slides() {
+    let dir = Scratch::new("render-all");
+    let baseline = run(&dir.0, &["render", "--sample", "--all", "--scale", "0.1", "normal"], Stdio::piped());
+    assert!(baseline.status.success(), "{}", String::from_utf8_lossy(&baseline.stderr));
+    let closed = run(&dir.0, &["render", "--sample", "--all", "--scale", "0.1", "closed"], closed_stdout());
+    assert!(closed.status.success(), "{}", String::from_utf8_lossy(&closed.stderr));
+    let names = |folder: &str| {
+        let mut files: Vec<_> = fs::read_dir(dir.0.join(folder)).unwrap().map(|entry| entry.unwrap().file_name()).collect();
+        files.sort();
+        files
+    };
+    let expected = names("normal");
+    assert!(expected.len() > 1, "sample must have multiple slides");
+    assert_eq!(names("closed"), expected, "rendering stopped after stdout closed");
+}
+
+#[test]
+fn other_stdout_write_errors_fail() {
+    let dir = Scratch::new("write-failure");
+    let path = dir.0.join("readonly");
+    fs::write(&path, b"").unwrap();
+    let readonly = File::open(path).unwrap();
+    let out = run(&dir.0, &["run", "--cmd", r#"slide.new={"title":"First"}"#, "--print"], Stdio::from(readonly));
+    assert!(!out.status.success(), "a non-broken stdout error returned success");
+    assert!(String::from_utf8_lossy(&out.stderr).contains("can't write to stdout"));
+}
@@ -1,4 +1,6 @@
 mod cli;
+#[cfg(unix)]
+mod closed_stdout;
 mod convert;
 mod damaged;
 // Integration tests: unwrapping and panicking on failure is fine here, unlike in shipped code (AGENTS.md).
@@ -87,6 +87,45 @@ fn mcp_automation_roots_confine_the_server() {
    let _ = std::fs::remove_dir_all(base);
 }

+#[test]
+fn mcp_accepts_multiple_read_and_write_roots() {
+    let base = tmpdir("multiple-roots");
+    let read1 = base.join("read1");
+    let read2 = base.join("read2");
+    let write1 = base.join("write1");
+    let write2 = base.join("write2");
+    for dir in [&read1, &read2, &write1, &write2] {
+        std::fs::create_dir_all(dir).unwrap();
+    }
+    let (input1, input2) = (read1.join("one.txt"), read2.join("two.txt"));
+    std::fs::write(&input1, "one").unwrap();
+    std::fs::write(&input2, "two").unwrap();
+    let (output1, output2) = (write1.join("one.deckcraft"), write2.join("two.deckcraft"));
+    let args = [
+        "--automation-read-root".to_owned(),
+        read1.to_string_lossy().into_owned(),
+        format!("--automation-read-root={}", read2.display()),
+        "--automation-write-root".to_owned(),
+        write1.to_string_lossy().into_owned(),
+        format!("--automation-write-root={}", write2.display()),
+    ];
+    let args = args.iter().map(String::as_str).collect::<Vec<_>>();
+    let calls = [
+        ("open_presentation", serde_json::json!({"path": input1})),
+        ("open_presentation", serde_json::json!({"path": input2})),
+        ("save_presentation", serde_json::json!({"path": output1})),
+        ("save_presentation", serde_json::json!({"path": output2})),
+    ];
+    let (success, stderr, replies) = mcp_session(&args, &calls);
+    assert!(success, "{stderr}");
+    for reply in &replies {
+        assert_eq!(reply["result"]["isError"], false, "{reply}");
+    }
+    assert!(output1.exists());
+    assert!(output2.exists());
+    let _ = std::fs::remove_dir_all(base);
+}
+
 #[test]
 fn mcp_automation_root_flags_are_checked_up_front() {
    let base = tmpdir("roots-args");
@@ -103,8 +142,12 @@ fn mcp_automation_root_flags_are_checked_up_front() {
    // The flags confine the in-process server, so they cannot be combined with --connect.
    fails(&["--connect", "7979", "--automation-read-root", dir], "--connect");
    fails(&["--automation-write-root", dir, "--connect", "7979"], "--connect");
-    fails(&["--automation-read-root", dir, "--automation-read-root", dir], "given twice");
-    fails(&["--automation-write-root", dir, "--automation-write-root", dir], "given twice");
+    for flag in ["--automation-read-root", "--automation-write-root"] {
+        let mut full = vec!["mcp", flag, dir, flag];
+        full.push(dir);
+        let out = run(&full);
+        assert!(out.status.success(), "{flag}: {}", String::from_utf8_lossy(&out.stderr));
+    }
    fails(&["--automation-read-root"], "needs a folder");
    fails(&["--automation-write-root", "--sample"], "needs a folder");
    fails(&["--automation-read-root", missing.to_str().unwrap()], "cannot open the automation read root");
@@ -187,7 +187,7 @@ fn main() -> eframe::Result {
    // First, so every start-up record (and the engine's panic hook, installed with the first
    // Session) is captured; see `logging`.
    let logger = logging::install();
-    if let Some(done) = craft_update::self_update::finish(&craft_update::suite::DECKCRAFT, &std::env::args_os().skip(1).collect::<Vec<_>>()) {
+    if let Some(done) = craft_update::self_update::finish(&deckcraft_ui_egui::UPDATE_APP, &std::env::args_os().skip(1).collect::<Vec<_>>()) {
        if let Err(e) = done {
            eprintln!("DeckCraft update helper failed: {e}");
            std::process::exit(1);
@@ -68,3 +68,6 @@ sync_github_name = true

 [people.SofiaAFigueredo]
 real_name = "Sofia Alves Figueredo"
+
+[people.dylanmtaylor]
+sync_github_name = true
@@ -58,6 +58,9 @@ pub struct ShowState {
    pub playing: bool,
    /// On the end screen.
    pub ended: bool,
+    /// The current slide was reached by going back (← / Backspace), so the show plays the
+    /// transition of the slide it left, in reverse, as PowerPoint does (#1531).
+    pub backward: bool,
    /// The show has entered a slide (so `slide` and `step` are meaningful and can be saved).
    active: bool,
    /// The time of the last [`ShowState::tick`] (seconds), for the triggered animations' clocks.
@@ -208,6 +211,7 @@ impl ShowState {
        self.active = true;
        self.slide = i;
        self.ended = false;
+        self.backward = false;
        // Time spent elsewhere never counts for this slide's triggered animations.
        self.last_now = None;
        let steps = ShowState::steps(pres, i);
@@ -309,6 +313,7 @@ impl ShowState {
            }
            self.step = ShowState::steps(pres, self.slide);
            self.playing = false;
+            self.backward = false;
            return ShowAction::Slide(self.slide);
        }
        // #844: undoing the automatic first step left the slide as before it appeared, and the show
@@ -337,6 +342,7 @@ impl ShowState {
                    self.step = ShowState::steps(pres, i);
                    self.playing = false;
                }
+                self.backward = true;
                ShowAction::Slide(i)
            }
            None => ShowAction::None,
@@ -763,6 +763,26 @@ fn show_skips_hidden_slides() {
    assert_eq!(s.goto(&p, 99), ShowAction::None);
 }

+#[test]
+fn show_remembers_a_slide_was_reached_by_going_back() {
+    // #1531: the UI plays the left slide's transition reversed only for Back.
+    let p = pres(3);
+    let mut s = ShowState::new(&p);
+    assert_eq!(s.next(&p), ShowAction::Slide(1));
+    assert!(!s.backward);
+    assert_eq!(s.prev(&p), ShowAction::Slide(0));
+    assert!(s.backward);
+    assert_eq!(s.next(&p), ShowAction::Slide(1));
+    assert!(!s.backward);
+    assert_eq!(s.goto(&p, 0), ShowAction::Slide(0));
+    assert!(!s.backward, "a jump is not Back");
+    // Back from the end screen shows the last slide again, without a transition to reverse.
+    assert_eq!(s.goto(&p, 2), ShowAction::Slide(2));
+    assert_eq!(s.next(&p), ShowAction::End);
+    assert_eq!(s.prev(&p), ShowAction::Slide(2));
+    assert!(!s.backward);
+}
+
 #[test]
 fn show_loops() {
    let mut p = pres(3);
@@ -515,8 +515,18 @@ pub(crate) fn current_shapes<'a>(doc: &'a deckcraft_model::Presentation, sel: &c
    }
 }

-pub(crate) fn current_names(doc: &deckcraft_model::Presentation, sel: &crate::Selection) -> std::collections::HashSet<String> {
-    current_shapes(doc, sel).map(|v| v.iter().map(|s| s.name.clone()).collect()).unwrap_or_default()
+/// Every name on the slide, group members included, and the number of shapes (which exceeds the
+/// number of names when two shapes share one).
+pub(crate) fn current_names(doc: &deckcraft_model::Presentation, sel: &crate::Selection) -> (std::collections::HashSet<String>, usize) {
+    let mut names = std::collections::HashSet::new();
+    let mut count = 0;
+    if let Some(v) = current_shapes(doc, sel) {
+        deckcraft_model::walk(v, &mut |sh, _| {
+            names.insert(sh.name.clone());
+            count += 1;
+        });
+    }
+    (names, count)
 }

 /// The command palette runs a command with `{}`. True when the params doc names a value that
@@ -339,7 +339,10 @@ fn options(s: &mut Session, p: &Value) -> Result<Value> {
 }

 fn clear(s: &mut Session, p: &Value) -> Result<Value> {
-    let i = usize_param(p, "index").unwrap_or(s.doc()?.selection.slide);
+    let i = match opt_usize_param(p, "index", "animation.clear")? {
+        Some(i) => i,
+        None => s.doc()?.selection.slide,
+    };
    s.edit(|doc, _| {
        if let Some(sl) = doc.slides.get_mut(i) {
            Arc::make_mut(sl).animations.clear();
@@ -434,6 +437,19 @@ mod tests {

    use super::*;

+    #[test]
+    fn clear_rejects_invalid_index() {
+        let mut s = Session::with_new();
+        let r = s.execute("shape.insert", &json!({"preset": "rect", "rect": [10.0, 10.0, 100.0, 100.0]})).unwrap();
+        let id = r.get("id").unwrap().as_u64().unwrap();
+        s.execute("animation.add", &json!({"effect": "fade", "class": "entrance", "ids": [id]})).unwrap();
+        for bad_index in [json!(-1), json!(1.5)] {
+            assert!(s.execute("animation.clear", &json!({"index": bad_index})).is_err());
+            let left = s.execute("animation.get", &json!({})).unwrap();
+            assert_eq!(left.as_array().unwrap().len(), 1);
+        }
+    }
+
    #[test]
    fn animation_painter_copies_effects_between_shapes() {
        let mut s = Session::with_new();
@@ -229,6 +229,98 @@ fn group(s: &mut Session, p: &Value) -> Result<Value> {
    })
 }

+/// After an edit: refit every group whose children's geometry changed to the union of its
+/// children (PowerPoint keeps a group's box on its children, so moving one child grows or
+/// shrinks the group). The children keep their place on the slide: the group's box and its child
+/// space change together. `old` is the presentation before the edit; only slides the edit
+/// touched are looked at, and a group whose own box changed (it was moved or resized) is left to
+/// that edit.
+pub(crate) fn refit_groups(old: &deckcraft_model::Presentation, new: &mut deckcraft_model::Presentation) {
+    // Each slide, master and layout is compared with its own earlier state, found by id: a move,
+    // insertion or deletion shifts the indices, and shape ids repeat across slides.
+    let old_slides: std::collections::HashMap<_, _> = old.slides.iter().map(|s| (s.id, s)).collect();
+    for slide in new.slides.iter_mut() {
+        let Some(before) = old_slides.get(&slide.id) else { continue };
+        if std::sync::Arc::ptr_eq(before, slide) {
+            continue;
+        }
+        let shapes = &mut std::sync::Arc::make_mut(slide).shapes;
+        refit_list(Some(&before.shapes), shapes, 0);
+    }
+    // A child edited in Slide Master, layout, notes or handout view refits its group there too.
+    for master in new.masters.iter_mut() {
+        if let Some(before) = old.masters.iter().find(|m| m.id == master.id)
+            && !std::sync::Arc::ptr_eq(before, master)
+        {
+            refit_master(before, std::sync::Arc::make_mut(master));
+        }
+    }
+    for (before, after) in [(old.notes_master.as_ref(), new.notes_master.as_mut()), (old.handout_master.as_ref(), new.handout_master.as_mut())] {
+        if let (Some(before), Some(after)) = (before, after)
+            && !std::sync::Arc::ptr_eq(before, after)
+        {
+            refit_master(before, std::sync::Arc::make_mut(after));
+        }
+    }
+}
+
+fn refit_master(old: &deckcraft_model::Master, new: &mut deckcraft_model::Master) {
+    refit_list(Some(&old.shapes), &mut new.shapes, 0);
+    for layout in new.layouts.iter_mut() {
+        refit_list(old.layouts.iter().find(|l| l.id == layout.id).map(|l| &l.shapes), &mut layout.shapes, 0);
+    }
+}
+
+fn refit_list(old: Option<&Vec<Shape>>, list: &mut [Shape], depth: usize) {
+    // Most edits touch a slide without groups: nothing to refit, and no per-shape lookup. Nesting
+    // is bounded like the model's other walks.
+    if depth > 64 || !list.iter().any(|sh| matches!(sh.kind, ShapeKind::Group { .. })) {
+        return;
+    }
+    let by_id: std::collections::HashMap<ShapeId, &Shape> = old.map(|o| o.iter().map(|x| (x.id, x)).collect()).unwrap_or_default();
+    for sh in list.iter_mut() {
+        let before = by_id.get(&sh.id).copied();
+        let old_children = before.and_then(|b| match &b.kind {
+            ShapeKind::Group { children, .. } => Some(children),
+            _ => None,
+        });
+        let own_before = before.map(|b| {
+            (
+                b.xfrm,
+                match &b.kind {
+                    ShapeKind::Group { child, .. } => Some(*child),
+                    _ => None,
+                },
+            )
+        });
+        let smart = sh.diagram.is_some();
+        let ShapeKind::Group { children, child } = &mut sh.kind else { continue };
+        refit_list(old_children, children, depth + 1);
+        if smart {
+            // A SmartArt graphic's box is its own; its shapes are regenerated inside it.
+            continue;
+        }
+        let (Some(old_children), Some((old_x, old_child))) = (old_children, own_before) else { continue };
+        if old_x != sh.xfrm || old_child != Some(*child) || children.is_empty() {
+            continue;
+        }
+        let same = old_children.len() == children.len() && old_children.iter().zip(children.iter()).all(|(a, b)| a.id == b.id && a.xfrm == b.xfrm);
+        if same {
+            continue;
+        }
+        let Some(group) = sh.xfrm else { continue };
+        let xs: Vec<Xfrm> = children.iter().filter_map(|c| c.xfrm).collect();
+        let Some(u) = union_bounds(&xs) else { continue };
+        if ![u.x0, u.y0, u.x1, u.y1].iter().all(|v| v.is_finite()) {
+            continue;
+        }
+        let union = Xfrm::new(u.x0, u.y0, u.width(), u.height());
+        let placed = child_to_parent(&group, child, &union);
+        sh.xfrm = Some(Xfrm { x: placed.x, y: placed.y, w: placed.w, h: placed.h, rot: group.rot, flip_h: group.flip_h, flip_v: group.flip_v });
+        *child = union;
+    }
+}
+
 /// A child's xfrm in slide space, given its group.
 pub fn child_to_parent(group: &Xfrm, ch: &Xfrm, c: &Xfrm) -> Xfrm {
    let sx = if ch.w.abs() > 1e-9 { group.w / ch.w } else { 1.0 };
@@ -321,7 +321,7 @@ fn paste(s: &mut Session, p: &Value) -> Result<Value> {
            let mut shapes = clip.shapes.clone();
            reid("edit.paste", doc, &mut shapes)?;
            crate::media_refs::visit_mut::shapes(&mut shapes, &mut remap_media(&media));
-            let mut taken = super::current_names(doc, sel);
+            let (mut taken, mut count) = super::current_names(doc, sel);
            for sh in &mut shapes {
                // Only a name already on the slide is changed (two shapes with one name are what the
                // issue is about); otherwise it stays, as Morph pairs shapes across slides by name.
@@ -330,9 +330,12 @@ fn paste(s: &mut Session, p: &Value) -> Result<Value> {
                    && !n.is_empty()
                    && n.bytes().all(|b| b.is_ascii_digit())
                {
-                    sh.name = super::insert::first_free_name(base, &taken);
+                    sh.name = super::insert::first_free_name(base, &taken, count);
                }
-                taken.insert(sh.name.clone());
+                deckcraft_model::walk(std::slice::from_ref(sh), &mut |m, _| {
+                    taken.insert(m.name.clone());
+                    count += 1;
+                });
                if let Some(x) = sh.xfrm.as_mut() {
                    x.x += off;
                    x.y += off;
@@ -508,6 +511,19 @@ fn paste_text(s: &mut Session, p: &Value) -> Result<Value> {
    paste_plain(s, &t)
 }

+/// Duplicate gives a copy the next automatic name ("Rectangle 4" after "Rectangle 1"), as
+/// PowerPoint does, and keeps a name the user chose. PowerPoint tells the two apart by comparing
+/// the number with the shape's id; ids here are numbered across the deck, so any "{kind} {n}"
+/// counts as automatic.
+fn rename_automatic(sh: &mut Shape, taken: &mut std::collections::HashSet<String>, count: usize) {
+    let base = if sh.is_group() { "Group".to_string() } else { super::insert::auto_name_base(sh) };
+    let n = sh.name.strip_prefix(&base).and_then(|r| r.strip_prefix(' '));
+    if n.is_some_and(|n| !n.is_empty() && n.bytes().all(|b| b.is_ascii_digit())) {
+        sh.name = super::insert::first_free_name(&base, taken, count);
+        taken.insert(sh.name.clone());
+    }
+}
+
 fn duplicate(s: &mut Session, p: &Value) -> Result<Value> {
    let ids = targets(s, p)?;
    let off = s.prefs.duplicate_offset;
@@ -532,6 +548,17 @@ fn duplicate(s: &mut Session, p: &Value) -> Result<Value> {
            })
            .unwrap_or((off, off));
        reid("edit.duplicate", doc, &mut copies)?;
+        // Every name on the slide, group members included, so a copy never repeats one.
+        let mut taken = std::collections::HashSet::new();
+        let mut count = 0;
+        deckcraft_model::walk(&list, &mut |sh, _| {
+            taken.insert(sh.name.clone());
+            count += 1;
+        });
+        walk_mut(&mut copies, &mut |c| {
+            rename_automatic(c, &mut taken, count);
+            count += 1;
+        });
        for (c, b) in copies.iter_mut().zip(boxes) {
            let mut x = b;
            x.x += dx;
@@ -540,9 +567,6 @@ fn duplicate(s: &mut Session, p: &Value) -> Result<Value> {
            if sel.target == crate::Target::Slides {
                c.ph = None;
            }
-            if !c.name.is_empty() {
-                c.name = format!("{} copy", c.name.trim_end_matches(" copy"));
-            }
        }
        let new_ids: Vec<ShapeId> = copies.iter().map(|c| c.id).collect();
        let shapes = crate::shapes_mut(doc, sel).ok_or_else(|| bad("edit.duplicate", "no slide"))?;
@@ -7,7 +7,7 @@ use deckcraft_media::MediaInfo;
 use deckcraft_model::{MediaId, MediaItem, Presentation, Shape, ShapeKind, defaults};
 use serde_json::{Value, json};

-use super::{CommandSpec, always, bad, base64_decode, base64_encode, bool_or, cmd, f64_or, has_doc, ok, str_param, usize_param};
+use super::{CommandSpec, always, bad, base64_decode, base64_encode, bool_or, cmd, f64_or, has_doc, ok, opt_usize_param, str_param, usize_param};
 use crate::{DocState, EngineError, Result, Session};

 pub fn specs() -> Vec<CommandSpec> {
@@ -395,6 +395,10 @@ pub fn parse_slide_range(text: &str, count: usize) -> Result<Vec<usize>> {
            Some((a, b)) => (a.trim(), b.trim()),
            None => (part, part),
        };
+        let digits = |s: &str| !s.is_empty() && s.bytes().all(|c| c.is_ascii_digit());
+        if !digits(a) || !digits(b) {
+            return Err(invalid());
+        }
        let (a, b) = (a.parse::<usize>().map_err(|_| invalid())?, b.parse::<usize>().map_err(|_| invalid())?);
        let (lo, hi) = (a.min(b), a.max(b));
        if lo == 0 || hi > count {
@@ -536,7 +540,7 @@ fn picture_bytes(img: &deckcraft_render::Image, format: &str, scale: f64) -> Vec

 fn render(s: &mut Session, p: &Value) -> Result<Value> {
    let st = s.doc()?;
-    let i = usize_param(p, "slide").unwrap_or(st.selection.slide);
+    let i = opt_usize_param(p, "slide", "file.render")?.unwrap_or(st.selection.slide);
    if i >= st.doc.slides.len() {
        return Err(bad("file.render", format!("no slide {i}")));
    }
@@ -547,7 +551,7 @@ fn render(s: &mut Session, p: &Value) -> Result<Value> {
 /// The colour the slide is drawn with at one point: what the Eyedropper takes.
 fn color_at(s: &mut Session, p: &Value) -> Result<Value> {
    let st = s.doc()?;
-    let i = usize_param(p, "slide").unwrap_or(st.selection.slide);
+    let i = opt_usize_param(p, "slide", "slide.colorAt")?.unwrap_or(st.selection.slide);
    if i >= st.doc.slides.len() {
        return Err(bad("slide.colorAt", format!("no slide {i}")));
    }
@@ -578,7 +582,7 @@ fn export(s: &mut Session, p: &Value) -> Result<Value> {
    }
    match format.as_str() {
        "png" | "jpeg" | "jpg" => {
-            let slides: Vec<usize> = match usize_param(p, "slide") {
+            let slides: Vec<usize> = match opt_usize_param(p, "slide", "file.export")? {
                Some(i) => vec![i],
                None if bool_or(p, "all", false) => (0..st.doc.slides.len()).collect(),
                None => vec![st.selection.slide],
@@ -763,7 +767,14 @@ mod color_at_tests;
 mod tests {
    #![allow(clippy::unwrap_used, clippy::expect_used)]

-    use super::write_file;
+    use super::{parse_slide_range, write_file};
+
+    #[test]
+    fn slide_range_rejects_plus_sign() {
+        assert!(parse_slide_range("+2", 3).is_err());
+        assert!(parse_slide_range("+1-+3", 3).is_err());
+        assert_eq!(parse_slide_range("1-3", 3).unwrap(), vec![0, 1, 2]);
+    }

    fn scratch(name: &str) -> std::path::PathBuf {
        let dir = std::env::temp_dir().join(format!("deckcraft-write-file-{}-{name}", std::process::id()));
@@ -179,7 +179,7 @@ pub fn specs() -> Vec<CommandSpec> {
            "Numbering",
            ["Home", "Paragraph"],
            None,
-            "{on?: bool, scheme?: arabicPeriod|arabicParenR|romanUcPeriod|romanLcPeriod|alphaUcPeriod|alphaLcParenR|alphaLcPeriod, start?: n, color?, size?: % of text}",
+            "{on?: bool, scheme?: arabicPeriod|arabicParenR|romanUcPeriod|romanLcPeriod|alphaUcPeriod|alphaLcParenR|alphaLcPeriod, start?: n (a numbered paragraph whose start differs from that of the last numbered paragraph at its level begins a new run of numbers at n, as PowerPoint's Start at does), color?, size?: % of text}",
            has_text_or_shapes,
            numbering
        ),
@@ -8,7 +8,7 @@ use deckcraft_model::resolve::{self, Ctx};
 use deckcraft_model::{Fill, Presentation, Rgba, Shape, ShapeKind};
 use serde_json::{Value, json};

-use super::{CommandSpec, bad, cmd, has_slide, str_param, usize_param, xfrm_of};
+use super::{CommandSpec, bad, cmd, has_slide, opt_usize_param, str_param, xfrm_of};
 use crate::{Result, Selection, Session};

 pub fn specs() -> Vec<CommandSpec> {
@@ -245,13 +245,13 @@ pub fn apply_idea(doc: &mut Presentation, sel: &Selection, index: usize, id: &st

 fn ideas_cmd(s: &mut Session, p: &Value) -> Result<Value> {
    let st = s.doc()?;
-    let i = usize_param(p, "slide").unwrap_or(st.selection.slide);
+    let i = opt_usize_param(p, "slide", "design.ideas")?.unwrap_or(st.selection.slide);
    Ok(json!(ideas_for(&st.doc, i).iter().map(|(id, label)| json!({"id": id, "label": label})).collect::<Vec<_>>()))
 }

 fn apply_cmd(s: &mut Session, p: &Value) -> Result<Value> {
    let id = str_param(p, "id").ok_or_else(|| bad("design.applyIdea", "missing `id`"))?.to_string();
-    let slide = usize_param(p, "slide");
+    let slide = opt_usize_param(p, "slide", "design.applyIdea")?;
    s.edit(|doc, sel| {
        let i = slide.unwrap_or(sel.slide);
        apply_idea(doc, sel, i, &id)?;
@@ -372,6 +372,19 @@ mod tests {
        assert!(s.execute("design.applyIdea", &json!({"id": "nope"})).is_err());
    }

+    #[test]
+    fn an_invalid_slide_index_is_refused_not_replaced_by_the_selection() {
+        let mut s = deck(false);
+        let before = s.doc().unwrap().doc.clone();
+        for bad_slide in [json!(-1), json!(1.5), json!("0")] {
+            assert!(s.execute("design.applyIdea", &json!({"id": "centred", "slide": bad_slide})).is_err(), "{bad_slide}");
+            assert!(s.execute("design.ideas", &json!({"slide": bad_slide})).is_err(), "{bad_slide}");
+        }
+        assert!(Arc::ptr_eq(&before, &s.doc().unwrap().doc) || *before == *s.doc().unwrap().doc);
+        assert!(s.execute("design.applyIdea", &json!({"id": "centred", "slide": 0})).is_ok());
+        assert!(s.execute("design.ideas", &json!({})).is_ok());
+    }
+
    #[test]
    fn switching_from_full_bleed_removes_the_title_band() {
        let mut s = deck(true);
@@ -98,7 +98,7 @@ pub fn specs() -> Vec<CommandSpec> {
            "Date & Time",
            ["Insert", "Text"],
            None,
-            "{format?: datetime1..datetime13, update?: bool, language?: en-US|en-GB|fr-FR|ja-JP|sv-SE} — no keys opens the dialog",
+            "{format?: datetime1..datetime13, update?: bool, language?: en-US|en-GB|fr-FR|ja-JP|sv-SE} — no keys opens the dialog; in the Handout or Notes Master view it fills the selected date placeholder (else the master's own) and answers where: \"master\"",
            has_slide,
            date_time
        ),
@@ -187,9 +187,10 @@ pub(crate) fn auto_name_base(shape: &Shape) -> String {
 }

 /// "{base} n" with the first `n` from the shape count + 1 that no shape on the slide already uses,
-/// so a gap left by a deleted shape never makes a second shape with the same name.
-pub(crate) fn first_free_name(base: &str, taken: &std::collections::HashSet<String>) -> String {
-    (taken.len() + 1..).map(|n| format!("{base} {n}")).find(|c| !taken.contains(c)).unwrap_or_default()
+/// so a gap left by a deleted shape never makes a second shape with the same name. `count` is the
+/// number of shapes, which exceeds the number of names when two shapes share one.
+pub(crate) fn first_free_name(base: &str, taken: &std::collections::HashSet<String>, count: usize) -> String {
+    (count + 1..).map(|n| format!("{base} {n}")).find(|c| !taken.contains(c)).unwrap_or_default()
 }

 pub(crate) fn add_shape(s: &mut Session, cmd: &str, mut shape: Shape, select: bool) -> Result<ShapeId> {
@@ -197,8 +198,8 @@ pub(crate) fn add_shape(s: &mut Session, cmd: &str, mut shape: Shape, select: bo
        shape.id = ShapeId(doc.alloc_id().ok_or_else(|| bad(cmd, NO_ID_SPACE))?);
        if shape.name.is_empty() {
            let base = auto_name_base(&shape);
-            let taken = super::current_names(doc, sel);
-            shape.name = first_free_name(&base, &taken);
+            let (taken, count) = super::current_names(doc, sel);
+            shape.name = first_free_name(&base, &taken, count);
        }
        let id = shape.id;
        let list = crate::shapes_mut(doc, sel).ok_or_else(|| bad("insert", "no slide"))?;
@@ -449,6 +450,17 @@ mod tests {
        assert_eq!(undo(&s), before + 1);
    }

+    #[test]
+    fn a_long_british_date_puts_the_day_first() {
+        let mut s = session();
+        edit_title(&mut s);
+        let v = s.execute("insert.dateTime", &json!({"format": "datetime4", "update": false, "language": "en-GB"})).unwrap();
+        let text = v["text"].as_str().unwrap().to_string();
+        assert!(text.chars().next().is_some_and(|c| c.is_ascii_digit()) && !text.contains(','), "{text}");
+        let v = s.execute("insert.dateTime", &json!({"format": "datetime4", "update": false, "language": "en-US"})).unwrap();
+        assert!(v["text"].as_str().is_some_and(|t| t.contains(',')), "{v}");
+    }
+
    #[test]
    fn a_named_format_in_french_and_a_bad_value_change_nothing() {
        let mut s = session();
@@ -473,6 +485,70 @@ mod tests {
        }
    }

+    /// ZZ1: in the handout and notes master views the date goes into the master's date placeholder
+    /// (not the current slide), so the exported handout and notes pages show it.
+    #[test]
+    fn on_a_page_master_the_date_fills_its_date_placeholder() {
+        for view in ["view.handoutMaster", "view.notesMaster"] {
+            let mut s = session();
+            s.execute(view, &json!({})).unwrap();
+            let (id, master) = {
+                let st = s.doc().unwrap();
+                let m = crate::page_master(&st.doc, st.selection.target).unwrap().clone();
+                (m.shapes.iter().find(|x| x.ph_type() == Some(deckcraft_model::PhType::Date)).unwrap().id.0, m)
+            };
+            assert!(master.shapes.iter().find(|x| x.id.0 == id).and_then(|x| x.text.as_ref()).is_none_or(|t| t.text().is_empty()));
+            s.execute("edit.select", &json!({"ids": [id]})).unwrap();
+            let v = s.execute("insert.dateTime", &json!({"format": "datetime10", "update": true})).unwrap();
+            assert_eq!(v["where"], "master", "{view}: {v}");
+            assert!(date_run(&s).is_none(), "the slide keeps no date");
+            let st = s.doc().unwrap();
+            let m = crate::page_master(&st.doc, st.selection.target).unwrap();
+            let run = m
+                .shapes
+                .iter()
+                .find(|x| x.id.0 == id)
+                .and_then(|x| x.text.as_ref())
+                .and_then(|t| t.paragraphs.first())
+                .and_then(|p| p.runs.first())
+                .cloned()
+                .unwrap();
+            assert!(matches!(run.kind, RunKind::Field { ref field } if field == "datetime10"), "{view}: {run:?}");
+            let placed = deckcraft_render::place_master_texts(&st.doc, m, 1);
+            assert!(placed.iter().any(|p| p.body.text() == run.text && run.text.contains(':')), "{view}: the page shows the date");
+            s.execute("edit.undo", &json!({})).unwrap();
+            let st = s.doc().unwrap();
+            let m = crate::page_master(&st.doc, st.selection.target).unwrap();
+            assert!(m.shapes.iter().find(|x| x.id.0 == id).and_then(|x| x.text.as_ref()).is_none_or(|t| t.text().is_empty()), "one undo");
+            // A fixed date in a placeholder whose run is en-GB reads day first, and the answer
+            // reports the text that was written, not the en-US sample.
+            s.execute("insert.dateTime", &json!({"format": "datetime1", "update": false, "language": "en-GB"})).unwrap();
+            let v = s.execute("insert.dateTime", &json!({"format": "datetime1", "update": false})).unwrap();
+            let st = s.doc().unwrap();
+            let m = crate::page_master(&st.doc, st.selection.target).unwrap();
+            let run = m
+                .shapes
+                .iter()
+                .find(|x| x.id.0 == id)
+                .and_then(|x| x.text.as_ref())
+                .and_then(|t| t.paragraphs.first())
+                .and_then(|p| p.runs.first())
+                .cloned()
+                .unwrap();
+            assert_eq!(run.props.lang.as_deref(), Some("en-GB"), "{view}: {run:?}");
+            assert_eq!(v["text"].as_str(), Some(run.text.as_str()), "{view}: the answer reports the written text: {v}");
+            let now = deckcraft_text::datetime::DateTime::now_local().unwrap();
+            let gb = deckcraft_text::datetime::field_text("datetime1", Some("en-GB"), now);
+            assert_eq!(Some(run.text.as_str()), gb.as_deref(), "{view}: the date in en-GB order (dd/mm/yyyy)");
+            // No date placeholder: refused, nothing changed.
+            let key = if view == "view.handoutMaster" { "handout.placeholders" } else { "notes.placeholders" };
+            s.execute(key, &json!({"date": false})).unwrap();
+            let rev = s.doc().unwrap().revision;
+            assert!(s.execute("insert.dateTime", &json!({"format": "datetime1"})).is_err());
+            assert_eq!(s.doc().unwrap().revision, rev);
+        }
+    }
+
    #[test]
    fn without_a_caret_the_date_lands_on_this_slide_only() {
        let mut s = session();
@@ -152,6 +152,11 @@ fn apply_date(s: &mut Session, o: &DateOpts) -> Result<Value> {
        }
        return Ok(json!({"where": "caret", "format": o.format, "update": o.update, "text": o.sample}));
    }
+    // Handout or Notes Master view: the master's date placeholder (the selected one, else the
+    // master's own), which every handout or notes page then shows.
+    if s.doc()?.selection.target.is_page_master() {
+        return write_master_date(s, o);
+    }
    // Not editing: the slide's date placeholder (this slide only). A layout with no date
    // placeholder gets a text box instead, so the chosen format is still inserted.
    s.execute("design.headerFooter", &json!({"date": true, "all": false}))?;
@@ -161,6 +166,49 @@ fn apply_date(s: &mut Session, o: &DateOpts) -> Result<Value> {
    Ok(json!({"where": "footer", "format": o.format, "update": o.update, "text": o.sample}))
 }

+/// Put the date in the date placeholder of the handout or notes master being edited.
+fn write_master_date(s: &mut Session, o: &DateOpts) -> Result<Value> {
+    let (format, sample, lang, update) = (o.format.clone(), o.sample.clone(), o.lang.clone(), o.update);
+    let has_date = {
+        let st = s.doc()?;
+        crate::page_master(&st.doc, st.selection.target).is_some_and(|m| m.shapes.iter().any(|x| x.ph_type() == Some(deckcraft_model::PhType::Date)))
+    };
+    if !has_date {
+        return Err(bad(
+            "insert.dateTime",
+            "this master has no date placeholder; show it with handout.placeholders or notes.placeholders {date: true}",
+        ));
+    }
+    // The text the master holds afterwards, which the answer reports (it can differ from the
+    // caller's sample when the placeholder's own language formats a fixed date).
+    let mut written = o.sample.clone();
+    s.edit(|doc, sel| {
+        let Some(m) = crate::page_master_mut(doc, sel.target) else { return Ok(false) };
+        let m = std::sync::Arc::make_mut(m);
+        let date = |x: &deckcraft_model::Shape| x.ph_type() == Some(deckcraft_model::PhType::Date);
+        let chosen = sel.shapes.iter().find_map(|id| m.shapes.iter().position(|x| x.id == *id && date(x)));
+        let Some(i) = chosen.or_else(|| m.shapes.iter().position(date)) else { return Ok(false) };
+        let Some(sh) = m.shapes.get_mut(i) else { return Ok(false) };
+        let mut props = sh.text.as_ref().and_then(|t| t.paragraphs.first()).and_then(|p| p.runs.first()).map(|r| r.props.clone()).unwrap_or_default();
+        // A fixed date reads in the placeholder's own language when the caller named none.
+        let text = match (&lang, &props.lang) {
+            (None, Some(l)) if !update => date_sample(&format, Some(l)).unwrap_or_else(|_| sample.clone()),
+            _ => sample.clone(),
+        };
+        if let Some(lang) = lang {
+            props.lang = Some(lang);
+        }
+        let kind = if update { RunKind::Field { field: format } } else { RunKind::Text };
+        let body = sh.text.clone().unwrap_or_default();
+        let mut para = body.paragraphs.first().cloned().unwrap_or_default();
+        written.clone_from(&text);
+        para.runs = vec![deckcraft_model::Run { text, props, kind }];
+        sh.text = Some(TextBody { paragraphs: vec![para], ..body });
+        Ok(true)
+    })?;
+    Ok(json!({"where": "master", "format": o.format, "update": o.update, "text": written}))
+}
+
 /// Point the current slide's date placeholder at this format (a field, or the sample as plain text).
 fn write_date_placeholder(s: &mut Session, o: &DateOpts) -> Result<bool> {
    let format = o.format.clone();
@@ -58,9 +58,17 @@ pub fn specs() -> Vec<CommandSpec> {
            has_text,
            insert_synonym
        ),
-        cmd!(noundo "review.compare", "Compare", ["Review", "Compare"], None, "{path} | {name, data: base64} — compare with a revised copy → {name, changes}", has_doc, compare),
-        cmd!(query "review.revisions", "Revisions", [], None, "{} → {name, changes: [{kind: inserted|deleted|changed, slide, revised, details}]}", has_doc, revisions),
-        cmd!("review.accept", "Accept Revision", ["Review", "Compare"], None, "{index} | {all: true}", comparing, accept),
+        cmd!(noundo "review.compare", "Compare", ["Review", "Compare"], None, "{path} | {name, data: base64} — compare the open deck with another file → {name, changes: [{kind, slide, number, onlyIn?, revised, details}]}; each change is described from the open deck: `onlyIn: \"deck\"` is in the deck and not in the file, `onlyIn: \"file\"` is in the file and not in the deck, `changed` is in both and differs; `slide` is 0-based, `number` the editor's slide number; review.accept takes the FILE's side, so it deletes what is only in the deck (Accept All keeps the deck's last remaining slide rather than deleting it)", has_doc, compare),
+        cmd!(query "review.revisions", "Revisions", [], None, "{} → {name, changes: [{kind: inserted|deleted|changed, slide (0-based), number (editor's), onlyIn?: deck|file, revised, details}]}; `onlyIn: deck` = only in the open deck, `file` = only in the compared file; accepting takes the file's side", has_doc, revisions),
+        cmd!(
+            "review.accept",
+            "Accept Revision",
+            ["Review", "Compare"],
+            None,
+            "{index} | {all: true} — accept the compared file's side of a change (or all): what is only in the file is added, what is only in the open deck is deleted (all: true leaves the deck's last remaining slide in place), a changed slide becomes the file's",
+            comparing,
+            accept
+        ),
        cmd!(
            noundo "review.reject",
            "Reject Revision",
@@ -264,19 +272,31 @@ fn accessibility(s: &mut Session, _p: &Value) -> Result<Value> {
                _ => None,
            };
            if let Some(bg) = bg {
-                for sh in &sl.shapes {
-                    let Some(t) = &sh.text else { continue };
-                    let Some(para) = t.paragraphs.iter().find(|p| !p.is_empty()) else { continue };
-                    let rp = deckcraft_model::resolve::run(&ctx, sh, para, &para.runs.first().map(|r| r.props.clone()).unwrap_or_default());
+                deckcraft_model::walk(&sl.shapes, &mut |sh, _| {
+                    let Some(t) = &sh.text else { return };
                    let (fill, _) = deckcraft_model::resolve::fill(&ctx, sh);
                    if fill.as_ref().is_some_and(|f| !f.is_none()) {
-                        continue;
+                        return;
                    }
-                    let fg = deckcraft_model::resolve::text_color(&ctx, &rp);
-                    if fg.contrast(bg) < 3.0 {
-                        out.push(json!({"slide": i, "shape": sh.id, "name": sh.name, "issue": format!("Hard-to-read text contrast ({:.1}:1)", fg.contrast(bg))}));
+                    let low = t
+                        .paragraphs
+                        .iter()
+                        .flat_map(|para| {
+                            // A line break or blank run shows no glyphs, so its colour can't be hard to read.
+                            para.runs.iter().filter(|run| run.kind != deckcraft_model::text::RunKind::Break && !run.text.trim().is_empty()).map(
+                                |run| {
+                                    let rp = deckcraft_model::resolve::run(&ctx, sh, para, &run.props);
+                                    deckcraft_model::resolve::text_color(&ctx, &rp).contrast(bg)
+                                },
+                            )
+                        })
+                        .find(|contrast| *contrast < 3.0);
+                    if let Some(contrast) = low {
+                        out.push(
+                            json!({"slide": i, "shape": sh.id, "name": sh.name, "issue": format!("Hard-to-read text contrast ({contrast:.1}:1)")}),
+                        );
                    }
-                }
+                });
            }
        }
    }
@@ -860,3 +880,81 @@ mod spelling_change_range_tests {
        assert!(matches!(err, EngineError::BadParams { .. }), "{err:?}");
    }
 }
+
+#[cfg(test)]
+mod accessibility_contrast_tests {
+    use super::*;
+    use deckcraft_model::text::{Paragraph, Run, RunKind, RunProps};
+    use deckcraft_model::{ColorRef, Fill, Rgba, Shape, ShapeId, ShapeKind, TextBody};
+    use serde_json::json;
+
+    fn run(text: &str, color: Rgba) -> Run {
+        Run::with(text, RunProps { fill: Some(Fill::solid(ColorRef::rgb(color))), ..Default::default() })
+    }
+
+    fn text_shape(id: u32, name: &str, paragraphs: Vec<Paragraph>) -> Shape {
+        Shape { id: ShapeId(id), name: name.into(), text: Some(TextBody { paragraphs, ..Default::default() }), ..Default::default() }
+    }
+
+    #[test]
+    fn contrast_checks_mixed_runs_later_paragraphs_and_group_descendants_once() {
+        let mut s = Session::with_new();
+        s.edit(|doc, _| {
+            let black = Rgba::BLACK;
+            let white = Rgba::WHITE;
+            let mixed = Paragraph { runs: vec![run("visible", black), run("hidden", white)], ..Default::default() };
+            let later = vec![
+                Paragraph { runs: vec![run("visible", black)], ..Default::default() },
+                Paragraph { runs: vec![run("hidden", white)], ..Default::default() },
+            ];
+            let child = text_shape(5, "nested text", vec![Paragraph { runs: vec![run("hidden", white)], ..Default::default() }]);
+            let group = Shape {
+                id: ShapeId(4),
+                name: "group".into(),
+                descr: "group of text".into(),
+                kind: ShapeKind::Group {
+                    children: vec![Shape {
+                        id: ShapeId(7),
+                        name: "nested group".into(),
+                        descr: "nested group of text".into(),
+                        kind: ShapeKind::Group { children: vec![child], child: Default::default() },
+                        ..Default::default()
+                    }],
+                    child: Default::default(),
+                },
+                ..Default::default()
+            };
+            let sl = Arc::make_mut(doc.slides.get_mut(0).ok_or_else(|| bad("test", "no slide"))?);
+            sl.shapes = vec![
+                text_shape(2, "mixed", vec![mixed]),
+                text_shape(3, "later paragraph", later),
+                group,
+                text_shape(6, "black control", vec![Paragraph { runs: vec![run("visible", black)], ..Default::default() }]),
+                text_shape(
+                    8,
+                    "invisible white runs",
+                    vec![Paragraph {
+                        runs: vec![run("visible", black), Run { kind: RunKind::Break, ..run("\n", white) }, run("  ", white), run("visible", black)],
+                        ..Default::default()
+                    }],
+                ),
+            ];
+            Ok(())
+        })
+        .unwrap();
+
+        let issues = s.execute("review.accessibility", &json!({})).unwrap();
+        let contrasts: Vec<_> = issues
+            .as_array()
+            .unwrap()
+            .iter()
+            .filter(|issue| issue["issue"].as_str().unwrap_or("").starts_with("Hard-to-read text contrast"))
+            .collect();
+        assert_eq!(contrasts.len(), 3, "{issues}");
+        for id in [2, 3, 5] {
+            assert!(contrasts.iter().any(|issue| issue["shape"] == id), "missing shape {id}: {issues}");
+        }
+        assert!(!contrasts.iter().any(|issue| issue["shape"] == 6), "black control warned: {issues}");
+        assert!(!contrasts.iter().any(|issue| issue["shape"] == 8), "white break or spaces warned: {issues}");
+    }
+}
@@ -4,6 +4,8 @@
 //! the same pair when it copies, and reads it back on paste: bold, italic and underline survive.
 //! Anything else in the markup is skipped. A hostile fragment is capped, never executed.

+use std::borrow::Cow;
+
 use deckcraft_model::text::{Paragraph, Run, RunProps, TextBody};

 const MAX_HTML: usize = 1 << 20;
@@ -14,20 +16,51 @@ const MAX_RUNS: usize = 10_000;
 pub fn body_to_html(body: &TextBody) -> String {
    let mut out = String::new();
    for (i, p) in body.paragraphs.iter().enumerate() {
-        if i > 0 {
-            out.push_str("<br>");
+        let prefix = if i > 0 { "<br><p>" } else { "<p>" };
+        if !push_if_fits(&mut out, prefix, 4) {
+            return plain_html(body);
        }
-        out.push_str("<p>");
        for r in &p.runs {
            let (open, close) = tags(&r.props);
-            out.push_str(&open);
+            if !push_if_fits(&mut out, &open, close.len() + 4) {
+                return plain_html(body);
+            }
            match &r.kind {
-                deckcraft_model::text::RunKind::Break => out.push_str("<br>"),
-                _ => push_escaped(&mut out, &r.text),
+                deckcraft_model::text::RunKind::Break => {
+                    if !push_if_fits(&mut out, "<br>", close.len() + 4) {
+                        return plain_html(body);
+                    }
+                }
+                _ => {
+                    if !push_escaped_bounded(&mut out, &r.text, close.len() + 4) {
+                        return plain_html(body);
+                    }
+                }
            }
            out.push_str(&close);
-            if out.len() > MAX_HTML {
-                break;
+        }
+        out.push_str("</p>");
+    }
+    out
+}
+
+/// The text without formatting, or "" (no HTML on the clipboard) when even that is too big: a
+/// cut-off prefix would paste as if it were the whole text.
+fn plain_html(body: &TextBody) -> String {
+    let mut out = String::new();
+    for (i, p) in body.paragraphs.iter().enumerate() {
+        let prefix = if i > 0 { "<br><p>" } else { "<p>" };
+        if !push_if_fits(&mut out, prefix, 4) {
+            return String::new();
+        }
+        for r in &p.runs {
+            let fits = if matches!(&r.kind, deckcraft_model::text::RunKind::Break) {
+                push_if_fits(&mut out, "<br>", 4)
+            } else {
+                push_escaped_bounded(&mut out, &r.text, 4)
+            };
+            if !fits {
+                return String::new();
            }
        }
        out.push_str("</p>");
@@ -35,6 +68,43 @@ pub fn body_to_html(body: &TextBody) -> String {
    out
 }

+fn push_if_fits(out: &mut String, value: &str, reserve: usize) -> bool {
+    if out.len().checked_add(value.len()).and_then(|n| n.checked_add(reserve)).is_none_or(|n| n > MAX_HTML) {
+        return false;
+    }
+    out.push_str(value);
+    true
+}
+
+fn push_escaped_bounded(out: &mut String, text: &str, reserve: usize) -> bool {
+    for c in text.chars() {
+        match c {
+            '&' => {
+                if !push_if_fits(out, "&amp;", reserve) {
+                    return false;
+                }
+            }
+            '<' => {
+                if !push_if_fits(out, "&lt;", reserve) {
+                    return false;
+                }
+            }
+            '>' => {
+                if !push_if_fits(out, "&gt;", reserve) {
+                    return false;
+                }
+            }
+            _ => {
+                if out.len().checked_add(c.len_utf8()).and_then(|n| n.checked_add(reserve)).is_none_or(|n| n > MAX_HTML) {
+                    return false;
+                }
+                out.push(c);
+            }
+        }
+    }
+    true
+}
+
 fn tags(props: &RunProps) -> (String, String) {
    let mut open = String::new();
    let mut close = String::new();
@@ -53,17 +123,6 @@ fn tags(props: &RunProps) -> (String, String) {
    (open, close)
 }

-fn push_escaped(out: &mut String, text: &str) {
-    for c in text.chars() {
-        match c {
-            '&' => out.push_str("&amp;"),
-            '<' => out.push_str("&lt;"),
-            '>' => out.push_str("&gt;"),
-            _ => out.push(c),
-        }
-    }
-}
-
 /// The formatted text of an HTML fragment, or `None` when it has no text.
 ///
 /// Understands `<b>`, `<strong>`, `<i>`, `<em>`, `<u>`, `<br>`, paragraphs, and a `style` that
@@ -77,7 +136,7 @@ pub fn html_to_body(html: &str) -> Option<TextBody> {
    let mut bold = 0i32;
    let mut italic = 0i32;
    let mut underline = 0i32;
-    let mut stack: Vec<(&'static str, i32, i32, i32)> = Vec::new();
+    let mut stack: Vec<(Cow<'static, str>, i32, i32, i32)> = Vec::new();
    let mut paragraphs: Vec<Paragraph> = vec![Paragraph::default()];
    let mut runs = 0usize;
    let mut skip = 0i32;
@@ -106,23 +165,27 @@ pub fn html_to_body(html: &str) -> Option<TextBody> {
                continue;
            }
            if closing {
-                let kind = tag_kind(&name);
-                if !kind.is_empty() {
-                    let search_start = stack.len().saturating_sub(64);
-                    if let Some(offset) = stack[search_start..].iter().rposition(|e| e.0 == kind) {
-                        let pos = search_start + offset;
-                        let (_, db, di, du) = stack[pos];
-                        bold -= db;
-                        italic -= di;
-                        underline -= du;
-                        stack.truncate(pos);
-                    }
+                let kind = match tag_kind(&name) {
+                    "" => name.as_str(),
+                    kind => kind,
+                };
+                let search_start = stack.len().saturating_sub(64);
+                if let Some(offset) = stack[search_start..].iter().rposition(|e| e.0.as_ref() == kind) {
+                    let pos = search_start + offset;
+                    let (db, di, du) = (stack[pos].1, stack[pos].2, stack[pos].3);
+                    bold -= db;
+                    italic -= di;
+                    underline -= du;
+                    stack.truncate(pos);
                }
                if is_block(&name) {
                    new_para(&mut paragraphs);
                }
                continue;
            }
+            if is_block(&name) {
+                new_para(&mut paragraphs);
+            }
            if is_break(&name) {
                new_para(&mut paragraphs);
                continue;
@@ -133,7 +196,11 @@ pub fn html_to_body(html: &str) -> Option<TextBody> {
                italic += di;
                underline += du;
                if !token.ends_with('/') && stack.len() < 128 {
-                    stack.push((tag_kind(&name), db, di, du));
+                    let kind = match tag_kind(&name) {
+                        "" => Cow::Owned(name.clone()),
+                        kind => Cow::Borrowed(kind),
+                    };
+                    stack.push((kind, db, di, du));
                } else {
                    bold -= db;
                    italic -= di;
@@ -368,6 +435,34 @@ fn fold(s: &str) -> String {
 mod tests {
    use super::*;

+    #[test]
+    fn style_on_other_tags_ends_at_their_close() {
+        type Prop = fn(&RunProps) -> bool;
+        let cases: [(&str, &str, Prop); 3] = [
+            ("a", "font-weight:bold", |p| p.bold == Some(true)),
+            ("td", "font-style:italic", |p| p.italic == Some(true)),
+            ("mark", "text-decoration:underline", |p| p.underline.is_some()),
+        ];
+        for (tag, style, prop) in cases {
+            let body = html_to_body(&format!("<p><{tag} style=\"{style}\">link</{tag}> plain</p>")).unwrap();
+            let runs = &body.paragraphs[0].runs;
+            assert_eq!(runs.len(), 2, "{tag}");
+            assert!(prop(&runs[0].props), "{tag}");
+            assert_eq!(runs[0].text, "link");
+            assert_eq!(runs[1].text, " plain");
+            assert!(runs[1].props.bold.is_none() && runs[1].props.italic.is_none() && runs[1].props.underline.is_none(), "{tag}");
+        }
+    }
+
+    #[test]
+    fn text_before_opening_block_tag_is_separate_paragraph() {
+        for tag in ["div", "p", "li", "h1"] {
+            let body = html_to_body(&format!("Hello<{tag}>world</{tag}>")).unwrap();
+            let texts: Vec<String> = body.paragraphs.iter().map(|p| p.runs.iter().map(|r| r.text.as_str()).collect()).collect();
+            assert_eq!(texts, ["Hello", "world"], "{tag}");
+        }
+    }
+
    #[test]
    fn multibyte_after_ampersand_is_kept() {
        let text = "é".repeat(20);
@@ -436,6 +531,16 @@ mod tests {
        assert!(last.props.underline.is_some());
    }

+    #[test]
+    fn oversized_escaped_rich_text_puts_no_html_on_the_clipboard() {
+        let mut body = TextBody::from_text(&"&<🦀".repeat(100_000));
+        body.paragraphs[0].runs[0].props.bold = Some(true);
+        body.paragraphs.push(Paragraph::new("later paragraph"));
+
+        // Neither the formatted nor the plain HTML fits, and a truncated prefix would lose text.
+        assert!(body_to_html(&body).is_empty());
+    }
+
    #[test]
    fn bare_ampersand_keeps_text_up_to_next_semicolon() {
        let text = |html: &str| html_to_body(html).unwrap().text();
@@ -103,7 +103,7 @@ pub fn specs() -> Vec<CommandSpec> {
            "Shape Fill",
            ["Shape Format", "Shape Styles"],
            None,
-            "{color? | none?: true | gradient?: {stops: [[pos, color]], angle?, kind?: linear|radial} | picture?: base64 | pattern?: {preset, fg, bg} | transparency?: 0..1 | reset?: true, ids?}; pictureProps?: {tile?: bool, offsetX?, offsetY?: pt, scaleX?, scaleY?: 0..10, align?: tl|t|tr|l|ctr|r|bl|b|br, mirror?: none|x|y|xy, stretch?: [l, t, r, b] fractions, rotateWithShape?: bool} adjusts a picture fill; a group also formats its members",
+            "{color? | none?: true | background?: true (the slide background shows through; shapes and text boxes only) | gradient?: {stops: [[pos, color]], angle?, kind?: linear|radial} | picture?: base64 | pattern?: {preset, fg, bg} | transparency?: 0..1 | reset?: true, ids?}; pictureProps?: {tile?: bool, offsetX?, offsetY?: pt, scaleX?, scaleY?: 0..10, align?: tl|t|tr|l|ctr|r|bl|b|br, mirror?: none|x|y|xy, stretch?: [l, t, r, b] fractions, rotateWithShape?: bool} adjusts a picture fill; a group also formats its members",
            has_selection,
            fill
        ),
@@ -121,7 +121,7 @@ pub fn specs() -> Vec<CommandSpec> {
            "Shape Effects",
            ["Shape Format", "Shape Styles"],
            None,
-            "{shadow?: none|outer|inner|perspective|{color, blur, dist, dir}, glow?: none|{color, radius}, softEdges?: pt, reflection?: none|tight|half|full, bevel?: none|circle|…, threeD?: {camera?: preset, rotX?, rotY?, rotZ?: deg, z?: pt, bevelTop?, bevelBottom?: none|circle|…, bevelTopW?, bevelTopH?, bevelBottomW?, bevelBottomH?, depth?, contour?: pt, material?, lighting?, reset?: true}, shadowProps?: {color?, transparency?: 0..1, blur?: pt, dist?: pt, dir?: deg}, glowProps?: {color?, transparency?, radius?: pt}, reflectionProps?: {transparency?, size?: 0..1, dist?: pt, blur?: pt}, reset?, ids?} (the *Props keys adjust the current effect, adding a default one when there is none)",
+            "{shadow?: none|outer|inner|perspective|{color, blur, dist, dir}, glow?: none|{color, radius}, softEdges?: pt, reflection?: none|tight|half|full, bevel?: none|circle|…, threeD?: {camera?: preset, rotX?, rotY?, rotZ?: deg, z?: pt, bevelTop?, bevelBottom?: none|circle|…, bevelTopW?, bevelTopH?, bevelBottomW?, bevelBottomH?, depth?, contour?: pt, material?, lighting?, reset?: true}, shadowProps?: {color?, transparency?: 0..1, size?: 0.01..2 (1 = 100%), blur?: pt, dist?: pt, dir?: deg}, glowProps?: {color?, transparency?, radius?: pt}, reflectionProps?: {transparency?, size?: 0..1, dist?: pt, blur?: pt}, reset?, ids?} (the *Props keys adjust the current effect, adding a default one when there is none)",
            has_selection,
            effects
        ),
@@ -165,7 +165,15 @@ pub fn specs() -> Vec<CommandSpec> {
            has_selection,
            picture_adjust
        ),
-        cmd!("picture.reset", "Reset Picture", ["Picture Format", "Adjust"], None, "{ids?}", has_selection, picture_reset),
+        cmd!(
+            "picture.reset",
+            "Reset Picture",
+            ["Picture Format", "Adjust"],
+            None,
+            "{ids?} (discards the picture's formatting: adjustments, artistic effect, crop, transparency, picture-style effects and outline; the frame shape from Change Shape or Crop to Shape, the size and the position stay)",
+            has_selection,
+            picture_reset
+        ),
        cmd!(
            "picture.change",
            "Change Picture",
@@ -253,6 +261,9 @@ fn requested_fill(s: &mut Session, p: &Value) -> Result<Option<Option<Fill>>> {
    if bool_or(p, "none", false) {
        return Ok(Some(Some(Fill::None)));
    }
+    if bool_or(p, "background", false) {
+        return Ok(Some(Some(Fill::Background)));
+    }
    if let Some(c) = color_param(p, "color") {
        return Ok(Some(Some(Fill::solid(c))));
    }
@@ -495,6 +506,103 @@ mod tests {
        }
    }

+    #[test]
+    fn background_fill_shows_the_slide_background_and_survives_a_save() {
+        let mut s = Session::with_new();
+        s.execute("slide.new", &json!({"layout": "blank"})).unwrap();
+        s.execute("design.background", &json!({"color": "#0000c8"})).unwrap();
+        let id = ShapeId(s.execute("shape.insert", &json!({"preset": "rect", "rect": [100, 100, 200, 100]})).unwrap()["id"].as_u64().unwrap() as u32);
+        let inside = |s: &mut Session| s.execute("slide.colorAt", &json!({"x": 200, "y": 150})).unwrap()["color"].clone();
+        assert_ne!(inside(&mut s), "0000C8", "a new shape takes the theme's fill");
+        s.execute("shape.fill", &json!({"background": true})).unwrap();
+        assert_eq!(s.doc().unwrap().shape(id).unwrap().fill, Some(Fill::Background));
+        assert_eq!(inside(&mut s), "0000C8", "the slide background shows through the shape");
+        s.execute("edit.undo", &json!({})).unwrap();
+        assert_eq!(s.doc().unwrap().shape(id).unwrap().fill, None, "one undo step returns to the theme's fill");
+        s.execute("edit.redo", &json!({})).unwrap();
+        // Transparency changes a solid or picture fill only.
+        s.execute("shape.fill", &json!({"transparency": 0.5})).unwrap();
+        assert_eq!(s.doc().unwrap().shape(id).unwrap().fill, Some(Fill::Background));
+
+        let bytes = deckcraft_pptx::export(&s.doc().unwrap().doc).unwrap();
+        let back = deckcraft_pptx::import(&bytes).unwrap();
+        let filled = back.slides.iter().flat_map(|sl| sl.shapes.iter()).filter(|sh| sh.fill == Some(Fill::Background)).count();
+        assert_eq!(filled, 1, "the shape keeps the background fill after a save and reopen");
+    }
+
+    /// A picture cannot save a slide background fill, so `background` leaves its fill alone.
+    #[test]
+    fn background_fill_skips_pictures() {
+        let mut s = Session::with_new();
+        s.execute("slide.new", &json!({"layout": "blank"})).unwrap();
+        let shape = s.execute("shape.insert", &json!({"preset": "rect", "rect": [100, 100, 200, 100]})).unwrap()["id"].as_u64().unwrap();
+        let png = deckcraft_render::Image { width: 2, height: 2, pixels: [255, 0, 0, 255].repeat(4) }.to_png();
+        let pic = s
+            .execute("insert.picture", &json!({"data": crate::cmd::base64_encode(&png), "name": "red.png", "rect": [400, 100, 100, 100]}))
+            .unwrap()["id"]
+            .as_u64()
+            .unwrap();
+        let fill = |s: &Session, id: u64| s.doc().unwrap().shape(ShapeId(id as u32)).unwrap().fill.clone();
+        let err = s.execute("shape.fill", &json!({"background": true, "ids": [pic]})).unwrap_err();
+        assert!(err.to_string().contains("shapes and text boxes"), "{err}");
+        assert_eq!(fill(&s, pic), None);
+
+        s.execute("edit.select", &json!({"ids": [shape, pic]})).unwrap();
+        let group = s.execute("arrange.group", &json!({})).unwrap()["id"].as_u64().unwrap();
+        s.execute("shape.fill", &json!({"color": "#ff0000"})).unwrap();
+        s.execute("shape.fill", &json!({"background": true})).unwrap();
+        assert_eq!(fill(&s, shape), Some(Fill::Background));
+        assert!(matches!(fill(&s, pic), Some(Fill::Solid { .. })), "the picture keeps its fill");
+        assert_eq!(fill(&s, group), None, "the group's own fill is cleared");
+        let bytes = deckcraft_pptx::export(&s.doc().unwrap().doc).unwrap();
+        let back = deckcraft_pptx::import(&bytes).unwrap();
+        let mut filled = 0;
+        for slide in &back.slides {
+            deckcraft_model::walk(&slide.shapes, &mut |sh, _| filled += usize::from(sh.fill == Some(Fill::Background)));
+        }
+        assert_eq!(filled, 1, "the shape keeps the background fill after a save and reopen");
+    }
+
+    /// A picture filled with its group's fill keeps that fill behind its transparent pixels when
+    /// the group's shapes take the slide background fill.
+    #[test]
+    fn background_fill_keeps_the_group_fill_a_picture_uses() {
+        let mut s = Session::with_new();
+        s.execute("slide.new", &json!({"layout": "blank"})).unwrap();
+        let shape = s.execute("shape.insert", &json!({"preset": "rect", "rect": [100, 100, 200, 100]})).unwrap()["id"].as_u64().unwrap();
+        let png = deckcraft_render::Image { width: 2, height: 2, pixels: [0, 0, 0, 0].repeat(4) }.to_png();
+        let pic = s
+            .execute("insert.picture", &json!({"data": crate::cmd::base64_encode(&png), "name": "clear.png", "rect": [400, 100, 100, 100]}))
+            .unwrap()["id"]
+            .as_u64()
+            .unwrap();
+        s.execute("edit.select", &json!({"ids": [shape, pic]})).unwrap();
+        let group = s.execute("arrange.group", &json!({})).unwrap()["id"].as_u64().unwrap();
+        let red = Some(Fill::solid(ColorRef::rgb(Rgba::rgb(255, 0, 0))));
+        s.edit(|doc, _| {
+            for slide in &mut doc.slides {
+                let slide = std::sync::Arc::make_mut(slide);
+                if let Some(g) = slide.shape_mut(ShapeId(group as u32)) {
+                    g.fill.clone_from(&red);
+                }
+                if let Some(p) = slide.shape_mut(ShapeId(pic as u32)) {
+                    p.fill = Some(Fill::Group);
+                }
+            }
+            Ok(())
+        })
+        .unwrap();
+        let behind = |s: &mut Session| s.execute("slide.colorAt", &json!({"x": 450, "y": 150})).unwrap()["color"].clone();
+        assert_eq!(behind(&mut s), "FF0000", "the group's fill shows through the picture");
+        s.execute("edit.select", &json!({"ids": [group]})).unwrap();
+        s.execute("shape.fill", &json!({"background": true})).unwrap();
+        let fill = |s: &Session, id: u64| s.doc().unwrap().shape(ShapeId(id as u32)).unwrap().fill.clone();
+        assert_eq!(fill(&s, shape), Some(Fill::Background));
+        assert_eq!(fill(&s, pic), Some(Fill::Group));
+        assert_eq!(fill(&s, group), red, "the group keeps the fill its picture uses");
+        assert_eq!(behind(&mut s), "FF0000", "the group's fill still shows through the picture");
+    }
+
    fn rotation(s: &Session) -> f64 {
        let st = s.active().unwrap();
        let id = st.selection.shapes[0];
@@ -1,7 +1,7 @@
 use super::{
    ColorRef, ColorTransform, Dash, Effects, Fill, Geom, Glow, Gradient, GradientShape, GradientStop, Line, LineEnd, PictureFill, PictureMode,
    Reflection, Result, Rgba, SchemeSlot, Session, Shadow, ShapeStyle, Value, apply_fill, bad, bool_or, color_param, color_value, edit_geometry,
-    edit_shapes, f64_param, inherited_fills, json, requested_fill, str_param, usize_param,
+    edit_shapes, f64_param, inherited_fills, json, requested_fill, str_param, targets, usize_param,
 };

 pub(super) fn adjust(s: &mut Session, p: &Value) -> Result<Value> {
@@ -134,11 +134,47 @@ pub(super) fn fill(s: &mut Session, p: &Value) -> Result<Value> {
    let transparency = f64_param(p, "transparency");
    let pic_props = p.get("pictureProps").filter(|v| v.is_object());
    if new_fill.is_none() && transparency.is_none() && pic_props.is_none() {
-        return Err(bad("shape.fill", "give `color`, `none`, `gradient`, `pattern`, `picture`, `pictureProps`, `transparency` or `reset`"));
+        return Err(bad(
+            "shape.fill",
+            "give `color`, `none`, `background`, `gradient`, `pattern`, `picture`, `pictureProps`, `transparency` or `reset`",
+        ));
    }
    // Transparency on an inherited (style) fill needs the effective colour.
    let inherited = inherited_fills(s, p)?;
-    edit_group_appearance(s, p, "shape.fill", |sh| apply_fill(sh, new_fill.as_ref(), pic_props, transparency, &inherited))
+    let background = matches!(new_fill, Some(Some(Fill::Background)));
+    if background {
+        let st = s.doc()?;
+        let mut any = false;
+        for id in targets(s, p)? {
+            if let Some(sh) = st.shape(id) {
+                deckcraft_model::walk(std::slice::from_ref(sh), &mut |sh, _| any |= matches!(sh.kind, deckcraft_model::ShapeKind::Shape));
+            }
+        }
+        if !any {
+            return Err(bad("shape.fill", "slide background fill applies to shapes and text boxes"));
+        }
+    }
+    edit_group_appearance(s, p, "shape.fill", |sh| {
+        if background && !matches!(sh.kind, deckcraft_model::ShapeKind::Shape) {
+            if matches!(sh.kind, deckcraft_model::ShapeKind::Group { .. }) && !group_fill_used(sh, 0) {
+                sh.fill = None;
+            }
+            return Ok(());
+        }
+        apply_fill(sh, new_fill.as_ref(), pic_props, transparency, &inherited)
+    })
+}
+
+/// Only a shape or text box (`p:sp`) saves a slide background fill (`useBgFill`). Pictures,
+/// connectors, tables and charts keep their fill, and a group's own fill is cleared unless one
+/// of them is filled with it (`grpFill`).
+fn group_fill_used(sh: &deckcraft_model::Shape, depth: usize) -> bool {
+    depth <= 64
+        && sh.children().iter().any(|c| match c.kind {
+            deckcraft_model::ShapeKind::Shape => false,
+            deckcraft_model::ShapeKind::Group { .. } => matches!(c.fill, None | Some(Fill::Group)) && group_fill_used(c, depth + 1),
+            _ => c.fill == Some(Fill::Group),
+        })
 }

 /// Applies Format Shape ▸ Picture or texture fill options to a picture fill.
@@ -401,6 +437,12 @@ pub(super) fn effects(s: &mut Session, p: &Value) -> Result<Value> {
            if let Some(d) = num(v, "dir") {
                x.dir = d.rem_euclid(360.0);
            }
+            // PowerPoint's Size: 0–200%, both axes; a zero scale would collapse the shadow's matrix.
+            if let Some(z) = num(v, "size") {
+                let z = z.clamp(0.01, 2.0);
+                x.sx = z;
+                x.sy = z;
+            }
            *slot = Some(x);
        }
        if let Some(v) = &glow_props {
@@ -1,5 +1,6 @@
 //! Slides: new, duplicate, delete, move, layout, reset, hide, notes, sections, navigation.

+use std::collections::{HashMap, HashSet};
 use std::sync::Arc;

 use deckcraft_model::text::TextBody;
@@ -22,7 +23,15 @@ pub fn specs() -> Vec<CommandSpec> {
        ),
        cmd!("slide.duplicate", "Duplicate Slide", ["Insert"], None, "{index?}", has_slide, duplicate),
        cmd!("slide.delete", "Delete Slide", ["Edit"], None, "{index?, ids?: [slide id]}", has_slide, delete),
-        cmd!("slide.move", "Move Slide", [], None, "{from?: index, to: index}", has_slide, move_slide),
+        cmd!(
+            "slide.move",
+            "Move Slide",
+            [],
+            None,
+            "{from?: index, ids?: [slide id], to: index (counted without the moved slides)}",
+            has_slide,
+            move_slide
+        ),
        cmd!(noundo "slide.go", "Go to Slide", [], None, "{index} | {id}", has_slide, go),
        cmd!(noundo "slide.next", "Next Slide", [], Some("PageDown"), "{}", has_slide, next),
        cmd!(noundo "slide.previous", "Previous Slide", [], Some("PageUp"), "{}", has_slide, prev),
@@ -266,36 +275,75 @@ fn delete(s: &mut Session, p: &Value) -> Result<Value> {
    })
 }

+/// Moves one slide (`from`, else the current slide) or several (`ids`) to `to`, in one undo step.
+/// `to` counts in the deck without the moved slides; they land there as one run, in the order
+/// they had, join the section of the slide before them, and stay selected.
 fn move_slide(s: &mut Session, p: &Value) -> Result<Value> {
-    let from = opt_usize_param(p, "from", "slide.move")?.unwrap_or(s.doc()?.selection.slide);
+    let ids = p.get("ids").filter(|v| !v.is_null());
+    let from = match ids {
+        None => opt_usize_param(p, "from", "slide.move")?.unwrap_or(s.doc()?.selection.slide),
+        Some(_) => 0,
+    };
    let to = usize_param(p, "to").ok_or_else(|| bad("slide.move", "missing `to`"))?;
    s.edit(|doc, sel| {
-        if from >= doc.slides.len() {
-            return Err(bad("slide.move", format!("no slide {from}")));
-        }
-        let sl = doc.slides.remove(from);
-        let to = to.min(doc.slides.len());
-        let id = sl.id;
-        doc.slides.insert(to, sl);
-        // Keep sections consistent with order: move the id into the section of its new neighbour.
-        if !doc.sections.is_empty() {
-            for sec in &mut doc.sections {
-                sec.slides.retain(|x| *x != id);
+        let moving: HashSet<SlideId> = match ids {
+            Some(v) => slide_ids_param(v, doc, "slide.move")?,
+            None => {
+                let id = doc.slides.get(from).map(|x| x.id).ok_or_else(|| bad("slide.move", format!("no slide {from}")))?;
+                HashSet::from([id])
            }
-            let neighbour = to.checked_sub(1).and_then(|i| doc.slides.get(i)).map(|x| x.id);
-            let si = neighbour.and_then(|n| doc.section_of(n)).unwrap_or(0);
-            let order: Vec<SlideId> = doc.slides.iter().map(|x| x.id).collect();
-            if let Some(sec) = doc.sections.get_mut(si) {
-                sec.slides.push(id);
-                sec.slides.sort_by_key(|x| order.iter().position(|o| o == x).unwrap_or(usize::MAX));
-            }
-        }
+        };
+        let (block, mut rest): (Vec<_>, Vec<_>) = std::mem::take(&mut doc.slides).into_iter().partition(|x| moving.contains(&x.id));
+        let to = to.min(rest.len());
+        let tail = rest.split_off(to);
+        let moved: Vec<SlideId> = block.iter().map(|x| x.id).collect();
+        rest.extend(block);
+        rest.extend(tail);
+        doc.slides = rest;
+        reassign_sections(doc, &moved, to);
        sel.slide = to;
-        sel.slides = vec![id];
-        Ok(json!({"index": to}))
+        sel.slides = moved;
+        sel.shapes.clear();
+        sel.text = None;
+        Ok(json!({"index": to, "moved": moving.len()}))
    })
 }

+/// The slides an `ids` param names: a non-empty list of ids of slides in `doc` (repeats fold).
+/// The first id that is not a slide of `doc` is an error, so the set never outgrows the deck.
+fn slide_ids_param(v: &Value, doc: &Presentation, cmd: &str) -> Result<HashSet<SlideId>> {
+    let a = v.as_array().ok_or_else(|| bad(cmd, "`ids` must be a list of slide ids"))?;
+    let known: HashSet<SlideId> = doc.slides.iter().map(|x| x.id).collect();
+    let mut out = HashSet::new();
+    for x in a {
+        let id = x.as_u64().and_then(|n| u32::try_from(n).ok()).map(SlideId).filter(|id| known.contains(id));
+        out.insert(id.ok_or_else(|| bad(cmd, format!("no slide with id {x}")))?);
+    }
+    if out.is_empty() {
+        return Err(bad(cmd, "`ids` is empty"));
+    }
+    Ok(out)
+}
+
+/// Keeps sections in step after `moved` landed as a run at `at`: the run joins the section of
+/// the slide just before it (the first section when it opens the deck), in document order.
+fn reassign_sections(doc: &mut Presentation, moved: &[SlideId], at: usize) {
+    if doc.sections.is_empty() {
+        return;
+    }
+    let moving: HashSet<SlideId> = moved.iter().copied().collect();
+    for sec in &mut doc.sections {
+        sec.slides.retain(|x| !moving.contains(x));
+    }
+    let neighbour = at.checked_sub(1).and_then(|i| doc.slides.get(i)).map(|x| x.id);
+    let si = neighbour.and_then(|n| doc.section_of(n)).unwrap_or(0);
+    let order: HashMap<SlideId, usize> = doc.slides.iter().enumerate().map(|(i, x)| (x.id, i)).collect();
+    if let Some(sec) = doc.sections.get_mut(si) {
+        sec.slides.extend_from_slice(moved);
+        sec.slides.sort_by_key(|x| order.get(x).copied().unwrap_or(usize::MAX));
+    }
+}
+
 fn go_to(s: &mut Session, i: usize) -> Result<Value> {
    s.select(|doc, sel| {
        let n = doc.slides.len();
@@ -710,6 +758,111 @@ mod tests {
        }
    }

+    /// A deck of `n` slides and its slide ids, in order.
+    fn deck(n: usize) -> (Session, Vec<u32>) {
+        let mut s = Session::with_new();
+        while s.doc().expect("doc").doc.slides.len() < n {
+            s.execute("slide.new", &json!({})).expect("new slide");
+        }
+        let ids = order(&s);
+        (s, ids)
+    }
+
+    fn order(s: &Session) -> Vec<u32> {
+        s.doc().expect("doc").doc.slides.iter().map(|x| x.id.0).collect()
+    }
+
+    fn selected(s: &Session) -> (usize, Vec<u32>) {
+        let sel = &s.doc().expect("doc").selection;
+        (sel.slide, sel.slides.iter().map(|x| x.0).collect())
+    }
+
+    #[test]
+    fn move_from_to_moves_one_slide() {
+        let (mut s, ids) = deck(4);
+        s.execute("slide.move", &json!({"from": 3, "to": 0})).expect("move");
+        assert_eq!(order(&s), [ids[3], ids[0], ids[1], ids[2]]);
+        assert_eq!(selected(&s), (0, vec![ids[3]]));
+    }
+
+    #[test]
+    fn move_ids_lands_them_as_one_run_in_deck_order() {
+        let (mut s, ids) = deck(6);
+        // Listed backwards: they still land in the order they had.
+        s.execute("slide.move", &json!({"ids": [ids[4], ids[1]], "to": 0})).expect("to the front");
+        assert_eq!(order(&s), [ids[1], ids[4], ids[0], ids[2], ids[3], ids[5]]);
+        assert_eq!(selected(&s), (0, vec![ids[1], ids[4]]), "the moved slides stay selected");
+
+        let (mut s, ids) = deck(6);
+        s.execute("slide.move", &json!({"ids": [ids[0], ids[2]], "to": 2})).expect("to the middle");
+        assert_eq!(order(&s), [ids[1], ids[3], ids[0], ids[2], ids[4], ids[5]]);
+        assert_eq!(selected(&s), (2, vec![ids[0], ids[2]]));
+
+        let (mut s, ids) = deck(6);
+        s.execute("slide.move", &json!({"ids": [ids[1], ids[3]], "to": 1000})).expect("past the end clamps");
+        assert_eq!(order(&s), [ids[0], ids[2], ids[4], ids[5], ids[1], ids[3]]);
+        assert_eq!(selected(&s), (4, vec![ids[1], ids[3]]));
+    }
+
+    #[test]
+    fn moving_several_slides_is_one_undo_step() {
+        let (mut s, ids) = deck(5);
+        s.execute("slide.selectSlides", &json!({"ids": [ids[0], ids[3]]})).expect("select");
+        let before = selected(&s);
+        s.execute("slide.move", &json!({"ids": [ids[0], ids[3]], "to": 3})).expect("move");
+        let after = order(&s);
+        assert_eq!(after, [ids[1], ids[2], ids[4], ids[0], ids[3]]);
+        s.execute("edit.undo", &json!({})).expect("undo");
+        assert_eq!(order(&s), ids);
+        assert_eq!(selected(&s), before);
+        s.execute("edit.redo", &json!({})).expect("redo");
+        assert_eq!(order(&s), after);
+    }
+
+    #[test]
+    fn moved_slides_join_the_section_before_them() {
+        let (mut s, ids) = deck(5);
+        s.execute("section.add", &json!({"name": "A", "at": 0})).expect("A");
+        s.execute("section.add", &json!({"name": "B", "at": 3})).expect("B");
+        // A = 0,1,2; B = 3,4. Move 0 and 1 to the end: B gets them, A keeps only slide 2.
+        s.execute("slide.move", &json!({"ids": [ids[0], ids[1]], "to": 3})).expect("move");
+        let sections =
+            |s: &Session| -> Vec<Vec<u32>> { s.doc().expect("doc").doc.sections.iter().map(|x| x.slides.iter().map(|id| id.0).collect()).collect() };
+        assert_eq!(sections(&s), [vec![ids[2]], vec![ids[3], ids[4], ids[0], ids[1]]]);
+        // Move the whole of A away: A stays, empty; the run at the front joins the first section.
+        s.execute("slide.move", &json!({"ids": [ids[2]], "to": 4})).expect("empty A");
+        assert_eq!(sections(&s), [vec![], vec![ids[3], ids[4], ids[0], ids[1], ids[2]]]);
+        s.execute("slide.move", &json!({"ids": [ids[0], ids[1]], "to": 0})).expect("to the front");
+        assert_eq!(sections(&s), [vec![ids[0], ids[1]], vec![ids[3], ids[4], ids[2]]]);
+        let all: Vec<u32> = sections(&s).concat();
+        assert_eq!(all, order(&s), "sections follow slide order");
+    }
+
+    #[test]
+    fn bad_ids_are_rejected_and_change_nothing() {
+        let (mut s, ids) = deck(3);
+        let lots_of_unknown: Vec<u64> = (1_000_000..1_100_000).collect();
+        for p in [
+            json!({"ids": [], "to": 0}),
+            json!({"ids": [ids[0], 999_999], "to": 0}),
+            json!({"ids": [-1], "to": 0}),
+            json!({"ids": ["1"], "to": 0}),
+            json!({"ids": [1.5], "to": 0}),
+            json!({"ids": [u64::MAX], "to": 0}),
+            json!({"ids": ids[0], "to": 0}),
+            json!({"ids": lots_of_unknown, "to": 0}),
+            json!({"ids": [ids[1]]}),
+        ] {
+            assert!(s.execute("slide.move", &p).is_err(), "slide.move must reject {p}");
+            assert_eq!(order(&s), ids, "{p}");
+        }
+        // Repeats fold into one.
+        let repeated = vec![ids[2]; 100_000];
+        s.execute("slide.move", &json!({"ids": repeated, "to": 0})).expect("repeats");
+        assert_eq!(order(&s), [ids[2], ids[0], ids[1]]);
+        assert_eq!(selected(&s), (0, vec![ids[2]]));
+    }
+
    #[test]
    fn duplicate_keeps_section_order_in_step_with_slides() {
        let mut s = Session::with_new();
@@ -108,7 +108,7 @@ pub fn specs() -> Vec<CommandSpec> {
            "Align Cell Text",
            ["Table Layout", "Alignment"],
            None,
-            "{anchor: top|middle|bottom, cells?, id?}",
+            "{anchor?: top|middle|bottom (vertical; top when neither anchor nor align is given), align?: left|center|right|justify (horizontal, applied to every paragraph of the cells), cells?, id?}",
            has_selection,
            cell_align
        ),
@@ -535,18 +535,43 @@ fn cell_margins(s: &mut Session, p: &Value) -> Result<Value> {
 }

 fn cell_align(s: &mut Session, p: &Value) -> Result<Value> {
-    use deckcraft_model::text::Anchor;
-    let a = match str_param(p, "anchor").unwrap_or("top") {
-        "middle" | "center" | "ctr" => Anchor::Middle,
-        "bottom" | "b" => Anchor::Bottom,
-        "top" | "t" => Anchor::Top,
-        o => return Err(bad("table.cellAlign", format!("unknown anchor {o:?}; one of top, middle, bottom"))),
+    use deckcraft_model::text::{Align, Anchor};
+    // A value that is not a string is refused, not taken as absent.
+    for k in ["align", "anchor"] {
+        if p.get(k).is_some_and(|v| !v.is_null() && !v.is_string()) {
+            return Err(bad("table.cellAlign", format!("`{k}` is a name such as {}", if k == "align" { "left or center" } else { "top or middle" })));
+        }
+    }
+    // Without `align`, the vertical anchor is the whole command (top when not given).
+    let align = match str_param(p, "align") {
+        None => None,
+        Some("left" | "l") => Some(Align::Left),
+        Some("center" | "centre" | "ctr") => Some(Align::Center),
+        Some("right" | "r") => Some(Align::Right),
+        Some("justify" | "just") => Some(Align::Justify),
+        Some(o) => return Err(bad("table.cellAlign", format!("unknown align {o:?}; one of left, center, right, justify"))),
+    };
+    let anchor = match (str_param(p, "anchor"), align) {
+        (None, Some(_)) => None,
+        (a, _) => Some(match a.unwrap_or("top") {
+            "middle" | "center" | "ctr" => Anchor::Middle,
+            "bottom" | "b" => Anchor::Bottom,
+            "top" | "t" => Anchor::Top,
+            o => return Err(bad("table.cellAlign", format!("unknown anchor {o:?}; one of top, middle, bottom"))),
+        }),
    };
    let targets = target_cells(s, p)?;
    with_table(s, p, "table.cellAlign", move |t| {
        for (r, c) in targets(t) {
            if let Some(cell) = t.cell_mut(r, c) {
-                cell.anchor = Some(a);
+                if anchor.is_some() {
+                    cell.anchor = anchor;
+                }
+                if let Some(a) = align {
+                    for para in &mut cell.text.paragraphs {
+                        para.props.align = Some(a);
+                    }
+                }
            }
        }
        Ok(())
@@ -142,7 +142,7 @@ pub fn correct_word(prefs: &crate::Prefs, word: &str, sentence_start: bool, typi

 /// After a space or punctuation, correct the word just typed.
 pub(super) fn autocorrect(s: &mut Session, typing: bool) -> Result<()> {
-    if !s.prefs.autocorrect {
+    if !s.prefs.autocorrect && !(typing && s.prefs.ac_lists) {
        return Ok(());
    }
    let st = s.doc()?;
@@ -160,6 +160,9 @@ pub(super) fn autocorrect(s: &mut Session, typing: bool) -> Result<()> {
            return Ok(());
        }
    }
+    if !s.prefs.autocorrect {
+        return Ok(());
+    }
    let mut word_end = end - 1;
    let mut start = word_end;
    while start > 0 && line.get(start - 1).is_some_and(|c| !c.is_whitespace()) {
@@ -7,6 +7,7 @@
 use std::collections::{HashMap, HashSet};
 use std::sync::Arc;

+use deckcraft_model::resolve::Ctx;
 use deckcraft_model::{MediaId, Presentation, Shape, ShapeId, ShapeKind, Slide, SlideId};
 use serde::Serialize;

@@ -92,6 +93,12 @@ pub struct Change {
    pub kind: ChangeKind,
    /// Index in the open deck (for inserted: where it would go).
    pub slide: usize,
+    /// The editor's number of that slide (`slide` + 1).
+    pub number: usize,
+    /// Which side has it alone: `deck` (the open presentation; accepting deletes it) or `file`
+    /// (the compared file; accepting adds it). Absent when both have it and differ.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub only_in: Option<&'static str>,
    /// Index in the revised deck (none for deleted).
    pub revised: Option<usize>,
    /// What differs, readable: `Title 1: text`, `Picture 3 inserted`, `notes`…
@@ -118,19 +125,33 @@ pub fn diff(cur: &Presentation, rev: &Presentation, by_position: bool) -> Vec<Ch
        let (Some(a), Some(b)) = (cur.slides.get(*i), rev.slides.get(*j)) else { continue };
        let details = slide_details(cur, a, rev, b);
        if !details.is_empty() {
-            out.push(Change { kind: ChangeKind::Changed, slide: *i, revised: Some(*j), details });
+            out.push(Change { kind: ChangeKind::Changed, slide: *i, number: i.saturating_add(1), only_in: None, revised: Some(*j), details });
        }
    }
    for (i, s) in cur.slides.iter().enumerate() {
        if !cur_matched.contains(&i) {
-            out.push(Change { kind: ChangeKind::Deleted, slide: i, revised: None, details: vec![slide_title(s)] });
+            out.push(Change {
+                kind: ChangeKind::Deleted,
+                slide: i,
+                number: i.saturating_add(1),
+                only_in: Some("deck"),
+                revised: None,
+                details: vec![slide_title(s)],
+            });
        }
    }
    for (j, s) in rev.slides.iter().enumerate() {
        if !rev_matched.contains(&j) {
            // After the open slide that matches the revised slide before it.
            let at = (0..j).rev().find_map(|k| pairs.iter().find(|p| p.1 == k).map(|p| p.0 + 1)).unwrap_or(0);
-            out.push(Change { kind: ChangeKind::Inserted, slide: at, revised: Some(j), details: vec![slide_title(s)] });
+            out.push(Change {
+                kind: ChangeKind::Inserted,
+                slide: at,
+                number: at.saturating_add(1),
+                only_in: Some("file"),
+                revised: Some(j),
+                details: vec![slide_title(s)],
+            });
        }
    }
    out.sort_by_key(|c| (c.slide, c.revised.unwrap_or(0)));
@@ -172,7 +193,18 @@ fn plain_shape(s: &Shape) -> Shape {
    c
 }

-fn shape_details(cp: &Presentation, a: &Shape, rp: &Presentation, b: &Shape, out: &mut Vec<String>) {
+/// The box a shape is drawn with: its own, else the one it inherits from its layout or master
+/// placeholder (`ctx`).
+fn drawn_box(ctx: Option<&Ctx>, s: &Shape) -> Option<deckcraft_model::Xfrm> {
+    s.xfrm.or_else(|| ctx.map(|c| deckcraft_model::resolve::xfrm(c, s)))
+}
+
+/// The rotation and flips a shape is drawn with (none without a box).
+fn turn(ctx: Option<&Ctx>, s: &Shape) -> (f64, bool, bool) {
+    drawn_box(ctx, s).map_or((0.0, false, false), |x| (x.rot, x.flip_h, x.flip_v))
+}
+
+fn shape_details(cp: &Presentation, ca: Option<&Ctx>, a: &Shape, rp: &Presentation, cb: Option<&Ctx>, b: &Shape, out: &mut Vec<String>) {
    let label = shape_label(b);
    let text = |s: &Shape| s.text.as_ref().map(|t| t.text()).unwrap_or_default();
    let mut what = vec![];
@@ -181,12 +213,24 @@ fn shape_details(cp: &Presentation, a: &Shape, rp: &Presentation, b: &Shape, out
    } else if a.text != b.text {
        what.push("text formatting");
    }
-    match (&a.xfrm, &b.xfrm) {
+    // Boxes as drawn: a stored box equal to the inherited one is no change.
+    match (&drawn_box(ca, a), &drawn_box(cb, b)) {
        (Some(x), Some(y)) if (x.x, x.y) != (y.x, y.y) && (x.w, x.h) == (y.w, y.h) => what.push("moved"),
        (Some(x), Some(y)) if (x.w, x.h) != (y.w, y.h) => what.push("resized"),
-        (x, y) if x.as_ref().map(|x| x.rot) != y.as_ref().map(|y| y.rot) => what.push("rotated"),
        _ => {}
    }
+    // Rotation and flips are reported alongside a move or resize, not hidden behind it. No stored
+    // box means the inherited one (the layout's or master's), as the shape is drawn.
+    let (ta, tb) = (turn(ca, a), turn(cb, b));
+    if ta.0 != tb.0 {
+        what.push("rotated");
+    }
+    if (ta.1, ta.2) != (tb.1, tb.2) {
+        what.push("flipped");
+    }
+    if a.geom != b.geom {
+        what.push("shape");
+    }
    if a.fill != b.fill || a.line != b.line || a.style != b.style || a.effects != b.effects {
        what.push("formatting");
    }
@@ -197,17 +241,24 @@ fn shape_details(cp: &Presentation, a: &Shape, rp: &Presentation, b: &Shape, out
    if pic(cp, a) != pic(rp, b) {
        what.push("picture");
    }
-    if what.is_empty() {
-        let (mut x, mut y) = (plain_shape(a), plain_shape(b));
-        x.text = None;
-        y.text = None;
-        if let (ShapeKind::Picture { .. }, ShapeKind::Picture { .. }) = (&x.kind, &y.kind) {
-            x.kind = ShapeKind::Shape;
-            y.kind = ShapeKind::Shape;
-        }
-        if x != y {
-            what.push("properties");
-        }
+    // Anything the checks above do not cover (alt text, hidden, a link…) is reported too, also
+    // beside them: the fields they compared are left out of this comparison.
+    let (mut x, mut y) = (plain_shape(a), plain_shape(b));
+    for z in [&mut x, &mut y] {
+        z.text = None;
+        z.xfrm = None;
+        z.geom = Default::default();
+        z.fill = None;
+        z.line = None;
+        z.style = None;
+        z.effects = Default::default();
+    }
+    if let (ShapeKind::Picture { .. }, ShapeKind::Picture { .. }) = (&x.kind, &y.kind) {
+        x.kind = ShapeKind::Shape;
+        y.kind = ShapeKind::Shape;
+    }
+    if x != y {
+        what.push("properties");
    }
    if !what.is_empty() {
        out.push(format!("{label}: {}", what.join(", ")));
@@ -217,6 +268,7 @@ fn shape_details(cp: &Presentation, a: &Shape, rp: &Presentation, b: &Shape, out
 fn slide_details(cp: &Presentation, a: &Slide, rp: &Presentation, b: &Slide) -> Vec<String> {
    let mut out = vec![];
    let mut used: HashSet<usize> = HashSet::new();
+    let (ca, cb) = (Ctx::for_slide(cp, a), Ctx::for_slide(rp, b));
    for sa in &a.shapes {
        let k = b
            .shapes
@@ -227,15 +279,15 @@ fn slide_details(cp: &Presentation, a: &Slide, rp: &Presentation, b: &Slide) ->
            Some(k) if !used.contains(&k) => {
                used.insert(k);
                if let Some(sb) = b.shapes.get(k) {
-                    shape_details(cp, sa, rp, sb, &mut out);
+                    shape_details(cp, ca.as_ref(), sa, rp, cb.as_ref(), sb, &mut out);
                }
            }
-            _ => out.push(format!("{} deleted", shape_label(sa))),
+            _ => out.push(format!("{} deleted (only in the deck)", shape_label(sa))),
        }
    }
    for (k, sb) in b.shapes.iter().enumerate() {
        if !used.contains(&k) {
-            out.push(format!("{} inserted", shape_label(sb)));
+            out.push(format!("{} inserted (only in the file)", shape_label(sb)));
        }
    }
    let order = |s: &Slide| s.shapes.iter().map(|x| x.name.clone()).collect::<Vec<_>>();
@@ -354,6 +406,25 @@ pub fn adopt(doc: &mut Presentation, rev: &Presentation, slide: &Slide, replacin
        let by_name = name.and_then(|n| doc.masters.iter().flat_map(|m| &m.layouts).find(|l| l.name == n).map(|l| l.id));
        sl.layout = by_name.or_else(|| doc.masters.first().and_then(|m| m.layouts.first()).map(|l| l.id)).unwrap_or_default();
    }
+    // A placeholder without a box of its own is drawn with its layout's; where this deck's layout
+    // draws it otherwise (placed or turned differently), the file's box is stored on it, so the
+    // accepted slide looks as the file does and compares equal to it.
+    if let (Some(file), Some(here)) = (Ctx::for_slide(rev, slide), Ctx::for_slide(doc, &sl)) {
+        let boxes: Vec<Option<deckcraft_model::Xfrm>> = slide
+            .shapes
+            .iter()
+            .zip(&sl.shapes)
+            .map(|(f, h)| {
+                let want = deckcraft_model::resolve::xfrm(&file, f);
+                (h.xfrm.is_none() && deckcraft_model::resolve::xfrm(&here, h) != want).then_some(want)
+            })
+            .collect();
+        for (h, b) in sl.shapes.iter_mut().zip(boxes) {
+            if b.is_some() {
+                h.xfrm = b;
+            }
+        }
+    }
    match replacing {
        Some(id) => sl.id = id,
        None => {
@@ -494,6 +565,136 @@ mod tests {
        assert_eq!(bytes(back.media), b"open background");
    }

+    /// NN6: a slide reset drops the placeholders' stored boxes; comparing it with the copy from
+    /// before the reset must not call that a rotation (no stored box is rotation 0).
+    #[test]
+    fn a_reset_slide_is_not_rotated_against_its_earlier_copy() {
+        let mut s = Session::with_new();
+        s.execute("slide.new", &json!({"layout": "titleAndContent", "title": "T", "body": "b"})).unwrap();
+        let ids: Vec<u32> = s.doc().unwrap().doc.slides[1].shapes.iter().map(|x| x.id.0).collect();
+        for id in &ids {
+            s.execute("shape.move", &json!({"ids": [id], "dx": 10, "dy": 0})).unwrap();
+            s.execute("shape.move", &json!({"ids": [id], "dx": -10, "dy": 0})).unwrap();
+        }
+        let before = s.execute("file.saveBytes", &json!({})).unwrap()["data"].as_str().unwrap().to_string();
+        s.execute("slide.reset", &json!({"index": 1})).unwrap();
+        let v = s.execute("review.compare", &json!({"name": "before.deckcraft", "data": before})).unwrap();
+        assert!(!v.to_string().contains("rotated"), "{v}");
+    }
+
+    /// A shape both moved and rotated reports both, not only the move.
+    #[test]
+    fn a_moved_and_rotated_shape_reports_both() {
+        let mut s = Session::with_new();
+        let id = s.execute("shape.insert", &json!({"preset": "rect", "rect": [100, 100, 100, 50]})).unwrap()["id"].as_u64().unwrap();
+        let before = s.execute("file.saveBytes", &json!({})).unwrap()["data"].as_str().unwrap().to_string();
+        s.execute("shape.move", &json!({"ids": [id], "dx": 40, "dy": 0})).unwrap();
+        s.execute("shape.rotate", &json!({"ids": [id], "deg": 30})).unwrap();
+        let v = s.execute("review.compare", &json!({"name": "before.deckcraft", "data": before})).unwrap().to_string();
+        assert!(v.contains("moved") && v.contains("rotated"), "{v}");
+    }
+
+    /// A property no other check covers (here the alt text) is reported beside a flip.
+    #[test]
+    fn a_flipped_shape_with_new_alt_text_reports_both() {
+        let mut s = Session::with_new();
+        let id = s.execute("shape.insert", &json!({"preset": "rect", "rect": [100, 100, 100, 50]})).unwrap()["id"].as_u64().unwrap();
+        let before = s.execute("file.saveBytes", &json!({})).unwrap()["data"].as_str().unwrap().to_string();
+        s.execute("shape.flip", &json!({"ids": [id]})).unwrap();
+        let st = s.doc_mut().unwrap();
+        let doc = std::sync::Arc::make_mut(&mut st.doc);
+        let sl = std::sync::Arc::make_mut(&mut doc.slides[0]);
+        sl.shapes.iter_mut().find(|x| x.id.0 as u64 == id).unwrap().descr = "A red box".into();
+        let v = s.execute("review.compare", &json!({"name": "before.deckcraft", "data": before})).unwrap().to_string();
+        assert!(v.contains("flipped") && v.contains("properties"), "{v}");
+    }
+
+    /// A flip and a change of shape (rectangle to ellipse) are both reported.
+    #[test]
+    fn a_flipped_shape_that_changed_shape_reports_both() {
+        let mut s = Session::with_new();
+        let id = s.execute("shape.insert", &json!({"preset": "rect", "rect": [100, 100, 100, 50]})).unwrap()["id"].as_u64().unwrap();
+        let before = s.execute("file.saveBytes", &json!({})).unwrap()["data"].as_str().unwrap().to_string();
+        s.execute("shape.flip", &json!({"ids": [id]})).unwrap();
+        s.execute("shape.change", &json!({"ids": [id], "preset": "ellipse"})).unwrap();
+        let v = s.execute("review.compare", &json!({"name": "before.deckcraft", "data": before})).unwrap().to_string();
+        assert!(v.contains("flipped") && v.contains("shape\""), "{v}");
+    }
+
+    /// A placeholder with no box of its own is drawn with its layout's rotation; setting it to 0
+    /// on the slide is a rotation change, and compare says so.
+    #[test]
+    fn an_inherited_rotation_counts_when_compared() {
+        let mut s = Session::with_new();
+        s.execute("slide.new", &json!({"layout": "titleOnly", "title": "T"})).unwrap();
+        s.execute("slide.reset", &json!({"index": 1})).unwrap();
+        let st = s.doc_mut().unwrap();
+        let doc = std::sync::Arc::make_mut(&mut st.doc);
+        let layout = doc.slides[1].layout;
+        let title = |sh: &deckcraft_model::Shape| sh.ph.as_ref().is_some_and(|p| matches!(p.kind, deckcraft_model::PhType::Title));
+        let (mi, li) = doc.masters.iter().enumerate().find_map(|(m, x)| x.layouts.iter().position(|l| l.id == layout).map(|l| (m, l))).unwrap();
+        let ph = std::sync::Arc::make_mut(&mut doc.masters[mi]).layouts[li].shapes.iter_mut().find(|x| title(x)).unwrap();
+        let mut x = ph.xfrm.unwrap();
+        x.rot = 30.0;
+        ph.xfrm = Some(x);
+        assert!(doc.slides[1].shapes.iter().find(|x| title(x)).unwrap().xfrm.is_none(), "the title inherits its box");
+        let before = s.execute("file.saveBytes", &json!({})).unwrap()["data"].as_str().unwrap().to_string();
+        let st = s.doc_mut().unwrap();
+        let doc = std::sync::Arc::make_mut(&mut st.doc);
+        let sl = std::sync::Arc::make_mut(&mut doc.slides[1]);
+        let t = sl.shapes.iter_mut().find(|x| title(x)).unwrap();
+        x.rot = 0.0;
+        t.xfrm = Some(x);
+        let v = s.execute("review.compare", &json!({"name": "before.deckcraft", "data": before})).unwrap();
+        assert!(v.to_string().contains("rotated"), "{v}");
+    }
+
+    /// The file's placeholder inherits an unturned box from its layout while this deck's layout
+    /// turns it: accepting stores the file's box on the placeholder, so the slide is drawn as in the
+    /// file and nothing is left to accept.
+    #[test]
+    fn accepting_an_inherited_box_takes_the_files_box() {
+        let mut s = Session::with_new();
+        s.execute("slide.new", &json!({"layout": "titleOnly", "title": "T"})).unwrap();
+        s.execute("slide.reset", &json!({"index": 1})).unwrap();
+        let file = s.execute("file.saveBytes", &json!({})).unwrap()["data"].as_str().unwrap().to_string();
+        let title = |sh: &deckcraft_model::Shape| sh.ph.as_ref().is_some_and(|p| matches!(p.kind, deckcraft_model::PhType::Title));
+        let st = s.doc_mut().unwrap();
+        let doc = std::sync::Arc::make_mut(&mut st.doc);
+        let layout = doc.slides[1].layout;
+        let (mi, li) = doc.masters.iter().enumerate().find_map(|(m, x)| x.layouts.iter().position(|l| l.id == layout).map(|l| (m, l))).unwrap();
+        let ph = std::sync::Arc::make_mut(&mut doc.masters[mi]).layouts[li].shapes.iter_mut().find(|x| title(x)).unwrap();
+        let mut x = ph.xfrm.unwrap();
+        x.rot = 30.0;
+        ph.xfrm = Some(x);
+        let v = s.execute("review.compare", &json!({"name": "file.deckcraft", "data": file})).unwrap();
+        assert!(v.to_string().contains("rotated"), "{v}");
+        s.execute("review.accept", &json!({"all": true})).unwrap();
+        let st = s.doc().unwrap();
+        let t = st.doc.slides[1].shapes.iter().find(|x| title(x)).unwrap();
+        assert_eq!(t.xfrm.map(|x| x.rot), Some(0.0), "the file's box is stored: {:?}", t.xfrm);
+        let v = s.execute("review.compare", &json!({"name": "file.deckcraft", "data": file})).unwrap();
+        assert!(v["changes"].as_array().is_some_and(|c| c.is_empty()), "nothing left to accept: {v}");
+    }
+
+    #[test]
+    fn each_change_says_which_side_it_is_on() {
+        let (mut s, rev, _) = decks();
+        let v = s.execute("review.compare", &json!({"name": "rev.deckcraft", "data": rev})).unwrap();
+        for c in v["changes"].as_array().unwrap() {
+            assert_eq!(c["number"].as_u64().unwrap(), c["slide"].as_u64().unwrap() + 1, "{c}");
+            match c["kind"].as_str().unwrap() {
+                "deleted" => assert_eq!(c["onlyIn"], "deck", "{c}"),
+                "inserted" => assert_eq!(c["onlyIn"], "file", "{c}"),
+                _ => assert!(c.get("onlyIn").is_none(), "{c}"),
+            }
+        }
+        // A shape only in the open deck reads as only in the deck.
+        s.execute("shape.insert", &json!({"preset": "ellipse", "rect": [10.0, 10.0, 40.0, 40.0]})).unwrap();
+        let v = s.execute("review.revisions", &json!({})).unwrap();
+        assert!(v.to_string().contains("deleted (only in the deck)"), "{v}");
+    }
+
    #[test]
    fn accept_one_then_all_makes_the_decks_equal_and_undoes() {
        let (mut s, rev, n) = decks();
@@ -35,8 +35,8 @@ pub enum Access {
 /// The folders automation may read and write; a root left out grants no access of its kind.
 #[derive(Debug)]
 pub struct AutomationRoots {
-    read: Option<Root>,
-    write: Option<Root>,
+    read: Vec<Root>,
+    write: Vec<Root>,
 }

 #[derive(Debug)]
@@ -62,46 +62,47 @@ impl Root {
 }

 impl AutomationRoots {
-    /// The roots `read` and `write`, which must be existing folders; `None` when neither is given
+    /// The read and write roots, which must be existing folders; `None` when both are empty
    /// (nothing is confined then).
-    pub fn new(read: Option<&Path>, write: Option<&Path>) -> Result<Option<Arc<Self>>, String> {
-        if read.is_none() && write.is_none() {
+    pub fn new(read: &[PathBuf], write: &[PathBuf]) -> Result<Option<Arc<Self>>, String> {
+        if read.is_empty() && write.is_empty() {
            return Ok(None);
        }
-        let read = read.map(|p| Root::open(p, Access::Read)).transpose()?;
-        let write = write.map(|p| Root::open(p, Access::Write)).transpose()?;
+        let read = read.iter().map(|p| Root::open(p, Access::Read)).collect::<Result<_, _>>()?;
+        let write = write.iter().map(|p| Root::open(p, Access::Write)).collect::<Result<_, _>>()?;
        Ok(Some(Arc::new(Self { read, write })))
    }

-    /// The read root, absolute with its links followed.
-    pub fn read_root(&self) -> Option<&Path> {
-        self.read.as_ref().map(|r| r.shown.as_path())
+    /// The read roots, absolute with their links followed.
+    pub fn read_roots(&self) -> impl Iterator<Item = &Path> {
+        self.read.iter().map(|r| r.shown.as_path())
    }

-    /// The write root, absolute with its links followed.
-    pub fn write_root(&self) -> Option<&Path> {
-        self.write.as_ref().map(|r| r.shown.as_path())
+    /// The write roots, absolute with their links followed.
+    pub fn write_roots(&self) -> impl Iterator<Item = &Path> {
+        self.write.iter().map(|r| r.shown.as_path())
    }

    /// May the file or folder at `path` be read (or written)? `Err` says why not.
    pub fn check(&self, path: &str, access: Access) -> Result<(), String> {
-        let root = match access {
-            Access::Read => self.read.as_ref(),
-            Access::Write => self.write.as_ref(),
+        let roots = match access {
+            Access::Read => &self.read,
+            Access::Write => &self.write,
        };
-        let Some(Root { resolved: folder, shown }) = root else {
+        if roots.is_empty() {
            return match access {
                Access::Read => Err(format!("automation filesystem access is not granted: read authority is absent: {path}")),
                Access::Write => Err(format!("automation filesystem access is not granted: write authority is absent: {path}")),
            };
-        };
-        if inside(&resolve(path)?, folder) {
+        }
+        let resolved = resolve(path)?;
+        if roots.iter().any(|root| inside(&resolved, &root.resolved)) {
            return Ok(());
        }
-        let root = shown.display();
+        let roots = roots.iter().map(|root| root.shown.display().to_string()).collect::<Vec<_>>().join(", ");
        match access {
-            Access::Read => Err(format!("automation path rejected: outside the read root {root}: {path}")),
-            Access::Write => Err(format!("automation path rejected: outside the write root {root}: {path}")),
+            Access::Read => Err(format!("automation path rejected: outside the read roots {roots}: {path}")),
+            Access::Write => Err(format!("automation path rejected: outside the write roots {roots}: {path}")),
        }
    }
 }
@@ -276,7 +277,7 @@ mod tests {
        }
        std::fs::write(base.join("in/a.deckcraft"), "x").unwrap();
        std::fs::write(base.join("outside/secret.deckcraft"), "x").unwrap();
-        let roots = AutomationRoots::new(Some(&base.join("in")), Some(&base.join("out"))).unwrap().unwrap();
+        let roots = AutomationRoots::new(&[base.join("in")], &[base.join("out")]).unwrap().unwrap();
        (base, roots)
    }

@@ -300,6 +301,17 @@ mod tests {
        let _ = std::fs::remove_dir_all(base);
    }

+    #[test]
+    fn any_configured_root_grants_access() {
+        let (base, _) = folders("multiple");
+        let roots = AutomationRoots::new(&[base.join("in"), base.join("in2")], &[base.join("out"), base.join("outside")]).unwrap().unwrap();
+        assert_eq!(roots.check(&s(base.join("in/a.deckcraft")), Access::Read), Ok(()));
+        assert_eq!(roots.check(&s(base.join("in2/b.deckcraft")), Access::Read), Ok(()));
+        assert_eq!(roots.check(&s(base.join("out/new.deckcraft")), Access::Write), Ok(()));
+        assert_eq!(roots.check(&s(base.join("outside/new.deckcraft")), Access::Write), Ok(()));
+        let _ = std::fs::remove_dir_all(base);
+    }
+
    #[test]
    fn a_sibling_with_the_same_prefix_is_outside() {
        let (base, roots) = folders("prefix");
@@ -336,18 +348,18 @@ mod tests {
    #[test]
    fn a_missing_root_is_an_error_and_none_is_no_confinement() {
        let (base, _) = folders("missing");
-        let e = AutomationRoots::new(Some(&base.join("nope")), None).unwrap_err();
+        let e = AutomationRoots::new(&[base.join("nope")], &[]).unwrap_err();
        assert!(e.starts_with("cannot open the automation read root"), "{e}");
-        let e = AutomationRoots::new(None, Some(&base.join("in/a.deckcraft"))).unwrap_err();
+        let e = AutomationRoots::new(&[], &[base.join("in/a.deckcraft")]).unwrap_err();
        assert!(
            e.starts_with("cannot open the automation write root")
                && e.ends_with(&std::io::Error::from(std::io::ErrorKind::NotADirectory).to_string()),
            "{e}"
        );
-        assert!(AutomationRoots::new(Some(Path::new("")), None).unwrap_err().starts_with("cannot open the automation read root ``"));
-        assert!(AutomationRoots::new(None, None).unwrap().is_none());
+        assert!(AutomationRoots::new(&[PathBuf::new()], &[]).unwrap_err().starts_with("cannot open the automation read root ``"));
+        assert!(AutomationRoots::new(&[], &[]).unwrap().is_none());
        // One root alone grants only its own access.
-        let read_only = AutomationRoots::new(Some(&base.join("in")), None).unwrap().unwrap();
+        let read_only = AutomationRoots::new(&[base.join("in")], &[]).unwrap().unwrap();
        let e = read_only.check(&s(base.join("in/x.deckcraft")), Access::Write).unwrap_err();
        assert!(e.contains("write authority is absent"), "{e}");
        let _ = std::fs::remove_dir_all(base);
@@ -384,7 +396,7 @@ mod tests {
        assert_eq!(roots.check(&s(base.join("in/alias/x.deckcraft")), Access::Read), Ok(()));
        // A root given through a link is the folder it leads to.
        assert!(made(&base.join("in"), &base.join("in-link")));
-        let linked = AutomationRoots::new(Some(&base.join("in-link")), None).unwrap().unwrap();
+        let linked = AutomationRoots::new(&[base.join("in-link")], &[]).unwrap().unwrap();
        assert_eq!(linked.check(&s(base.join("in/a.deckcraft")), Access::Read), Ok(()));
        let _ = std::fs::remove_dir_all(base);
    }
@@ -22,12 +22,14 @@ pub fn install_embedded_fonts(p: &Presentation) {
 }

 /// The font families the slides' text is drawn in (theme fonts resolved, bullet fonts included)
-/// that aren't installed or bundled, sorted, without duplicates (case-insensitive).
+/// that aren't installed or bundled, sorted, without duplicates (case-insensitive). Names that
+/// start with a dot are macOS hidden system fonts (`.SF NS`); they never appear in a font list
+/// and can't be installed, so they aren't reported.
 pub fn missing_fonts(p: &Presentation) -> Vec<String> {
    let db = FontDb::global();
    let mut out: Vec<String> = Vec::new();
    for family in used_fonts(p) {
-        if !db.has_family(&family) && !out.iter().any(|f| f.eq_ignore_ascii_case(&family)) {
+        if !family.starts_with('.') && !db.has_family(&family) && !out.iter().any(|f| f.eq_ignore_ascii_case(&family)) {
            out.push(family);
        }
    }
@@ -682,7 +682,28 @@ impl Session {
                self.journal.drain(..1000);
            }
        }
-        Ok(r)
+        Ok(if outer { self.with_editing(id, r) } else { r })
+    }
+
+    /// In Slide Master / layout (or handout / notes master) view the insert commands edit the
+    /// master or layout, not a slide; their answer says so with `editing: {kind, name}`, as
+    /// `slide.inspect` does. Nothing is added on slides, so those answers stay as they were.
+    fn with_editing(&self, id: &str, mut r: Value) -> Value {
+        let inserts = id.starts_with("insert.") || matches!(id, "shape.insert" | "shape.freeform" | "shape.connect" | "slide.new");
+        let (true, Some(st), Some(o)) = (inserts, self.active(), r.as_object_mut()) else { return r };
+        let doc = &st.doc;
+        let edited = match st.selection.target {
+            Target::Master { master } => doc.masters.get(master).map(|m| ("master", m.name.clone())),
+            Target::Layout { master, layout } => doc.masters.get(master).and_then(|m| m.layouts.get(layout)).map(|l| ("layout", l.name.clone())),
+            t @ (Target::Handout | Target::NotesMaster) => {
+                page_master(doc, t).map(|m| (if matches!(t, Target::Handout) { "handout" } else { "notesMaster" }, m.name.clone()))
+            }
+            Target::Slides => None,
+        };
+        if let Some((kind, name)) = edited {
+            o.entry("editing").or_insert_with(|| serde_json::json!({"kind": kind, "name": name}));
+        }
+        r
    }

    pub fn commands(&self) -> Vec<CommandInfo> {
@@ -695,6 +716,7 @@ impl Session {
        let mut doc = (*st.doc).clone();
        let mut sel = st.selection.clone();
        let r = f(&mut doc, &mut sel)?;
+        cmd::arrange::refit_groups(&st.doc, &mut doc);
        connect::reroute(&mut doc, &sel);
        st.doc = Arc::new(doc);
        st.selection = sel;
@@ -356,7 +356,14 @@ impl Dictionary {
    }

    /// Is `word` spelt correctly? Capitalised and upper-case forms of a lower-case word pass.
+    /// Words longer than 100 characters are not checked (they pass).
    pub fn check(&self, word: &str) -> bool {
+        // Compound splitting tries every split point, so checking costs O(n²) in the word's
+        // length: a 100,000-character "word" took seconds per check under a compounding
+        // dictionary, on every edit (#1175).
+        if word.chars().nth(MAX_CHECK_CHARS).is_some() {
+            return true;
+        }
        if word.contains('\u{2019}') {
            return self.check(&word.replace('\u{2019}', "'"));
        }
@@ -394,12 +401,18 @@ impl Dictionary {
            return vec![];
        }
        let cap = word.chars().next().is_some_and(char::is_uppercase);
-        let lower = if cap && word.chars().skip(1).all(|c| !c.is_uppercase()) { word.to_lowercase() } else { word.to_string() };
+        let upper = word.chars().count() > 1 && word.chars().any(char::is_uppercase) && !word.chars().any(char::is_lowercase);
+        let lower = if upper || (cap && word.chars().skip(1).all(|c| !c.is_uppercase())) { word.to_lowercase() } else { word.to_string() };
        let w: Vec<char> = lower.chars().collect();
        let mut out: Vec<String> = vec![];
        let mut seen = HashSet::new();
        let mut push = |s: String, out: &mut Vec<String>| {
-            if s != lower && seen.insert(s.to_lowercase()) && s.split(' ').all(|p| self.suggestible(p)) {
+            if s == lower {
+                return;
+            }
+            // Checked in capitals, so a KEEPCASE entry ("NASA") is offered for an all-caps word.
+            let s = if upper { s.to_uppercase() } else { s };
+            if seen.insert(s.to_lowercase()) && s.split(' ').all(|p| self.suggestible(p)) {
                out.push(s);
            }
        };
@@ -443,7 +456,7 @@ impl Dictionary {
            push(format!("{} {}", s(&w[..i]), s(&w[i..])), &mut out);
        }
        out.truncate(n);
-        if cap {
+        if cap && !upper {
            out = out.into_iter().map(|x| capitalise(&x)).collect();
        }
        out
@@ -553,6 +566,9 @@ pub fn find_in(dirs: &[PathBuf], lang: &str) -> Option<(PathBuf, PathBuf)> {
 /// Longest word `Dictionary::suggest` generates corrections for.
 const MAX_SUGGEST_CHARS: usize = 64;

+/// Longest word `Dictionary::check` checks, as Hunspell's word length limit.
+const MAX_CHECK_CHARS: usize = 100;
+
 type Cache = Mutex<HashMap<String, Option<Arc<Dictionary>>>>;

 fn cache() -> &'static Cache {
@@ -843,6 +859,28 @@ SFX D Y 1\nSFX D 0 ed/S .\n";
        assert!(d.suggest("workingslides", 5).contains(&"working slides".to_string()));
    }

+    /// #1175: compound splitting is quadratic in the word's length, so a word longer than
+    /// `MAX_CHECK_CHARS` is not checked; shorter ones still are.
+    #[test]
+    fn a_word_longer_than_the_check_limit_is_not_checked() {
+        let d = Dictionary::parse(b"COMPOUNDFLAG X\nCOMPOUNDMIN 3\n", b"2\nfoot/X\nball/X\n".as_slice());
+        assert!(d.check("footballfoot"), "a compound is checked");
+        let under: String = "footb".repeat(MAX_CHECK_CHARS / 5);
+        assert_eq!(under.chars().count(), MAX_CHECK_CHARS);
+        assert!(!d.check(&under), "a word at the limit is still checked");
+        // Unchecked, not seconds of compound splitting.
+        assert!(d.check(&"footb".repeat(20_000)));
+        assert!(d.check(&format!("{under}x")));
+    }
+
+    #[test]
+    fn all_caps_words_get_uppercase_suggestions() {
+        let d = d();
+        assert!(d.suggest("SLDE", 5).contains(&"SLIDE".to_string()));
+        assert!(d.suggest("FOTO", 5).contains(&"PHOTO".to_string()));
+        assert!(d.suggest("NSSA", 5).contains(&"NASA".to_string()));
+    }
+
    #[test]
    fn compounds_join_flagged_parts() {
        let aff = "COMPOUNDFLAG X\nCOMPOUNDMIN 3\nONLYINCOMPOUND O\nSFX S Y 1\nSFX S 0 en .\n";
@@ -237,6 +237,132 @@ fn pasted_shapes_get_the_next_automatic_name() {
    assert_eq!(names(&s).last().unwrap(), "Hero");
 }

+/// PowerPoint 16.0 (Windows): on "Rectangle 1, Oval 2, TextBox 3, Hero" Duplicate gives
+/// "Rectangle 5" and then "Rectangle 6", "TextBox 7"; the copy of "Hero" (and of its copy) is
+/// "Hero". Never "Hero copy".
+#[test]
+fn duplicate_gives_the_next_automatic_name_and_keeps_a_chosen_one() {
+    let mut s = session();
+    let names = |s: &Session| s.doc().unwrap().current_slide().unwrap().shapes.iter().map(|x| x.name.clone()).collect::<Vec<_>>();
+    let add = |s: &mut Session, cmd: &str, p: serde_json::Value| {
+        s.execute(cmd, &p).unwrap();
+        s.doc().unwrap().selection.shapes[0].0
+    };
+    let rect = add(&mut s, "shape.insert", json!({"preset": "rect", "rect": [10, 10, 50, 50]}));
+    let tb = add(&mut s, "shape.insert", json!({"preset": "rect", "rect": [100, 10, 50, 50]}));
+    s.execute("shape.rename", &json!({"id": tb, "name": "Hero"})).unwrap();
+    let n = names(&s).len();
+    let auto = names(&s)[n - 2].clone();
+    let (base, _) = auto.rsplit_once(' ').unwrap();
+
+    s.execute("edit.duplicate", &json!({"ids": [rect]})).unwrap();
+    s.execute("edit.duplicate", &json!({"ids": [rect]})).unwrap();
+    let all = names(&s);
+    assert_eq!(all[n], format!("{base} {}", n + 1), "{all:?}");
+    assert_eq!(all[n + 1], format!("{base} {}", n + 2), "{all:?}");
+
+    s.execute("edit.duplicate", &json!({"ids": [tb]})).unwrap();
+    let copy = s.doc().unwrap().selection.shapes[0].0;
+    s.execute("edit.duplicate", &json!({"ids": [copy]})).unwrap();
+    let all = names(&s);
+    assert_eq!(&all[n + 2..], ["Hero", "Hero"], "{all:?}");
+}
+
+/// Two shapes sharing a chosen name are still two shapes: the next number follows the count.
+#[test]
+fn duplicate_numbers_from_the_shape_count_when_names_repeat() {
+    let mut s = session();
+    s.execute("shape.insert", &json!({"preset": "rect", "rect": [10, 10, 50, 50]})).unwrap();
+    let rect = s.doc().unwrap().selection.shapes[0].0;
+    s.execute("shape.insert", &json!({"preset": "rect", "rect": [100, 10, 50, 50]})).unwrap();
+    let hero = s.doc().unwrap().selection.shapes[0].0;
+    s.execute("shape.rename", &json!({"id": hero, "name": "Hero"})).unwrap();
+    s.execute("edit.duplicate", &json!({"ids": [hero]})).unwrap();
+    let before = s.doc().unwrap().current_slide().unwrap().shapes.len();
+    s.execute("edit.duplicate", &json!({"ids": [rect]})).unwrap();
+    let doc = s.doc().unwrap();
+    let shapes = &doc.current_slide().unwrap().shapes;
+    let source = shapes.iter().find(|x| x.id.0 == rect).unwrap();
+    let base = source.name.rsplit_once(' ').unwrap().0;
+    let names: Vec<_> = shapes.iter().map(|x| x.name.as_str()).collect();
+    assert_eq!(shapes[before].name, format!("{base} {}", before + 1), "{names:?}");
+}
+
+/// The next automatic name looks at the names inside groups too.
+#[test]
+fn duplicating_a_group_does_not_repeat_the_names_of_its_members() {
+    let mut s = session();
+    let mut ids = vec![];
+    for x in [10, 70, 130, 190] {
+        s.execute("shape.insert", &json!({"preset": "rect", "rect": [x, 10, 50, 50]})).unwrap();
+        ids.push(s.doc().unwrap().selection.shapes[0].0);
+    }
+    s.execute("arrange.group", &json!({"ids": [ids[2], ids[3]]})).unwrap();
+    let group = s.doc().unwrap().selection.shapes[0].0;
+    // Fewer top-level shapes than names in use: the next number is one a member already has.
+    s.execute("edit.delete", &json!({"ids": [ids[0], ids[1]]})).unwrap();
+    s.execute("edit.duplicate", &json!({"ids": [group]})).unwrap();
+    let doc = s.doc().unwrap();
+    let mut all = vec![];
+    deckcraft_model::walk(&doc.current_slide().unwrap().shapes, &mut |sh, _| all.push(sh.name.clone()));
+    let mut unique = all.clone();
+    unique.sort();
+    unique.dedup();
+    assert_eq!(unique.len(), all.len(), "{all:?}");
+}
+
+/// A shape inserted or pasted after a group was duplicated takes none of its members' names.
+#[test]
+fn inserting_after_duplicating_a_group_does_not_repeat_a_member_name() {
+    let mut s = session();
+    let mut ids = vec![];
+    for x in [10, 70] {
+        s.execute("shape.insert", &json!({"preset": "rect", "rect": [x, 10, 50, 50]})).unwrap();
+        ids.push(s.doc().unwrap().selection.shapes[0].0);
+    }
+    s.execute("arrange.group", &json!({"ids": ids})).unwrap();
+    let group = s.doc().unwrap().selection.shapes[0].0;
+    s.execute("edit.duplicate", &json!({"ids": [group]})).unwrap();
+    // Fewer top-level shapes than shapes: counting only the top level reaches a member's number.
+    for x in [130, 190, 250] {
+        s.execute("shape.insert", &json!({"preset": "rect", "rect": [x, 10, 50, 50]})).unwrap();
+    }
+    s.execute("edit.copy", &json!({})).unwrap();
+    s.execute("edit.paste", &json!({})).unwrap();
+    let doc = s.doc().unwrap();
+    let mut all = vec![];
+    deckcraft_model::walk(&doc.current_slide().unwrap().shapes, &mut |sh, _| all.push(sh.name.clone()));
+    let mut unique = all.clone();
+    unique.sort();
+    unique.dedup();
+    assert_eq!(unique.len(), all.len(), "{all:?}");
+}
+
+/// Group members are renamed like any other copied shape.
+#[test]
+fn duplicating_a_group_renames_its_automatic_children() {
+    let mut s = session();
+    let mut ids = vec![];
+    for x in [10, 100] {
+        s.execute("shape.insert", &json!({"preset": "rect", "rect": [x, 10, 50, 50]})).unwrap();
+        ids.push(s.doc().unwrap().selection.shapes[0].0);
+    }
+    s.execute("arrange.group", &json!({"ids": ids})).unwrap();
+    let group = s.doc().unwrap().selection.shapes[0].0;
+    s.execute("edit.duplicate", &json!({"ids": [group]})).unwrap();
+    let doc = s.doc().unwrap();
+    let shapes = &doc.current_slide().unwrap().shapes;
+    let (orig, copy) = (&shapes[shapes.len() - 2], &shapes[shapes.len() - 1]);
+    assert!(orig.is_group() && copy.is_group());
+    assert_ne!(orig.name, copy.name);
+    assert!(copy.name.starts_with("Group "), "{}", copy.name);
+    let all: Vec<_> = orig.children().iter().chain(copy.children()).map(|c| c.name.as_str()).collect();
+    let mut unique = all.clone();
+    unique.sort();
+    unique.dedup();
+    assert_eq!(unique.len(), all.len(), "{all:?}");
+}
+
 #[test]
 fn pasting_after_a_deleted_shape_does_not_repeat_a_name() {
    let mut s = session();
@@ -1425,6 +1551,14 @@ fn opening_a_file_lists_the_fonts_it_uses_that_are_missing() {
    assert!(s.doc().unwrap().missing_fonts.is_empty());
 }

+#[test]
+fn a_macos_hidden_system_font_is_not_reported_missing() {
+    let mut s = Session::with_new();
+    let r = s.execute("file.openBytes", &json!({"name": "a.pptx", "data": deck_in_font(".SF NS")})).unwrap();
+    assert_eq!(r["missingFonts"], json!([]));
+    assert!(s.doc().unwrap().missing_fonts.is_empty());
+}
+
 #[test]
 fn an_embedded_face_is_used_when_the_machine_lacks_it() {
    let mut p = deckcraft_model::Presentation::default();
@@ -2320,6 +2454,15 @@ fn shape_effects_props_adjust_shadow_glow_and_reflection() {
    let f = fx(&s);
    assert!(f.outer_shadow.is_none());
    assert_eq!(f.inner_shadow.unwrap().blur, 3.0);
+    // Size scales both axes (PowerPoint's 0–200%); out-of-range values clamp.
+    s.execute("shape.effects", &json!({"shadow": "inner"})).unwrap();
+    s.execute("shape.effects", &json!({"shadowProps": {"size": 1.5}})).unwrap();
+    let sw = fx(&s).inner_shadow.unwrap();
+    assert_eq!((sw.sx, sw.sy), (1.5, 1.5));
+    s.execute("shape.effects", &json!({"shadowProps": {"size": 9}})).unwrap();
+    assert_eq!(fx(&s).inner_shadow.unwrap().sx, 2.0);
+    s.execute("shape.effects", &json!({"shadowProps": {"size": 0}})).unwrap();
+    assert_eq!(fx(&s).inner_shadow.unwrap().sy, 0.01);
    // Glow: size, colour, transparency; size 0 removes it.
    s.execute("shape.effects", &json!({"glowProps": {"radius": 12, "transparency": 0.5}})).unwrap();
    let g = fx(&s).glow.unwrap();
@@ -4421,6 +4564,16 @@ fn autoformat_starts_bulleted_and_numbered_lists_as_you_type() {
    assert_eq!(s.execute("text.autocorrect", &json!({})).unwrap()["lists"], true);
    s.execute("text.autocorrect", &json!({"lists": false})).unwrap();
    assert_eq!(typed(&mut s, "* x"), ("* x".to_string(), none));
+    // List AutoFormat is independent of the Replace text as you type setting.
+    s.execute("text.autocorrect", &json!({"on": false, "lists": true})).unwrap();
+    assert_eq!(typed(&mut s, "*"), ("*".to_string(), Some(Bullet::None)));
+    s.execute("text.insert", &json!({"text": " "})).unwrap();
+    assert_eq!(para(&s), (String::new(), ch("•")));
+    s.execute("text.delete", &json!({"dir": "backward"})).unwrap();
+    assert_eq!(para(&s), ("* ".to_string(), Some(Bullet::None)));
+    // Word replacements still run while list formatting is disabled.
+    s.execute("text.autocorrect", &json!({"on": true, "lists": false})).unwrap();
+    assert_eq!(typed(&mut s, "teh "), ("The ".to_string(), Some(Bullet::None)));
 }

 #[test]
@@ -5646,3 +5799,160 @@ fn invalid_ids_array_never_falls_back_to_the_selection() {
        assert!(s.doc().unwrap().shape(deckcraft_model::ShapeId(a as u32)).is_some(), "shape deleted for {ids}");
    }
 }
+
+#[test]
+fn table_cell_align_sets_the_horizontal_alignment() {
+    use deckcraft_model::text::{Align, Anchor};
+    let mut s = session();
+    let id = table_at(&mut s, &[100.0, 100.0], json!([["a", "b"], ["c", "d"]]));
+    s.execute("table.cellAlign", &json!({"id": id.0, "align": "center", "cells": [[0, 0], [1, 0]]})).unwrap();
+    s.execute("table.cellAlign", &json!({"id": id.0, "align": "right", "anchor": "bottom", "cells": [[0, 1]]})).unwrap();
+    let t = table_of(&s, id);
+    let al = |r, c| t.cell(r, c).unwrap().text.paragraphs.iter().map(|p| p.props.align).collect::<Vec<_>>();
+    assert_eq!(al(0, 0), vec![Some(Align::Center)]);
+    assert_eq!(al(1, 0), vec![Some(Align::Center)]);
+    assert_eq!(al(0, 1), vec![Some(Align::Right)]);
+    assert_eq!(al(1, 1), vec![None], "other cells are untouched");
+    assert_eq!(t.cell(0, 1).unwrap().anchor, Some(Anchor::Bottom));
+    assert_eq!(t.cell(0, 0).unwrap().anchor, None, "align alone leaves the vertical anchor");
+    assert!(s.execute("table.cellAlign", &json!({"id": id.0, "align": "diagonal"})).is_err());
+    // A value that is not a name is refused, not read as absent (which would set the anchor to top).
+    let rev = s.doc().unwrap().revision;
+    assert!(s.execute("table.cellAlign", &json!({"id": id.0, "align": 1})).is_err());
+    assert!(s.execute("table.cellAlign", &json!({"id": id.0, "align": "left", "anchor": true})).is_err());
+    assert_eq!(s.doc().unwrap().revision, rev);
+}
+
+/// In Slide Master / layout view the insert commands edit the master or layout; their answers say
+/// so with `editing`, and on slides carry no such key.
+#[test]
+fn insert_answers_carry_editing_in_master_and_layout_view() {
+    let mut s = session();
+    let ins = json!({"preset": "rect", "rect": [10.0, 10.0, 100.0, 100.0]});
+    s.execute("view.slideMaster", &json!({"layout": 0})).unwrap();
+    let r = s.execute("shape.insert", &ins).unwrap();
+    assert_eq!(r["editing"]["kind"], "layout", "{r}");
+    assert!(r["editing"]["name"].is_string(), "{r}");
+    let r = s.execute("insert.textBox", &json!({"rect": [10.0, 10.0, 100.0, 50.0], "text": "x"})).unwrap();
+    assert_eq!(r["editing"]["kind"], "layout", "{r}");
+    s.execute("view.slideMaster", &json!({"master": 0})).unwrap();
+    let r = s.execute("shape.insert", &ins).unwrap();
+    assert_eq!(r["editing"]["kind"], "master", "{r}");
+    s.execute("view.closeMaster", &json!({})).unwrap();
+    let r = s.execute("shape.insert", &ins).unwrap();
+    assert!(r.get("editing").is_none(), "{r}");
+}
+
+/// MM4: moving a group's child through a command refits the group's box to its children, as
+/// PowerPoint does, and the children stay where they were drawn.
+#[test]
+fn moving_a_group_child_refits_the_group() {
+    let mut s = session();
+    s.execute("slide.new", &json!({"layout": "blank"})).unwrap();
+    let ins = |s: &mut Session, p: serde_json::Value| s.execute("shape.insert", &p).unwrap()["id"].as_u64().unwrap();
+    let a = ins(&mut s, json!({"preset": "rect", "rect": [100, 100, 100, 50]}));
+    let b = ins(&mut s, json!({"preset": "rect", "rect": [300, 100, 100, 50]}));
+    let g = s.execute("arrange.group", &json!({"ids": [a, b]})).unwrap()["id"].as_u64().unwrap();
+    let gb = |s: &Session| s.doc().unwrap().shape(ShapeId(g as u32)).unwrap().xfrm.unwrap();
+    assert_eq!((gb(&s).x, gb(&s).w), (100.0, 300.0));
+    s.execute("shape.move", &json!({"id": b, "dx": 100, "dy": 60})).unwrap();
+    let x = gb(&s);
+    assert_eq!((x.x, x.y, x.w, x.h), (100.0, 100.0, 400.0, 110.0), "group follows its children: {x:?}");
+    // The child is where it was moved to on the slide.
+    let r = s.execute("slide.inspect", &json!({})).unwrap();
+    assert!(r.to_string().contains("400"), "{r}");
+    s.execute("shape.setBounds", &json!({"ids": [a], "x": 20, "y": 20, "w": 100, "h": 50})).unwrap();
+    let x = gb(&s);
+    assert_eq!((x.x, x.y, x.w), (20.0, 20.0, 480.0), "{x:?}");
+}
+
+/// HH9: Reset Picture discards the picture's formatting (adjustments, artistic effect, picture
+/// style effects and outline) but not the frame's shape (Change Shape / Crop to Shape).
+#[test]
+fn picture_reset_keeps_the_frame_shape() {
+    let mut img = image::RgbaImage::new(40, 30);
+    img.pixels_mut().for_each(|p| *p = image::Rgba([200, 30, 30, 255]));
+    let mut png = Vec::new();
+    image::DynamicImage::ImageRgba8(img).write_to(&mut std::io::Cursor::new(&mut png), image::ImageFormat::Png).unwrap();
+    let mut s = Session::with_new();
+    s.execute("slide.new", &json!({"layout": "blank"})).unwrap();
+    s.execute("insert.picture", &json!({"name": "a.png", "data": cmd::base64_encode(&png)})).unwrap();
+    s.execute("shape.change", &json!({"preset": "roundRect"})).unwrap();
+    s.execute("picture.adjust", &json!({"brightness": 0.3})).unwrap();
+    let geom = s.doc().unwrap().selected_shapes()[0].geom.clone();
+    assert_ne!(geom, deckcraft_model::Geom::preset("rect"));
+    s.execute("picture.reset", &json!({})).unwrap();
+    let sh = s.doc().unwrap().selected_shapes()[0].clone();
+    assert_eq!(sh.geom, geom, "the frame shape stays");
+    match &sh.kind {
+        deckcraft_model::ShapeKind::Picture { fill } => assert_eq!(fill.adjust, Default::default()),
+        _ => panic!("not a picture"),
+    }
+    let doc = command_specs().iter().find(|c| c.id == "picture.reset").unwrap().params;
+    assert!(doc.contains("frame shape"), "{doc}");
+}
+
+/// HH12: exporting the same slide twice to one PNG path after an edit overwrites the file with
+/// the new picture (not a bug: the second file differs).
+#[test]
+fn exporting_a_slide_again_overwrites_the_png_with_the_edit() {
+    /// Removes the folder when the test ends, a failed assertion included.
+    struct Cleanup(std::path::PathBuf);
+    impl Drop for Cleanup {
+        fn drop(&mut self) {
+            let _ = std::fs::remove_dir_all(&self.0);
+        }
+    }
+    // A folder of this run's own: created exclusively (never one an earlier or parallel run left).
+    let stamp = std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH).map_or(0, |d| d.as_nanos());
+    let dir = (0..100)
+        .map(|k| std::env::temp_dir().join(format!("deckcraft-hh12-{}-{stamp}-{k}", std::process::id())))
+        .find(|d| std::fs::create_dir(d).is_ok())
+        .expect("a fresh temporary folder");
+    let _cleanup = Cleanup(dir.clone());
+    let png = dir.join("slide.png");
+    let mut s = session();
+    let path = png.to_string_lossy().to_string();
+    s.execute("file.export", &json!({"path": path, "format": "png", "slide": 0, "scale": 0.5})).unwrap();
+    let first = std::fs::read(&png).unwrap();
+    s.execute("shape.insert", &json!({"preset": "rect", "rect": [100, 100, 400, 300]})).unwrap();
+    s.execute("shape.fill", &json!({"color": "#FF0000"})).unwrap();
+    s.execute("file.export", &json!({"path": path, "format": "png", "slide": 0, "scale": 0.5})).unwrap();
+    let second = std::fs::read(&png).unwrap();
+    assert_ne!(first, second, "the second export replaced the file with the edited slide");
+}
+
+#[test]
+fn action_button_fill_follows_the_theme() {
+    let mut s = session();
+    let id = s.execute("insert.actionButton", &json!({"kind": "next"})).unwrap()["id"].clone();
+    let fill = |s: &mut Session| {
+        let r = s.execute("slide.inspect", &json!({})).unwrap();
+        r["shapes"].as_array().unwrap().iter().find(|x| x["id"] == id).unwrap()["fill"].clone()
+    };
+    let before = fill(&mut s);
+    assert!(before.as_str().is_some_and(|f| f.starts_with('#')), "{before}");
+    s.execute("design.theme", &json!({"name": "Ember"})).unwrap();
+    let after = fill(&mut s);
+    assert_ne!(before, after, "the button takes the new theme's accent1");
+    let st = s.doc().unwrap();
+    let sh = st.doc.slides[0].shapes.iter().find(|x| x.fill.is_none() && x.style.is_some()).unwrap();
+    assert!(sh.fill.is_none(), "no explicit fill: the style binds it to accent1");
+}
+
+#[test]
+fn invalid_slide_index_never_falls_back_to_the_selection_in_export_commands() {
+    let mut s = session();
+    let dir = std::env::temp_dir().join(format!("deckcraft-badslide-{}", std::process::id()));
+    let path = dir.join("a.png");
+    for slide in [json!(-1), json!(1.5), json!("two")] {
+        let r = s.execute("file.export", &json!({"path": path.to_string_lossy(), "slide": slide, "scale": 0.1}));
+        assert!(matches!(r, Err(crate::EngineError::BadParams { .. })), "export slide {slide} gave {r:?}");
+        assert!(!path.exists(), "export wrote a file for {slide}");
+        let r = s.execute("file.render", &json!({"slide": slide, "scale": 0.1}));
+        assert!(matches!(r, Err(crate::EngineError::BadParams { .. })), "render slide {slide} gave {r:?}");
+        let r = s.execute("slide.colorAt", &json!({"slide": slide, "x": 1, "y": 1, "scale": 0.1}));
+        assert!(matches!(r, Err(crate::EngineError::BadParams { .. })), "colorAt slide {slide} gave {r:?}");
+    }
+    let _ = std::fs::remove_dir_all(&dir);
+}
@@ -206,7 +206,7 @@ impl Session {
        let Some(f) = st.shape(id).and_then(|sh| cmd::table::table_frame(st, sh)) else { return Ok(()) };
        let size = if column { f.cols.get(index) } else { f.heights.get(index) }.copied().unwrap_or(0.0);
        let (start, frame) = (f.local(p), f.affine);
-        if !st.selection.text.as_ref().is_some_and(|t| t.shape == id) {
+        if st.selection.text.as_ref().is_none_or(|t| t.shape != id) {
            self.select(|_, sel| {
                sel.shapes = vec![id];
                sel.text = None;
@@ -455,12 +455,11 @@ impl Session {
                    self.execute("guide.move", &json!({"index": index, "pos": pos}))?
                };
            }
-            Some(Drag::Move { moved: false, enter_text: Some((id, at)), .. }) => {
+            Some(Drag::Move { moved: false, enter_text: Some((id, at)), .. })
                // Plain click on text: caret at the click (in a table, in the clicked cell).
-                if self.edit_text_at(id, at)? {
+                if self.edit_text_at(id, at)? => {
                    out = json!({"editing": id});
                }
-            }
            Some(Drag::Marquee { start, add }) => {
                let r = Rect::from_points(start, p);
                self.tool.marquee = None;
@@ -393,6 +393,22 @@ fn legacy_names(f: &skrifa::FontRef<'_>, family: &str) -> Option<(String, String
    Some((legacy, name(f, &[StringId::SUBFAMILY_NAME]).unwrap_or_else(|| "Regular".into())))
 }

+/// The Windows family and style a variable font's named instance answers to. Windows lists each
+/// instance other than Regular, Italic, Bold and Bold Italic as a family of its own, as the
+/// family's static files name themselves: "Montserrat ExtraBold" / "Regular" for the ExtraBold
+/// instance, "Montserrat ExtraBold" / "Italic" for ExtraBold Italic.
+fn instance_legacy_names(family: &str, style: &str) -> Option<(String, String)> {
+    if style.contains('{') {
+        return None;
+    }
+    let weight: Vec<&str> = style.split_whitespace().filter(|w| !matches!(norm(w).as_str(), "italic" | "oblique")).collect();
+    let weight = weight.join(" ");
+    if matches!(norm(&weight).as_str(), "" | "regular" | "bold") {
+        return None;
+    }
+    Some((format!("{family} {weight}"), if style_italic(style) { "Italic" } else { "Regular" }.into()))
+}
+
 /// The tables skrifa reads glyph outlines from: `glyf` (TrueType), `CFF `, `CFF2` and `VARC`. For a
 /// face with none of them (bitmaps only, or outlines in Apple's `hvgl` table), [`FontDb::outline`]
 /// returns an empty path for every glyph.
@@ -604,21 +620,55 @@ fn fontconfig_dirs(text: &str, data_home: Option<&str>, home: Option<&std::path:
 /// axis settings.
 type Found = (u32, String, String, Vec<([u8; 4], f32)>);

+/// Maximum number of faces we enumerate from a single font collection.
+const MAX_COLLECTION_FACES: u32 = 256;
+/// Maximum collection entries inspected while looking for distinct table directories.
+const MAX_COLLECTION_ENTRIES_SCANNED: u32 = 16_384;
+/// Maximum named instances read from a single face.
+const MAX_NAMED_INSTANCES_PER_FACE: usize = 1024;
+
+fn distinct_face_indices(entries: impl IntoIterator<Item = (u32, u32)>) -> Vec<u32> {
+    let mut offsets = std::collections::HashSet::new();
+    let mut indices = Vec::with_capacity(MAX_COLLECTION_FACES as usize);
+    for (index, offset) in entries.into_iter().take(MAX_COLLECTION_ENTRIES_SCANNED as usize) {
+        if offsets.insert(offset) {
+            indices.push(index);
+            if indices.len() == MAX_COLLECTION_FACES as usize {
+                break;
+            }
+        }
+    }
+    indices
+}
+
+fn capped_named_instance_count(count: usize) -> usize {
+    count.min(MAX_NAMED_INSTANCES_PER_FACE)
+}
+
 /// Parse every face in `data` (a font file or collection); a variable font yields one face per
 /// named instance (InDesign lists them as styles).
 fn enumerate_faces(data: &[u8]) -> Vec<Found> {
-    let count = match FileRef::new(data) {
-        Ok(FileRef::Font(_)) => 1,
-        Ok(FileRef::Collection(c)) => c.len(),
-        Err(_) => 0,
+    let indices = match FileRef::new(data) {
+        Ok(FileRef::Font(_)) => vec![0],
+        Ok(FileRef::Collection(c)) => {
+            let entries = (0..c.len().min(MAX_COLLECTION_ENTRIES_SCANNED)).filter_map(|i| {
+                let start = 12usize.checked_add((i as usize).checked_mul(4)?)?;
+                let end = start.checked_add(4)?;
+                let offset = u32::from_be_bytes(data.get(start..end)?.try_into().ok()?);
+                Some((i, offset))
+            });
+            distinct_face_indices(entries)
+        }
+        Err(_) => Vec::new(),
    };
    let mut out = Vec::new();
-    for i in 0..count {
+    for i in indices {
        let Ok(f) = skrifa::FontRef::from_index(data, i) else { continue };
        let Some((family, style)) = face_names(&f) else { continue };
        let axes = f.axes();
        let mut named = Vec::new();
-        for ni in f.named_instances().iter() {
+        let instances = f.named_instances();
+        for ni in instances.iter().take(capped_named_instance_count(instances.len())) {
            let Some(style) = name(&f, &[ni.subfamily_name_id()]) else { continue };
            if named.iter().any(|(_, s, _): &(u32, String, _)| s.eq_ignore_ascii_case(&style)) {
                continue;
@@ -686,7 +736,7 @@ fn make_face(bytes: FontBytes, index: u32, family: String, style: String, coords
        .map(|v| v >= 0.5)
        .or(axis(b"slnt").map(|v| v.abs() > 0.1))
        .unwrap_or(!matches!(a.style, skrifa::attribute::Style::Normal) || style_italic(&style));
-    let legacy = if coords.is_empty() { legacy_names(&f, &family) } else { None };
+    let legacy = if coords.is_empty() { legacy_names(&f, &family) } else { instance_legacy_names(&family, &style) };
    Some(FontFace {
        id: NEXT_ID.fetch_add(1, Ordering::Relaxed),
        family,
@@ -1435,6 +1485,24 @@ mod font_dir_tests {

    use super::*;

+    #[test]
+    fn duplicate_collection_offsets_do_not_consume_face_cap() {
+        let mut entries = vec![(0, 7); MAX_COLLECTION_FACES as usize];
+        entries.extend((0..MAX_COLLECTION_FACES).map(|i| (i + MAX_COLLECTION_FACES, i + 8)));
+        let faces = distinct_face_indices(entries);
+        assert_eq!(faces.len(), MAX_COLLECTION_FACES as usize);
+        assert_eq!(faces.first(), Some(&0));
+        assert_eq!(faces.get(1), Some(&MAX_COLLECTION_FACES));
+        assert_eq!(faces.last(), Some(&(MAX_COLLECTION_FACES * 2 - 2)));
+    }
+
+    #[test]
+    fn named_instance_limit_is_bounded_per_face() {
+        assert_eq!(capped_named_instance_count(0), 0);
+        assert_eq!(capped_named_instance_count(MAX_NAMED_INSTANCES_PER_FACE), MAX_NAMED_INSTANCES_PER_FACE);
+        assert_eq!(capped_named_instance_count(MAX_NAMED_INSTANCES_PER_FACE + 1), MAX_NAMED_INSTANCES_PER_FACE);
+    }
+
    #[test]
    fn xdg_data_dirs_contribute_their_fonts_folders() {
        let home = Path::new("/home/ann");
@@ -147,6 +147,36 @@ fn windows_family_names_find_their_faces() {
    }
 }

+#[test]
+fn variable_font_instances_answer_to_their_windows_names() {
+    // Windows lists a variable font's named instances other than Regular, Italic, Bold and
+    // Bold Italic as families of their own, and documents name them that way ("Montserrat
+    // ExtraBold"). The bundled Montserrat is variable, so these names found no face and drew
+    // in Inter Regular, even with the family's static files installed (their faces are
+    // skipped as already present).
+    let db = FontDb::with_font_dirs(Vec::new());
+    db.set_system_fallback(false);
+    if !db.is_loaded("Montserrat") {
+        return; // built without craft-fonts
+    }
+    for (name, style, weight, italic) in [
+        ("Montserrat ExtraBold", "Regular", 800.0, false),
+        ("Montserrat SemiBold", "Regular", 600.0, false),
+        ("Montserrat Medium", "Regular", 500.0, false),
+        ("Montserrat Medium", "Italic", 500.0, true),
+        ("Montserrat Thin", "Bold", 100.0, false),
+    ] {
+        assert!(db.has_family(name), "{name}");
+        let f = db.face(name, style);
+        assert_eq!((f.family.as_str(), f.weight, f.italic), ("Montserrat", weight, italic), "{name} {style}");
+        assert_eq!(db.document_face(name, style).family, "Montserrat", "{name}: installed, so not Calibri");
+    }
+    // Regular and Bold are the family itself, not families of their own.
+    assert!(!db.has_family("Montserrat Regular"));
+    assert!(!db.has_family("Montserrat Bold"));
+    assert_eq!(db.face("Montserrat", "Bold").weight, 700.0);
+}
+
 #[test]
 fn faces_without_outlines_are_not_cataloged() {
    // Rename the Semibold's `glyf` table, as in fonts whose glyphs are bitmaps or are stored in
@@ -557,16 +557,16 @@ impl Decoder {

 /// Decode all slices of one picture and publish its rows.
 fn run_job(frame: FrameRef, slices: Vec<SliceJob>, shared: &Shared, draft: bool) {
-    let reuse = shared.pool.lock().ok().and_then(|mut p| p.pop());
-    let mut pic = match reuse {
-        Some(mut p) if p.mb_w == frame.mb_w && p.mb_h == frame.mb_h() => {
-            p.reset(frame.clone());
-            p
-        }
-        _ => PicState::new(frame.clone()),
-    };
-    pic.skip_deblock = draft;
    let result = std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| {
+        let reuse = shared.pool.lock().ok().and_then(|mut p| p.pop());
+        let mut pic = match reuse {
+            Some(mut p) if p.mb_w == frame.mb_w && p.mb_h == frame.mb_h() => {
+                p.reset(frame.clone());
+                p
+            }
+            _ => PicState::new(frame.clone()),
+        };
+        pic.skip_deblock = draft;
        let mut first_err = None;
        for s in &slices {
            if let Err(e) = decode_slice(s, &mut pic) {
@@ -574,10 +574,10 @@ fn run_job(frame: FrameRef, slices: Vec<SliceJob>, shared: &Shared, draft: bool)
            }
        }
        pic.flush_rows(true);
-        first_err
+        (pic, first_err)
    }));
-    let err = match result {
-        Ok(e) => e,
+    let (pic, err) = match result {
+        Ok((pic, err)) => (Some(pic), err),
        Err(_) => {
            // Make sure readers never block on this frame.
            let fallback = Planes::gray(frame.width, frame.height);
@@ -587,34 +587,35 @@ fn run_job(frame: FrameRef, slices: Vec<SliceJob>, shared: &Shared, draft: bool)
                    frame.publish(r, Frame::make_row(&fallback, r, &blank, &|_, _, _| u32::MAX));
                }
            }
-            pic = PicState::new(frame.clone());
-            Some(Error::Invalid("internal error while decoding a picture".into()))
+            (None, Some(Error::Invalid("internal error while decoding a picture".into())))
        }
    };
    if let Ok(mut s) = shared.stats.lock() {
        s.pictures += 1;
        s.draft_pictures += draft as u64;
-        for st in &pic.mbs {
-            match st.kind {
-                MbKind::I4x4 => s.mb_i4x4 += 1,
-                MbKind::I8x8 => s.mb_i8x8 += 1,
-                MbKind::I16x16 => s.mb_i16x16 += 1,
-                MbKind::IPcm => s.mb_pcm += 1,
-                MbKind::PSkip => s.mb_p_skip += 1,
-                MbKind::BSkip => s.mb_b_skip += 1,
-                MbKind::BDirect16x16 => s.mb_b_direct16x16 += 1,
-                MbKind::Inter => s.mb_inter += 1,
-                MbKind::None => {}
-            }
-            if st.transform_8x8 && !st.kind.is_intra() {
-                s.mb_inter_8x8_transform += 1;
+        if let Some(pic) = &pic {
+            for st in &pic.mbs {
+                match st.kind {
+                    MbKind::I4x4 => s.mb_i4x4 += 1,
+                    MbKind::I8x8 => s.mb_i8x8 += 1,
+                    MbKind::I16x16 => s.mb_i16x16 += 1,
+                    MbKind::IPcm => s.mb_pcm += 1,
+                    MbKind::PSkip => s.mb_p_skip += 1,
+                    MbKind::BSkip => s.mb_b_skip += 1,
+                    MbKind::BDirect16x16 => s.mb_b_direct16x16 += 1,
+                    MbKind::Inter => s.mb_inter += 1,
+                    MbKind::None => {}
+                }
+                if st.transform_8x8 && !st.kind.is_intra() {
+                    s.mb_inter_8x8_transform += 1;
+                }
            }
        }
    }
    if let (Some(e), Ok(mut slot)) = (err, shared.error.lock()) {
        slot.get_or_insert(e);
    }
-    if let Ok(mut p) = shared.pool.lock()
+    if let (Some(pic), Ok(mut p)) = (pic, shared.pool.lock())
        && p.len() < 4
    {
        p.push(pic);
@@ -561,9 +561,9 @@ fn run_job(
    draft: bool,
    shared: &Shared,
 ) {
-    let mut pic = PicState::new(frame.clone(), sps, pps, layout, scaling);
-    pic.draft = draft;
    let result = std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| {
+        let mut pic = PicState::new(frame.clone(), sps, pps, layout, scaling);
+        pic.draft = draft;
        let mut first_err = None;
        for s in &slices {
            if let Err(e) = SliceDecoder::decode(&mut pic, s) {
@@ -571,10 +571,10 @@ fn run_job(
            }
        }
        crate::filter::finish(&mut pic);
-        first_err
+        (pic, first_err)
    }));
-    let err = match result {
-        Ok(e) => e,
+    let (pic, err) = match result {
+        Ok((pic, err)) => (Some(pic), err),
        Err(_) => {
            // make sure readers never block on this frame
            let gray = Frame::gray(0, frame.poc, &frame);
@@ -584,18 +584,20 @@ fn run_job(
                    frame.publish(r, crate::picture::FrameRow { y: row.y.clone(), cb: row.cb.clone(), cr: row.cr.clone(), col: row.col.clone() });
                }
            }
-            Some(Error::Invalid("internal error while decoding a picture".into()))
+            (None, Some(Error::Invalid("internal error while decoding a picture".into())))
        }
    };
    if let Ok(mut s) = shared.stats.lock() {
        s.pictures += 1;
-        for b in &pic.blk {
-            if b.flags & F_INTRA != 0 {
-                s.intra_4x4_blocks += 1;
-            } else if b.flags & F_SKIP != 0 {
-                s.skip_4x4_blocks += 1;
-            } else if b.flags != 0 {
-                s.inter_4x4_blocks += 1;
+        if let Some(pic) = &pic {
+            for b in &pic.blk {
+                if b.flags & F_INTRA != 0 {
+                    s.intra_4x4_blocks += 1;
+                } else if b.flags & F_SKIP != 0 {
+                    s.skip_4x4_blocks += 1;
+                } else if b.flags != 0 {
+                    s.inter_4x4_blocks += 1;
+                }
            }
        }
    }
@@ -1,6 +1,6 @@
 //! JSON-RPC 2.0 framing and the MCP lifecycle / tools / resources methods.

-use std::io::{BufRead, Write};
+use std::io::{self, BufRead, Write};

 use serde_json::{Value, json};

@@ -17,6 +17,8 @@ const METHOD_NOT_FOUND: i64 = -32601;
 const INVALID_PARAMS: i64 = -32602;
 const INTERNAL_ERROR: i64 = -32603;
 const RESOURCE_NOT_FOUND: i64 = -32002;
+/// Keep request frames in step with the connected backend's reply limit.
+const MAX_FRAME_BYTES: usize = 16 * 1024 * 1024;

 const INSTRUCTIONS: &str = "DeckCraft is a presentation app (a PowerPoint clone). Coordinates are points on the \
 current slide (y down; the default 16:9 slide is 960×540). Every action is a command: find ids and parameters with \
@@ -62,9 +64,16 @@ impl Server {
    /// Serve newline-delimited JSON-RPC until `input` closes. Logs go to stderr only (stdout is
    /// the protocol stream).
    pub fn serve(&mut self, input: impl BufRead, mut output: impl Write) -> std::io::Result<()> {
-        for line in input.lines() {
-            let line = line?;
-            if let Some(reply) = self.handle_line(&line) {
+        let mut input = input;
+        while let Some(frame) = read_frame(&mut input)? {
+            let reply = match frame {
+                Frame::Complete(bytes) => match std::str::from_utf8(&bytes) {
+                    Ok(line) => self.handle_line(line),
+                    Err(_) => Some(error(Value::Null, PARSE_ERROR, "request frame is not valid UTF-8").to_string()),
+                },
+                Frame::TooLarge => Some(error(Value::Null, INVALID_REQUEST, "request frame exceeds 16 MiB").to_string()),
+            };
+            if let Some(reply) = reply {
                output.write_all(reply.as_bytes())?;
                output.write_all(b"\n")?;
                output.flush()?;
@@ -172,3 +181,38 @@ impl Server {
        }
    }
 }
+
+enum Frame {
+    Complete(Vec<u8>),
+    TooLarge,
+}
+
+/// Read through one newline while retaining no more than the documented frame budget.
+fn read_frame(input: &mut impl BufRead) -> io::Result<Option<Frame>> {
+    let mut bytes = Vec::new();
+    let mut too_large = false;
+    loop {
+        let available = input.fill_buf()?;
+        if available.is_empty() {
+            if bytes.is_empty() && !too_large {
+                return Ok(None);
+            }
+            return Ok(Some(if too_large { Frame::TooLarge } else { Frame::Complete(bytes) }));
+        }
+        let count = available.iter().position(|byte| *byte == b'\n').map_or(available.len(), |i| i + 1);
+        if !too_large {
+            let remaining = MAX_FRAME_BYTES.saturating_sub(bytes.len());
+            if count > remaining {
+                too_large = true;
+                bytes.clear();
+            } else {
+                bytes.extend_from_slice(&available[..count]);
+            }
+        }
+        let ended = available[count - 1] == b'\n';
+        input.consume(count);
+        if ended {
+            return Ok(Some(if too_large { Frame::TooLarge } else { Frame::Complete(bytes) }));
+        }
+    }
+}
@@ -10,6 +10,34 @@ fn call(s: &mut Server, id: u64, method: &str, params: Value) -> Value {
    serde_json::from_str(&out).expect("json")
 }

+#[test]
+fn oversized_stdio_frame_is_drained_before_the_next_request() {
+    let mut s = Server::new(Box::new(Headless::new()));
+    let mut input = vec![b'x'; 16 * 1024 * 1024 + 1];
+    input.extend_from_slice(b"\n{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"initialize\"}\n");
+    let mut output = Vec::new();
+    s.serve(std::io::Cursor::new(input), &mut output).unwrap();
+    let replies: Vec<Value> = std::str::from_utf8(&output).unwrap().lines().map(|line| serde_json::from_str(line).unwrap()).collect();
+    assert_eq!(replies.len(), 2);
+    assert_eq!(replies[0]["error"]["code"], -32600);
+    assert!(replies[0]["error"]["message"].as_str().unwrap().contains("16 MiB"));
+    assert_eq!(replies[1]["id"], 1);
+    assert_eq!(replies[1]["result"]["serverInfo"]["name"], "deckcraft");
+}
+
+#[test]
+fn invalid_utf8_stdio_frame_gets_a_parse_error_and_does_not_stop_serving() {
+    let mut s = Server::new(Box::new(Headless::new()));
+    let mut input = b"\xff\n{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"initialize\"}\n".to_vec();
+    let mut output = Vec::new();
+    s.serve(std::io::Cursor::new(&mut input), &mut output).unwrap();
+    let replies: Vec<Value> = std::str::from_utf8(&output).unwrap().lines().map(|line| serde_json::from_str(line).unwrap()).collect();
+    assert_eq!(replies.len(), 2);
+    assert_eq!(replies[0]["error"]["code"], -32700);
+    assert!(replies[0]["error"]["message"].as_str().unwrap().contains("UTF-8"));
+    assert_eq!(replies[1]["result"]["serverInfo"]["name"], "deckcraft");
+}
+
 fn tool(s: &mut Server, name: &str, args: Value) -> Value {
    let r = call(s, 9, "tools/call", json!({"name": name, "arguments": args}));
    let res = &r["result"];
@@ -31,7 +31,9 @@ fn confined(tag: &str, read: bool, write: bool) -> (Server, PathBuf) {
    std::fs::write(base.join("outside/pic.png"), PNG).unwrap();
    std::fs::write(base.join("in2/c.txt"), "Sibling").unwrap();
    let (in_dir, out_dir) = (base.join("in"), base.join("out"));
-    let roots = AutomationRoots::new(read.then_some(in_dir.as_path()), write.then_some(out_dir.as_path())).unwrap();
+    let read = read.then(|| in_dir.to_path_buf()).into_iter().collect::<Vec<_>>();
+    let write = write.then(|| out_dir.to_path_buf()).into_iter().collect::<Vec<_>>();
+    let roots = AutomationRoots::new(&read, &write).unwrap();
    let mut server = Server::new(Box::new(Headless::with_document().with_automation_roots(roots)));
    ok(&mut server, "new_presentation", json!({}));
    (server, base)
@@ -215,7 +217,7 @@ fn without_roots_nothing_is_confined() {
    let _ = std::fs::remove_dir_all(&base);
    std::fs::create_dir_all(&base).unwrap();
    std::fs::write(base.join("a.txt"), "Anywhere").unwrap();
-    let mut server = Server::new(Box::new(Headless::with_document().with_automation_roots(AutomationRoots::new(None, None).unwrap())));
+    let mut server = Server::new(Box::new(Headless::with_document().with_automation_roots(AutomationRoots::new(&[], &[]).unwrap())));
    ok(&mut server, "open_presentation", json!({"path": s(&base.join("a.txt"))}));
    ok(&mut server, "save_presentation", json!({"path": s(&base.join("b.deckcraft"))}));
    assert!(base.join("b.deckcraft").exists());
@@ -50,6 +50,8 @@ const MAX_CHARS: usize = 32_768;
 const MAX_OBJECT_BYTES: usize = 64 * 1024 * 1024;
 /// Nesting depth of region nodes.
 const MAX_REGION_DEPTH: usize = 32;
+/// Region nodes and path points parsed together, including nodes in sibling branches.
+const MAX_REGION_WORK: usize = MAX_POINTS;

 const TA_RIGHT: u32 = 2;
 const TA_CENTER: u32 = 6;
@@ -93,7 +95,7 @@ impl Fill {
                if w == 0.0 || h == 0.0 {
                    return [0, 0, 0, 0];
                }
-                if *wrap == 4 && !(0.0..w).contains(&p.0) || *wrap == 4 && !(0.0..h).contains(&p.1) {
+                if *wrap == 4 && !((0.0..w).contains(&p.0) && (0.0..h).contains(&p.1)) {
                    return [0, 0, 0, 0];
                }
                let x = (p.0.rem_euclid(w) as usize).min(img.w - 1);
@@ -1106,12 +1108,14 @@ fn path(r: Bytes) -> Option<Vec<Op>> {
 /// A region object as a convex area in world units (non-convex parts become their bounding
 /// rectangle).
 fn region(r: Bytes) -> Option<Obj> {
-    region_node(r, 8, 0).map(|(a, _)| Obj::Region(a))
+    let mut work = 0;
+    region_node(r, 8, 0, &mut work).map(|(a, _)| Obj::Region(a))
 }

 /// One region node at `off`: its area and its length in bytes.
-fn region_node(r: Bytes, off: usize, depth: usize) -> Option<(Area, usize)> {
-    if depth > MAX_REGION_DEPTH {
+fn region_node(r: Bytes, off: usize, depth: usize, work: &mut usize) -> Option<(Area, usize)> {
+    *work = work.checked_add(1)?;
+    if depth > MAX_REGION_DEPTH || *work > MAX_REGION_WORK {
        return None;
    }
    match r.u32(off)? {
@@ -1121,14 +1125,23 @@ fn region_node(r: Bytes, off: usize, depth: usize) -> Option<(Area, usize)> {
        }
        0x1000_0001 => {
            let size = r.u32(off + 4)? as usize;
-            let area = path(r.tail(off + 8)?).map(|ops| area_of_ops(&ops)).unwrap_or_default();
+            if size < 12 {
+                return None;
+            }
+            let data = Bytes(r.slice(off + 8, size)?);
+            let points = (data.u32(4)? as usize).min(MAX_POINTS);
+            *work = work.checked_add(points)?;
+            if *work > MAX_REGION_WORK {
+                return None;
+            }
+            let area = area_of_ops(&path(data)?);
            Some((Some(area), 8usize.checked_add(size)?))
        }
        0x1000_0002 => Some((Some(Vec::new()), 4)),
        0x1000_0003 => Some((None, 4)),
        mode @ 0..=5 => {
-            let (a, la) = region_node(r, off + 4, depth + 1)?;
-            let (b, lb) = region_node(r, off.checked_add(4 + la)?, depth + 1)?;
+            let (a, la) = region_node(r, off + 4, depth + 1, work)?;
+            let (b, lb) = region_node(r, off.checked_add(4 + la)?, depth + 1, work)?;
            let out = match mode {
                0 => b,
                1 => area_intersect(a, b),
@@ -1875,6 +1875,34 @@ fn emfplus_region_clip_intersects_rectangles() {
    assert_eq!((p.width, p.height), (20.0, 20.0));
 }

+#[test]
+fn emfplus_region_path_cannot_read_into_its_sibling() {
+    let rect = |r: [f32; 4]| cat(vec![h32(0x1000_0000), f32s(&r)]);
+    // The path declares only its 12-byte header, but claims three points. The following
+    // rectangle must not supply those points or be parsed twice as the next node.
+    let path = cat(vec![h32(0x1000_0001), h32(12), h32(0), h32(3), h32(0)]);
+    let region = cat(vec![h32(0xDBC0_1002), h32(2), h32(1), path, rect([10.0, 10.0, 20.0, 20.0])]);
+    let fill = prec(0x400A, 0x8000, &cat(vec![h32(0xFF00_0000), h32(1), f32s(&[0.0, 0.0, 100.0, 100.0])]));
+    let p = plus_pic(vec![prec(0x4008, 0x0400 | 6, &region), prec(0x4034, 6, &[]), fill]);
+    assert_eq!(p.items.len(), 1);
+    assert_eq!((p.width, p.height), (100.0, 100.0));
+}
+
+#[test]
+fn emfplus_region_path_keeps_its_shape() {
+    let mut path_data = cat(vec![h32(0), h32(4), h32(0x4000)]);
+    for (x, y) in [(10i16, 10i16), (30, 10), (30, 30), (10, 30)] {
+        path_data.extend(x.to_le_bytes());
+        path_data.extend(y.to_le_bytes());
+    }
+    path_data.extend([0, 1, 1, 0x81]);
+    let path_node = cat(vec![h32(0x1000_0001), h32(path_data.len() as u32), path_data]);
+    let region = cat(vec![h32(0xDBC0_1002), h32(1), path_node]);
+    let fill = prec(0x400A, 0x8000, &cat(vec![h32(0xFF00_0000), h32(1), f32s(&[0.0, 0.0, 100.0, 100.0])]));
+    let p = plus_pic(vec![prec(0x4008, 0x0400 | 6, &region), prec(0x4034, 6, &[]), fill]);
+    assert_eq!((p.width, p.height), (20.0, 20.0));
+}
+
 #[test]
 fn emfplus_pie_and_arc() {
    // A quarter pie from 0 to 90 degrees in a 0..100 circle: centre, then (100, 50) round to (50, 100).
@@ -367,37 +367,37 @@ pub static ANIMATIONS: &[(&str, &str, AnimClass, u32, u32, &[&str])] = &[
    ("shape", "Shape", AnimClass::Entrance, 6, 2000, &["circleIn", "circleOut", "boxIn", "boxOut", "diamondIn", "diamondOut", "plusIn", "plusOut"]),
    ("wheel", "Wheel", AnimClass::Entrance, 21, 2000, &["1", "2", "3", "4", "8"]),
    ("randomBars", "Random Bars", AnimClass::Entrance, 14, 500, &["horz", "vert"]),
-    ("grow", "Grow & Turn", AnimClass::Entrance, 31, 500, &[]),
+    ("grow", "Grow & Turn", AnimClass::Entrance, 31, 1000, &[]),
    ("zoom", "Zoom", AnimClass::Entrance, 53, 500, &["in", "out"]),
    ("swivel", "Swivel", AnimClass::Entrance, 45, 2000, &["horz", "vert"]),
    ("bounce", "Bounce", AnimClass::Entrance, 26, 2000, &[]),
    ("blinds", "Blinds", AnimClass::Entrance, 3, 500, &["horz", "vert"]),
-    ("box", "Box", AnimClass::Entrance, 4, 500, &["in", "out"]),
+    ("box", "Box", AnimClass::Entrance, 4, 2000, &["in", "out"]),
    ("checkerboard", "Checkerboard", AnimClass::Entrance, 5, 500, &["across", "down"]),
-    ("circle", "Circle", AnimClass::Entrance, 6, 500, &["in", "out"]),
-    ("diamond", "Diamond", AnimClass::Entrance, 8, 500, &["in", "out"]),
+    ("circle", "Circle", AnimClass::Entrance, 6, 2000, &["in", "out"]),
+    ("diamond", "Diamond", AnimClass::Entrance, 8, 2000, &["in", "out"]),
    ("dissolve", "Dissolve In", AnimClass::Entrance, 9, 500, &[]),
    ("peek", "Peek In", AnimClass::Entrance, 12, 500, &["b", "l", "t", "r"]),
    ("strips", "Strips", AnimClass::Entrance, 18, 500, &["lu", "ru", "ld", "rd"]),
-    ("expand", "Expand", AnimClass::Entrance, 55, 500, &[]),
+    ("expand", "Expand", AnimClass::Entrance, 55, 1000, &[]),
    ("rise", "Rise Up", AnimClass::Entrance, 37, 1000, &[]),
-    ("spinner", "Spinner", AnimClass::Entrance, 49, 1000, &[]),
+    ("spinner", "Spinner", AnimClass::Entrance, 49, 500, &[]),
    ("pulse", "Pulse", AnimClass::Emphasis, 26, 500, &[]),
-    ("colorPulse", "Color Pulse", AnimClass::Emphasis, 27, 500, &[]),
+    ("colorPulse", "Color Pulse", AnimClass::Emphasis, 27, 250, &[]),
    ("teeter", "Teeter", AnimClass::Emphasis, 32, 1000, &[]),
    ("spin", "Spin", AnimClass::Emphasis, 8, 2000, &["clockwise", "counterClockwise"]),
    ("growShrink", "Grow/Shrink", AnimClass::Emphasis, 6, 2000, &["both", "horz", "vert"]),
-    ("desaturate", "Desaturate", AnimClass::Emphasis, 35, 500, &[]),
-    ("darken", "Darken", AnimClass::Emphasis, 25, 500, &[]),
+    ("desaturate", "Desaturate", AnimClass::Emphasis, 25, 500, &[]),
+    ("darken", "Darken", AnimClass::Emphasis, 24, 500, &[]),
    ("lighten", "Lighten", AnimClass::Emphasis, 30, 500, &[]),
    ("transparency", "Transparency", AnimClass::Emphasis, 9, 500, &[]),
-    ("objectColor", "Object Color", AnimClass::Emphasis, 19, 2000, &[]),
+    ("objectColor", "Object Color", AnimClass::Emphasis, 19, 500, &[]),
    ("complementaryColor", "Complementary Color", AnimClass::Emphasis, 21, 500, &[]),
    ("lineColor", "Line Color", AnimClass::Emphasis, 7, 2000, &[]),
    ("fillColor", "Fill Color", AnimClass::Emphasis, 1, 2000, &[]),
    ("fontColor", "Font Color", AnimClass::Emphasis, 3, 2000, &[]),
    ("underline", "Underline", AnimClass::Emphasis, 18, 500, &[]),
-    ("boldFlash", "Bold Flash", AnimClass::Emphasis, 10, 500, &[]),
+    ("boldFlash", "Bold Flash", AnimClass::Emphasis, 10, 2000, &[]),
    ("wave", "Wave", AnimClass::Emphasis, 34, 500, &[]),
    ("disappear", "Disappear", AnimClass::Exit, 1, 0, &[]),
    ("fadeOut", "Fade", AnimClass::Exit, 10, 500, &[]),
@@ -408,20 +408,20 @@ pub static ANIMATIONS: &[(&str, &str, AnimClass, u32, u32, &[&str])] = &[
    ("shapeOut", "Shape", AnimClass::Exit, 6, 2000, &["circleIn", "circleOut"]),
    ("wheelOut", "Wheel", AnimClass::Exit, 21, 2000, &["1", "2", "3", "4", "8"]),
    ("randomBarsOut", "Random Bars", AnimClass::Exit, 14, 500, &["horz", "vert"]),
-    ("shrinkTurn", "Shrink & Turn", AnimClass::Exit, 31, 500, &[]),
+    ("shrinkTurn", "Shrink & Turn", AnimClass::Exit, 31, 1000, &[]),
    ("zoomOut", "Zoom", AnimClass::Exit, 53, 500, &["in", "out"]),
    ("swivelOut", "Swivel", AnimClass::Exit, 45, 2000, &["horz", "vert"]),
    ("bounceOut", "Bounce", AnimClass::Exit, 26, 2000, &[]),
    ("dissolveOut", "Dissolve Out", AnimClass::Exit, 9, 500, &[]),
    ("blindsOut", "Blinds", AnimClass::Exit, 3, 500, &["horz", "vert"]),
-    ("boxOut", "Box", AnimClass::Exit, 4, 500, &["in", "out"]),
+    ("boxOut", "Box", AnimClass::Exit, 4, 2000, &["in", "out"]),
    ("checkerboardOut", "Checkerboard", AnimClass::Exit, 5, 500, &["across", "down"]),
-    ("diamondOut", "Diamond", AnimClass::Exit, 8, 500, &["in", "out"]),
+    ("diamondOut", "Diamond", AnimClass::Exit, 8, 2000, &["in", "out"]),
    ("peekOut", "Peek Out", AnimClass::Exit, 12, 500, &["b", "l", "t", "r"]),
    ("stripsOut", "Strips", AnimClass::Exit, 18, 500, &["lu", "ru", "ld", "rd"]),
    ("sinkDown", "Sink Down", AnimClass::Exit, 37, 1000, &[]),
-    ("spinnerOut", "Spinner", AnimClass::Exit, 49, 1000, &[]),
-    ("contract", "Contract", AnimClass::Exit, 55, 500, &[]),
+    ("spinnerOut", "Spinner", AnimClass::Exit, 49, 500, &[]),
+    ("contract", "Contract", AnimClass::Exit, 55, 1000, &[]),
    ("lines", "Lines", AnimClass::Path, 64, 2000, &["down", "up", "right", "left"]),
    ("arcs", "Arcs", AnimClass::Path, 37, 2000, &["down", "up", "right", "left"]),
    ("turns", "Turns", AnimClass::Path, 43, 2000, &["down", "up", "right", "left"]),
@@ -1270,7 +1270,14 @@ impl Chart {
        let mut bins: Vec<Bin> = (0..count).map(|i| Bin { lo: lo + width * i as f64, hi: lo + width * (i + 1) as f64, count: 0 }).collect();
        for x in v {
            // (lo, hi] bins, the first one also holding the minimum.
-            let i = (((x - lo) / width).ceil() as usize).saturating_sub(1).min(count - 1);
+            let mut i = (((x - lo) / width).ceil() as usize).saturating_sub(1).min(count - 1);
+            // The division can round across an edge: settle on the bin whose stored bounds hold x.
+            while i > 0 && x <= bins[i - 1].hi {
+                i -= 1;
+            }
+            while i + 1 < count && x > bins[i].hi {
+                i += 1;
+            }
            if let Some(b) = bins.get_mut(i) {
                b.count += 1;
            }
@@ -1535,6 +1542,16 @@ mod chartex_tests {
        assert_eq!(c.histogram_bins().len(), 7);
    }

+    #[test]
+    fn histogram_value_on_a_bin_edge_counts_in_that_bin() {
+        let mut c = obs(&[0.0, 2.1, 3.0]);
+        c.bin_size = Some(0.3);
+        let bins = c.histogram_bins();
+        let own = bins.iter().find(|b| b.lo < 2.1 && 2.1 <= b.hi).expect("a bin holds 2.1");
+        assert_eq!(own.count, 1, "2.1 must be counted in ({}, {}]", own.lo, own.hi);
+        assert_eq!(bins.iter().map(|b| b.count).sum::<usize>(), 3);
+    }
+
    #[test]
    fn pareto_view_sorts_bins_and_adds_the_cumulative_line() {
        let mut c = obs(&[1.0, 5.0, 5.0, 5.0, 9.0, 9.0]);
@@ -418,6 +418,8 @@ fn pos_of_char(body: &TextBody, mut n: usize) -> Pos {
 /// keeps its run and paragraph formatting and new text takes the formatting where it lands. Text
 /// that shares nothing with the old text replaces it as plain text.
 pub fn replace_text(body: &mut TextBody, text: &str) {
+    // Normalise line endings first so the common prefix/suffix cannot split a `\r\n` pair.
+    let text = &text.replace("\r\n", "\n").replace('\r', "\n");
    let old: Vec<char> = body.text().chars().collect();
    let new: Vec<char> = text.chars().collect();
    if old == new {
@@ -723,6 +725,22 @@ mod tests {
        b
    }

+    #[test]
+    fn replace_text_crlf_matches_from_text() {
+        // The kept suffix must not start inside a `\r\n` pair.
+        let mut b = TextBody::from_text("x\ny");
+        replace_text(&mut b, "z\r\ny");
+        assert_eq!(b.text(), "z\ny");
+        // CRLF in the kept prefix, and the same text with CRLF changes nothing.
+        let before = notes();
+        let mut b = before.clone();
+        replace_text(&mut b, "Overview\r\nFirst point\r\nSecond point");
+        assert_eq!(b, before);
+        replace_text(&mut b, "Overview\r\nFirst point\r\nSecond\rpoint");
+        assert_eq!(b.text(), "Overview\nFirst point\nSecond\npoint");
+        assert_eq!(b.paragraphs[0].runs[0].props.bold, Some(true));
+    }
+
    #[test]
    fn replace_text_keeps_formatting() {
        let before = notes();
@@ -480,7 +480,7 @@ fn num(v: f64) -> String {
    if a == 0.0 {
        return "0".to_string();
    }
-    if a >= 1.0e6 || a < 1.0e-3 {
+    if !(1.0e-3..1.0e6).contains(&a) {
        return format!("{v:.2e}").replace('+', "");
    }
    let digits = if a >= 100.0 {
@@ -451,6 +451,17 @@ fn opaque_px(rgba: &mut [u8]) {
    }
 }

+/// Gives every fully transparent content pixel the backdrop's colour. The renderer leaves them
+/// RGB 0,0,0; a viewer that smooths the image blends colour and mask separately, so the black
+/// shows as a grey hairline around white pictures and shapes (#1455).
+fn fill_clear(front: &mut [u8], back: &[u8]) {
+    for (f, b) in front.as_chunks_mut::<4>().0.iter_mut().zip(back.as_chunks::<4>().0) {
+        if f[3] == 0 {
+            f[..3].copy_from_slice(&b[..3]);
+        }
+    }
+}
+
 /// Most bytes of opaque backdrop rasters kept to recognise a backdrop seen before.
 const BACKDROP_CACHE_BYTES: usize = 32 << 20;

@@ -515,7 +526,8 @@ impl Exporter<'_> {
        // Two rasters per slide: the backdrop (background, master and layout graphics) is the same
        // on every slide that shares its layout, so the writer stores it once, and the slide's own
        // shapes draw over it (#845).
-        let back = deckcraft_render::render_slide_part(pres, i, deckcraft_render::SlidePart::Backdrop, &ropts);
+        let mut back = deckcraft_render::render_slide_part(pres, i, deckcraft_render::SlidePart::Backdrop, &ropts);
+        opaque(&mut back.pixels);
        let front = deckcraft_render::render_slide_part(pres, i, deckcraft_render::SlidePart::Content, &ropts);
        let (w, h) = (back.width, back.height);
        if w > 0
@@ -523,11 +535,15 @@ impl Exporter<'_> {
            && let Some(size) = Size::from_wh(b.width() as f32, b.height() as f32)
        {
            s.push_transform(&Transform::from_translate(b.x0 as f32, b.y0 as f32));
-            s.draw_image(self.backdrops.image(back), size);
            // Taken, not copied: a print-resolution slide is ~16 MB.
            let mut rgba = front.pixels;
-            if rgba.as_chunks::<4>().0.iter().any(|px| px[3] != 0) {
+            let content = rgba.as_chunks::<4>().0.iter().any(|px| px[3] != 0);
+            if content {
+                fill_clear(&mut rgba, &back.pixels);
                straight(&mut rgba);
+            }
+            s.draw_image(self.backdrops.image(back), size);
+            if content {
                s.draw_image(Image::from_rgba8(rgba, w, h), size);
            }
            s.pop();
@@ -7,8 +7,8 @@ use deckcraft_render::RenderOpts;
 use kurbo::Rect;

 use super::{
-    MAX_RASTER_PIXELS, PAPERS, PageLayout, PdfError, PdfOptions, Presentation, export, glyph_text_ranges, handout_boxes, master_text_pieces,
-    master_texts, notes_frames, notes_slide_box, opaque, paper_size, raster_scale, straight,
+    MAX_RASTER_PIXELS, PAPERS, PageLayout, PdfError, PdfOptions, Presentation, export, fill_clear, glyph_text_ranges, handout_boxes,
+    master_text_pieces, master_texts, notes_frames, notes_slide_box, opaque, paper_size, raster_scale, straight,
 };
 use deckcraft_model::text::TextBody;

@@ -582,7 +582,20 @@ fn slides_share_one_backdrop_raster_and_keep_their_pixels() {
        deckcraft_render::SlidePart::Content,
        &RenderOpts { scale: scale(&p), threads: 4, ..Default::default() },
    );
-    let straight = expect.to_straight();
+    let mut straight = expect.to_straight();
+    // Fully transparent pixels carry the backdrop colour, not black (#1455).
+    let mut back = deckcraft_render::render_slide_part(
+        &p,
+        0,
+        deckcraft_render::SlidePart::Backdrop,
+        &RenderOpts { scale: scale(&p), threads: 4, ..Default::default() },
+    );
+    opaque(&mut back.pixels);
+    for (px, b) in straight.as_chunks_mut::<4>().0.iter_mut().zip(back.pixels.as_chunks::<4>().0) {
+        if px[3] == 0 {
+            px[..3].copy_from_slice(&b[..3]);
+        }
+    }
    let want_rgb: Vec<u8> = straight.as_chunks::<4>().0.iter().flat_map(|px| px[..3].iter().copied()).collect();
    let want_alpha: Vec<u8> = straight.as_chunks::<4>().0.iter().map(|px| px[3]).collect();
    assert_eq!(rgb, want_rgb, "content colors are straight, not premultiplied");
@@ -634,6 +647,15 @@ fn backdrop_and_content_pixels_convert_per_pixel() {
    }
 }

+/// Fully transparent content pixels take the backdrop colour (not black) so a smoothing viewer
+/// draws no hairline at the edge of a picture; every other pixel is untouched (#1455).
+#[test]
+fn transparent_content_pixels_take_the_backdrop_colour() {
+    let mut front = vec![0, 0, 0, 0, 10, 20, 30, 255, 5, 5, 5, 1, 0, 0, 0, 0];
+    fill_clear(&mut front, &[255, 250, 240, 255].repeat(4));
+    assert_eq!(front, [255, 250, 240, 0, 10, 20, 30, 255, 5, 5, 5, 1, 255, 250, 240, 0]);
+}
+
 #[test]
 fn glyph_ranges_follow_shaping_clusters() {
    // "fl" ligature: its glyph maps to both characters, the rest stay one to one (#164).
@@ -435,4 +435,15 @@ mod tests {
        assert_eq!(effect_for_preset(AnimClass::Entrance, 2), Some("fly"));
        assert_eq!(effect_for_preset(AnimClass::Emphasis, 8), Some("spin"));
    }
+
+    /// PowerPoint's own ids: Darken is 24 and Desaturate 25 (read back from its saved file).
+    #[test]
+    fn darken_and_desaturate_use_powerpoints_ids() {
+        assert_eq!(effect_for_preset(AnimClass::Emphasis, 24), Some("darken"));
+        assert_eq!(effect_for_preset(AnimClass::Emphasis, 25), Some("desaturate"));
+        for (effect, id) in [("darken", 24), ("desaturate", 25)] {
+            let a = deckcraft_model::Animation { class: AnimClass::Emphasis, effect: effect.into(), ..Default::default() };
+            assert_eq!(preset_for(&a), id, "{effect}");
+        }
+    }
 }
@@ -93,7 +93,8 @@ impl Package {
                }
            }
            total = total.saturating_add(data.len() as u64);
-            parts.insert(name.to_ascii_lowercase(), (name, data));
+            // A name kept with `\` would reach code that splits paths on `/`.
+            parts.insert(norm(&name), (name.replace('\\', "/"), data));
        }
        Ok(Package { parts, ct_cache: std::sync::OnceLock::new() })
    }
@@ -499,6 +500,14 @@ mod tests {
        assert!(p.get("e").is_some());
    }

+    #[test]
+    fn backslash_zip_entry_names_are_found() {
+        let z = zip_of(&[("PPT\\Slides\\Slide1.xml", 3)]);
+        let p = Package::open(&z).unwrap();
+        assert!(p.get("ppt/slides/slide1.xml").is_some());
+        assert_eq!(p.original_name("ppt/slides/slide1.xml"), Some("PPT/Slides/Slide1.xml"));
+    }
+
    #[test]
    fn xml_bytes_applies_the_xml_limit() {
        let z = zip_of(&[("small.xml", 10)]);
@@ -1205,6 +1205,7 @@ fn read_slide(imp: &mut Imp, part: &Part, doc: &Doc, id: SlideId, layout: Layout
    }
    if let Some(t) = root.child("timing") {
        s.animations = timing::animations(imp, part, &ctx, t, &s.shapes);
+        timing::media_settings(t, &ctx, &mut s.shapes);
    }
    if let Some(ext) = root.child("extLst").filter(|e| !has_rel_refs(e)) {
        s.raw_ext = Some(ext.elements().map(|e| part.keep(e)).collect());
@@ -360,7 +360,11 @@ fn read_axes<'a>(c: &mut Chart, pa: &'a El, primary_val: &Option<String>) -> (Op
        Some(n) if n.attr("sourceLinked") != Some("1") => n.attr("formatCode").map(str::to_string),
        n => source_format(a).or_else(|| n.and_then(|n| n.attr("formatCode")).map(str::to_string)),
    };
-    let deleted = |a: &El| a.child("delete").and_then(|d| d.bool("val")) == Some(true);
+    // `c:tickLblPos val="none"` hides the labels just as `c:delete` does.
+    let deleted = |a: &El| a.child("delete").and_then(|d| d.bool("val")) == Some(true) || a.child_val("tickLblPos") == Some("none");
+    // A gridline whose `c:spPr/a:ln` has `a:noFill` is not drawn, though the element is there.
+    let grid =
+        |a: &El, k: &str| a.child(k).is_some_and(|g| !g.child("spPr").and_then(|p| p.child("ln")).is_some_and(|l| l.child("noFill").is_some()));
    if c.kind == ChartType::Combo && c.series.iter().any(|s| s.secondary_axis) {
        let primary_id = val_ax.and_then(|a| a.child_val("axId"));
        // The other vertical value axis is the secondary one.
@@ -375,8 +379,8 @@ fn read_axes<'a>(c: &mut Chart, pa: &'a El, primary_val: &Option<String>) -> (Op
    }
    let cat_ax = pa.child("catAx").or_else(|| pa.child("dateAx")).or_else(|| pa.children_named("valAx").find(|a| !vertical(a)));
    if let Some(v) = val_ax {
-        c.gridlines = v.child("majorGridlines").is_some();
-        c.minor_gridlines = v.child("minorGridlines").is_some();
+        c.gridlines = grid(v, "majorGridlines");
+        c.minor_gridlines = grid(v, "minorGridlines");
        let sc = v.child("scaling");
        c.y_min = sc.and_then(|s| s.child_val("min")).and_then(|v| v.parse().ok()).filter(|v: &f64| v.is_finite());
        c.y_max = sc.and_then(|s| s.child_val("max")).and_then(|v| v.parse().ok()).filter(|v: &f64| v.is_finite());
@@ -769,6 +773,26 @@ mod tests {
        assert_eq!(read_chart_xml(xml.as_bytes()).unwrap().text_size, None, "no sizes: the renderer picks one");
    }

+    #[test]
+    fn hidden_labels_and_unfilled_gridlines_are_read() {
+        let xml = |ax: &str| {
+            format!(
+                r#"<c:chartSpace xmlns:c="{NS_C}" xmlns:a="{NS_A}"><c:chart><c:plotArea><c:barChart><c:barDir val="col"/><c:axId val="1"/><c:axId val="2"/></c:barChart><c:catAx><c:axId val="1"/></c:catAx><c:valAx><c:axId val="2"/>{ax}</c:valAx></c:plotArea></c:chart></c:chartSpace>"#
+            )
+        };
+        let no_fill = r#"<c:spPr><a:ln w="9525"><a:noFill/></a:ln></c:spPr>"#;
+        let c = read_chart_xml(xml(r#"<c:majorGridlines/><c:minorGridlines/><c:tickLblPos val="nextTo"/>"#).as_bytes()).unwrap();
+        assert!(c.gridlines && c.minor_gridlines && !c.y_hidden);
+        let c = read_chart_xml(
+            xml(&format!(
+                r#"<c:majorGridlines>{no_fill}</c:majorGridlines><c:minorGridlines>{no_fill}</c:minorGridlines><c:tickLblPos val="none"/>"#
+            ))
+            .as_bytes(),
+        )
+        .unwrap();
+        assert!(!c.gridlines && !c.minor_gridlines && c.y_hidden);
+    }
+
    #[test]
    fn trendlines_are_read() {
        let xml = br#"<c:chartSpace xmlns:c="http://schemas.openxmlformats.org/drawingml/2006/chart"><c:chart><c:plotArea><c:lineChart><c:grouping val="standard"/><c:ser><c:idx val="0"/><c:tx><c:v>Spend</c:v></c:tx>
@@ -631,18 +631,14 @@ pub fn paragraph(imp: &mut Imp, part: &Part, p: &El) -> Paragraph {
                let text: String = e.child("t").map(|t| t.text()).unwrap_or_default();
                push_text_runs(&mut para, props, &text);
            }
-            "br" => {
-                if para.runs.len() < MAX_PARAGRAPH_RUNS {
-                    let props = run_props(imp, part, e);
-                    para.runs.push(Run { text: String::new(), props, kind: RunKind::Break });
-                }
+            "br" if para.runs.len() < MAX_PARAGRAPH_RUNS => {
+                let props = run_props(imp, part, e);
+                para.runs.push(Run { text: String::new(), props, kind: RunKind::Break });
            }
-            "fld" => {
-                if para.runs.len() < MAX_PARAGRAPH_RUNS {
-                    let props = run_props(imp, part, e);
-                    let text = e.child("t").map(|t| t.text()).unwrap_or_default();
-                    para.runs.push(Run { text, props, kind: RunKind::Field { field: e.attr("type").unwrap_or("").to_string() } });
-                }
+            "fld" if para.runs.len() < MAX_PARAGRAPH_RUNS => {
+                let props = run_props(imp, part, e);
+                let text = e.child("t").map(|t| t.text()).unwrap_or_default();
+                para.runs.push(Run { text, props, kind: RunKind::Field { field: e.attr("type").unwrap_or("").to_string() } });
            }
            "m" => push_math_run(&mut para, part, e),
            "endParaRPr" => para.end_props = rpr(imp, part, e),
@@ -338,6 +338,8 @@ fn pic(imp: &mut Imp, part: &Part, ctx: &mut IdCtx, e: &El) -> Shape {
    if let Some(pr) = e.child("spPr") {
        sp_pr(imp, part, &mut s, pr);
    }
+    // A picture in a picture placeholder is cut into the layout's shape (a circle, say).
+    mark_inherited_geometry(&mut s, e.child("spPr"));
    s.style = e.child("style").map(style);
    let pf = e.child("blipFill").and_then(|b| dml::blip_fill(imp, part, b));
    let nvpr = e.path(&["nvPicPr", "nvPr"]);
@@ -1,7 +1,7 @@
 //! Slide transitions (`p:transition`) and animations (`p:timing`).

 use deckcraft_model::anim::{AnimClass, AnimStart, Animation, BuildRole, TextBuild, Transition, build_filled, paragraph_build_roles};
-use deckcraft_model::{Shape, TextBody, find_shape};
+use deckcraft_model::{Shape, ShapeKind, TextBody, find_shape, find_shape_mut};

 use super::shapes::IdCtx;
 use super::{Imp, Part, dml};
@@ -94,6 +94,42 @@ fn max_dur(e: &El, depth: usize) -> Option<u32> {
    best
 }

+/// Does every behaviour time node (`p:cBhvr/p:cTn`) under the effect node `c` carry `autoRev`?
+fn behaviour_auto_reverses(c: &El) -> bool {
+    let mut behaviours = vec![];
+    c.find_all("cBhvr", &mut behaviours);
+    !behaviours.is_empty() && behaviours.iter().all(|b| b.child("cTn").and_then(|t| t.bool("autoRev")).unwrap_or(false))
+}
+
+/// Volume, mute, Loop until Stopped, Hide While Not Playing and Play Full Screen live in the timing tree
+/// (`p:video`/`p:audio` > `p:cMediaNode`), not on the picture: copy them onto the target's `MediaClip`.
+pub fn media_settings(timing: &El, ctx: &IdCtx, shapes: &mut [Shape]) {
+    let mut nodes = vec![];
+    for tag in ["video", "audio"] {
+        timing.find_all(tag, &mut nodes);
+    }
+    for node in nodes.into_iter().take(10_000) {
+        let Some(cm) = node.child("cMediaNode") else { continue };
+        let Some(id) = cm.path(&["tgtEl", "spTgt"]).and_then(|t| t.u32("spid")).and_then(|f| ctx.lookup(f)) else { continue };
+        let Some(ShapeKind::Media(clip)) = find_shape_mut(shapes, id).map(|s| &mut s.kind) else { continue };
+        if let Some(v) = cm.attr("vol").and_then(|v| v.trim().parse::<f64>().ok()).filter(|v| v.is_finite()) {
+            clip.volume = (v / 100_000.0).clamp(0.0, 1.0);
+        }
+        if cm.bool("mute") == Some(true) {
+            clip.volume = 0.0;
+        }
+        if cm.bool("showWhenStopped") == Some(false) {
+            clip.hide_while_not_playing = true;
+        }
+        if cm.child("cTn").and_then(|c| c.attr("repeatCount")) == Some("indefinite") {
+            clip.loop_play = true;
+        }
+        if node.bool("fullScrn") == Some(true) {
+            clip.full_screen = true;
+        }
+    }
+}
+
 /// Flatten the timing tree into the Animation Pane list.
 pub fn animations(imp: &mut Imp, part: &Part, ctx: &IdCtx, timing: &El, shapes: &[Shape]) -> Vec<Animation> {
    let _ = (imp, part);
@@ -144,7 +180,9 @@ pub fn animations(imp: &mut Imp, part: &Part, ctx: &IdCtx, timing: &El, shapes:
            trigger: f.trigger.and_then(|t| ctx.lookup(t)),
            preset_id: Some(preset),
            preset_subtype: Some(sub),
-            auto_reverse: c.bool("autoRev").unwrap_or(false),
+            // PowerPoint's "Auto-reverse" is `autoRev` on the behaviour nodes (`p:cBhvr/p:cTn`); Color Pulse
+            // always writes it there and plays back and forth on its own, so it isn't read as the option.
+            auto_reverse: c.bool("autoRev").unwrap_or(false) || (effect != "colorPulse" && behaviour_auto_reverses(c)),
            // PowerPoint's "Rewind when done playing" is `fill="remove"` on the effect node.
            rewind: c.attr("fill") == Some("remove"),
            smooth_start: c.f64("accel").map(|v| v / 100_000.0).unwrap_or(0.0),
@@ -383,7 +383,19 @@ fn behaviors(w: &mut W, x: &mut Exp, ids: &mut Ids, e: &Eff) {
                    w.close("p:animClr");
                }
            }
-            "fillColor" | "objectColor" | "fontColor" | "lineColor" | "complementaryColor" | "darken" | "lighten" => {
+            // As PowerPoint writes them: a relative HSL shift of text, fill and line colour.
+            "darken" | "desaturate" => {
+                let (s, l) = if a.effect == "darken" { (0, -25_098) } else { (-70_588, 0) };
+                for attr in ["style.color", "fillcolor", "stroke.color"] {
+                    w.open("p:animClr", A::new().a("clrSpc", "hsl").a("dir", "cw"));
+                    cbhvr(w, ids, e, dur, None, &[attr], None);
+                    w.open0("p:by");
+                    w.empty("p:hsl", A::new().a("h", 0).a("s", s).a("l", l));
+                    w.close("p:by");
+                    w.close("p:animClr");
+                }
+            }
+            "fillColor" | "objectColor" | "fontColor" | "lineColor" | "complementaryColor" | "lighten" => {
                let attr = match a.effect.as_str() {
                    "fontColor" => "style.color",
                    "lineColor" => "stroke.color",
@@ -0,0 +1,44 @@
+//! "Auto-reverse" is written by PowerPoint on the behaviour time nodes, not on the effect node.
+
+use std::io::{Cursor, Read, Write};
+
+use deckcraft_geom::Xfrm;
+use deckcraft_model::anim::{AnimClass, Animation};
+use deckcraft_model::{Shape, ShapeId, defaults};
+
+fn deck_with(effect: &str, behaviour: &str) -> Vec<bool> {
+    let mut p = defaults::new_presentation(None);
+    let id = ShapeId(p.alloc_id().expect("id"));
+    let shape = Shape { id, name: "Box".into(), xfrm: Some(Xfrm::new(10.0, 10.0, 200.0, 100.0)), ..Default::default() };
+    let sl = std::sync::Arc::make_mut(&mut p.slides[0]);
+    sl.shapes = vec![shape];
+    sl.animations.push(Animation { shape: id, class: AnimClass::Emphasis, effect: effect.into(), duration_ms: 1000, ..Default::default() });
+    let mut z = zip::ZipArchive::new(Cursor::new(deckcraft_pptx::export(&p).expect("export"))).expect("zip");
+    let mut out = zip::ZipWriter::new(Cursor::new(Vec::new()));
+    for i in 0..z.len() {
+        let mut f = z.by_index(i).expect("entry");
+        let name = f.name().to_string();
+        let mut d = vec![];
+        f.read_to_end(&mut d).expect("read");
+        if name == "ppt/slides/slide1.xml" {
+            let xml = String::from_utf8(d).expect("utf8");
+            let at = xml.find(behaviour).expect("behaviour written");
+            let cb = at + xml[at..].find("<p:cTn ").expect("behaviour node");
+            d = format!("{}<p:cTn autoRev=\"1\" {}", &xml[..cb], &xml[cb + "<p:cTn ".len()..]).into_bytes();
+        }
+        out.start_file(name, zip::write::SimpleFileOptions::default()).expect("start");
+        out.write_all(&d).expect("write");
+    }
+    let q = deckcraft_pptx::import(&out.finish().expect("finish").into_inner()).expect("import");
+    q.slides[0].animations.iter().map(|a| a.auto_reverse).collect()
+}
+
+#[test]
+fn grow_shrink_reads_auto_reverse_from_its_behaviour_node() {
+    assert_eq!(deck_with("growShrink", "<p:animScale>"), [true]);
+}
+
+#[test]
+fn color_pulse_behaviour_auto_reverse_is_not_the_option() {
+    assert_eq!(deck_with("colorPulse", "<p:animClr "), [false]);
+}
@@ -1,4 +1,5 @@
 mod anchor;
+mod anim_auto_reverse;
 mod chart_embed;
 mod comments;
 mod corpus;
@@ -13,6 +14,7 @@ mod kept_parts;
 mod locks;
 mod malformed;
 mod math_ns;
+mod media_timing;
 mod notes;
 mod ole;
 mod ole_vml;
@@ -0,0 +1,76 @@
+//! Media settings PowerPoint keeps in the timing tree, spliced into an exported deck and read back.
+
+use std::io::{Cursor, Read, Write};
+use std::sync::Arc;
+
+use deckcraft_geom::Xfrm;
+use deckcraft_model::{MediaClip, ShapeId, ShapeKind, defaults};
+
+fn node(tag: &str, attrs: &str, spid: u32, media: &str, ctn: &str) -> String {
+    format!(
+        r#"<p:par><p:cTn id="2" fill="hold"><p:childTnLst><p:{tag}{attrs}><p:cMediaNode{media}><p:cTn id="3"{ctn}/><p:tgtEl><p:spTgt spid="{spid}"/></p:tgtEl></p:cMediaNode></p:{tag}></p:childTnLst></p:cTn></p:par>"#
+    )
+}
+
+fn clips(nodes: impl Fn(u32, u32) -> String) -> Vec<MediaClip> {
+    let mut p = defaults::new_presentation(None);
+    let video = p.add_media("clip.mp4", "video/mp4", b"video".to_vec()).expect("media");
+    let audio = p.add_media("clip.m4a", "audio/mp4", b"audio".to_vec()).expect("media");
+    let mut ids = vec![];
+    for (media, is_video) in [(video, true), (audio, false)] {
+        let id = ShapeId(p.alloc_id().expect("id"));
+        ids.push(id.0);
+        let s = deckcraft_model::Shape {
+            id,
+            name: "Clip".into(),
+            xfrm: Some(Xfrm::new(40.0, 40.0, 200.0, 100.0)),
+            kind: ShapeKind::Media(MediaClip { media, video: is_video, volume: 1.0, ..Default::default() }),
+            ..Default::default()
+        };
+        Arc::make_mut(&mut p.slides[0]).shapes.push(s);
+    }
+    let timing = format!(
+        r#"<p:timing><p:tnLst><p:par><p:cTn id="1" dur="indefinite" restart="never" nodeType="tmRoot"><p:childTnLst>{}</p:childTnLst></p:cTn></p:par></p:tnLst></p:timing>"#,
+        nodes(ids[0], ids[1])
+    );
+    let bytes = deckcraft_pptx::export(&p).expect("export");
+    let mut z = zip::ZipArchive::new(Cursor::new(&bytes)).expect("zip");
+    let mut out = zip::ZipWriter::new(Cursor::new(Vec::new()));
+    for i in 0..z.len() {
+        let mut f = z.by_index(i).expect("entry");
+        let mut d = vec![];
+        f.read_to_end(&mut d).expect("read");
+        if f.name() == "ppt/slides/slide1.xml" {
+            let s = String::from_utf8(d).expect("utf8");
+            assert!(!s.contains("<p:timing"));
+            let end = s.rfind("</p:sld>").expect("end");
+            d = format!("{}{timing}{}", &s[..end], &s[end..]).into_bytes();
+        }
+        out.start_file(f.name(), zip::write::SimpleFileOptions::default()).expect("start");
+        out.write_all(&d).expect("write");
+    }
+    let q = deckcraft_pptx::import(&out.finish().expect("finish").into_inner()).expect("import");
+    q.slides[0]
+        .shapes
+        .iter()
+        .filter_map(|s| match &s.kind {
+            ShapeKind::Media(m) => Some(m.clone()),
+            _ => None,
+        })
+        .collect()
+}
+
+#[test]
+fn video_settings_are_read_from_the_timing_tree() {
+    let c = clips(|v, _| node("video", r#" fullScrn="1""#, v, r#" vol="80000" showWhenStopped="0""#, r#" repeatCount="indefinite""#));
+    assert_eq!((c[0].volume, c[0].hide_while_not_playing, c[0].loop_play, c[0].full_screen), (0.8, true, true, true));
+    // The sound next to it has no node: defaults stay.
+    assert_eq!((c[1].volume, c[1].hide_while_not_playing, c[1].loop_play, c[1].full_screen), (1.0, false, false, false));
+}
+
+#[test]
+fn muted_audio_has_no_volume_and_other_clips_keep_theirs() {
+    let c = clips(|_, a| node("audio", "", a, r#" vol="50000" mute="1""#, ""));
+    assert_eq!(c[0].volume, 1.0);
+    assert_eq!((c[1].volume, c[1].loop_play, c[1].full_screen), (0.0, false, false));
+}
@@ -2,7 +2,9 @@

 use std::io::{Cursor, Read, Write};

-use deckcraft_model::{Geom, defaults};
+use deckcraft_geom::Xfrm;
+use deckcraft_model::style::PictureFill;
+use deckcraft_model::{Geom, PhType, Placeholder, Shape, ShapeId, ShapeKind, defaults};

 /// `bytes` with `edit` applied to every slide part.
 fn edit_slides(bytes: &[u8], edit: impl Fn(String) -> String) -> Vec<u8> {
@@ -62,3 +64,47 @@ fn a_placeholder_without_geometry_takes_its_layouts() {
    let q = deckcraft_pptx::import(&deckcraft_pptx::export(&p).expect("export")).expect("import");
    assert!(q.slides[0].shapes.iter().filter(|s| s.ph.is_some()).all(|s| matches!(&s.geom, Geom::Preset { name, .. } if name == "triangle")));
 }
+
+#[test]
+fn a_picture_placeholder_without_geometry_takes_its_layouts() {
+    // The slide's picture sits in a layout's picture placeholder drawn as an ellipse; PowerPoint
+    // writes its spPr with a frame only and shows the picture cut into the circle.
+    let mut p = defaults::new_presentation(None);
+    let img = {
+        let mut out = Cursor::new(vec![]);
+        let px = image::RgbImage::from_pixel(4, 4, image::Rgb([10, 200, 30]));
+        image::DynamicImage::ImageRgb8(px).write_to(&mut out, image::ImageFormat::Png).expect("png");
+        p.add_media("image1.png", "image/png", out.into_inner()).expect("media")
+    };
+    let ph = Placeholder { kind: PhType::Picture, idx: 15, ..Default::default() };
+    let layout = p.slides[0].layout;
+    let slot = Shape {
+        id: ShapeId(p.alloc_id().expect("ids")),
+        name: "Picture Placeholder".into(),
+        xfrm: Some(Xfrm::new(100.0, 100.0, 200.0, 200.0)),
+        geom: Geom::Preset { name: "ellipse".into(), adj: vec![] },
+        ph: Some(ph.clone()),
+        ..Default::default()
+    };
+    std::sync::Arc::make_mut(&mut p.masters[0]).layouts.iter_mut().find(|l| l.id == layout).expect("layout").shapes.push(slot);
+    let pic = Shape {
+        id: ShapeId(p.alloc_id().expect("ids")),
+        name: "Photo".into(),
+        xfrm: Some(Xfrm::new(100.0, 100.0, 200.0, 200.0)),
+        kind: ShapeKind::Picture { fill: PictureFill { media: img, ..Default::default() } },
+        ph: Some(ph),
+        ..Default::default()
+    };
+    std::sync::Arc::make_mut(&mut p.slides[0]).shapes = vec![pic];
+    let bytes = deckcraft_pptx::export(&p).expect("export");
+    let bare = edit_slides(&bytes, |mut s| {
+        while let Some(i) = s.find("<a:prstGeom") {
+            let Some(j) = s[i..].find("</a:prstGeom>").map(|j| j + i + "</a:prstGeom>".len()) else { break };
+            s.replace_range(i..j, "");
+        }
+        s
+    });
+    let q = deckcraft_pptx::import(&bare).expect("import");
+    let photo = q.slides[0].shapes.iter().find(|s| matches!(s.kind, ShapeKind::Picture { .. })).expect("picture");
+    assert!(matches!(&photo.geom, Geom::Preset { name, .. } if name == "ellipse"), "{:?}", photo.geom);
+}
@@ -1925,3 +1925,47 @@ fn zoom_inserts_linked_slide_pictures() {
    assert!(s.execute("insert.zoom", &json!({"slides": [42]})).is_err());
    assert!(s.execute("insert.zoom", &json!({"kind": "slide"})).is_err());
 }
+
+#[test]
+fn darken_and_desaturate_write_powerpoints_hsl_shift() {
+    for (effect, preset, shift) in [("darken", 24, r#"s="0" l="-25098""#), ("desaturate", 25, r#"s="-70588" l="0""#)] {
+        let mut p = defaults::new_presentation(None);
+        let mut s = p.slides[0].as_ref().clone();
+        let sh = shape(&mut p, "Target", 100.0, 100.0, 100.0, 100.0);
+        let id = sh.id;
+        s.shapes.push(sh);
+        s.animations.push(Animation { shape: id, class: AnimClass::Emphasis, effect: effect.into(), duration_ms: 500, ..Default::default() });
+        p.slides[0] = Arc::new(s);
+        let bytes = deckcraft_pptx::export(&p).expect("export");
+        let mut zip = zip::ZipArchive::new(std::io::Cursor::new(bytes)).unwrap();
+        let mut xml = String::new();
+        std::io::Read::read_to_string(&mut zip.by_name("ppt/slides/slide1.xml").unwrap(), &mut xml).unwrap();
+        assert!(xml.contains(&format!(r#"presetID="{preset}""#)), "{effect}");
+        assert!(xml.contains(r#"clrSpc="hsl""#) && xml.contains(shift), "{effect}: {xml}");
+        assert_eq!(round(&p).slides[0].animations[0].effect, effect);
+    }
+}
+
+/// PowerPoint's default durations (COM `AddEffect`), which differ from the 0.5 s most effects get.
+#[test]
+fn default_durations_match_powerpoint() {
+    for (effect, ms) in [
+        ("grow", 1000),
+        ("shrinkTurn", 1000),
+        ("box", 2000),
+        ("circle", 2000),
+        ("diamond", 2000),
+        ("boxOut", 2000),
+        ("diamondOut", 2000),
+        ("expand", 1000),
+        ("contract", 1000),
+        ("spinner", 500),
+        ("spinnerOut", 500),
+        ("colorPulse", 250),
+        ("objectColor", 500),
+        ("boldFlash", 2000),
+    ] {
+        let a = deckcraft_model::anim::ANIMATIONS.iter().find(|a| a.0 == effect).unwrap();
+        assert_eq!(a.4, ms, "{effect}");
+    }
+}
@@ -1040,8 +1040,7 @@ fn draw_bars(ctx: &mut RenderContext, draw: &BarDrawing<'_, '_>) -> Vec<(f64, f6
                        err_marks.push((mid, p0, p1, bar.min(base * 0.8) * 0.5, e.end_cap));
                    }
                }
-                if c.series_data_labels(s) {
-                    let t = c.data_label(s, s.values.get(i).copied().flatten().unwrap_or(0.0));
+                if let Some(t) = bar_data_label(c, s, i) {
                    let lr = if horiz {
                        Rect::new(r.x1 + 2.0, r.y0, r.x1 + 40.0, r.y1)
                    } else {
@@ -1068,6 +1067,31 @@ fn draw_bars(ctx: &mut RenderContext, draw: &BarDrawing<'_, '_>) -> Vec<(f64, f6
    err_marks
 }

+fn bar_data_label(c: &Chart, s: &deckcraft_model::chart::Series, i: usize) -> Option<String> {
+    if !c.series_data_labels(s) {
+        return None;
+    }
+    s.values.get(i).copied().flatten().map(|value| c.data_label(s, value))
+}
+
+#[cfg(test)]
+mod bar_label_tests {
+    use super::bar_data_label;
+    use deckcraft_model::chart::{Chart, Series};
+
+    #[test]
+    fn missing_bar_values_have_no_label_but_explicit_zero_does() {
+        let chart = Chart { data_labels: true, ..Default::default() };
+        let series = Series { values: [Some(1.0), None, Some(3.0)].into(), ..Default::default() };
+
+        let labels: Vec<_> = (0..series.values.len()).filter_map(|i| bar_data_label(&chart, &series, i)).collect();
+
+        assert_eq!(labels, ["1", "3"]);
+        let zero = Series { values: [Some(0.0)].into(), ..Default::default() };
+        assert_eq!(bar_data_label(&chart, &zero, 0).as_deref(), Some("0"));
+    }
+}
+
 fn draw_pie(ctx: &mut RenderContext, rctx: &Ctx, c: &Chart, m: Affine, area: Rect, base: f64, text_col: Rgba) {
    let Some(s) = c.series.first() else { return };
    let vals: Vec<f64> = s.values.iter().map(|v| v.unwrap_or(0.0).max(0.0)).collect();
@@ -199,3 +199,21 @@ pub(crate) fn scale_of(m: Affine) -> f64 {
 pub(crate) fn blur(sigma: f64) -> Filter {
    Filter::from_primitive(FilterPrimitive::GaussianBlur { std_deviation: sigma.clamp(0.0, 500.0) as f32, edge_mode: EdgeMode::None })
 }
+
+/// The widest a shape may reach on screen, in pixels, and still be drawn: ten thousand screens
+/// across, far past any real deck, and still cheap for vello to flatten (#1165).
+const MAX_DEVICE_EXTENT: f64 = 1e7;
+
+/// Whether a shape's geometry can go to vello. Geometry far beyond any screen (a size at the EMU
+/// limit, group scales compounding, custom-geometry guides) makes vello's flattener size a buffer
+/// by its on-screen length, and the allocation aborts the process (#1165). Each path is checked
+/// for finite points first: a bounding box drops NaN, and a union with the frame would hide it.
+/// The extent is the control box, which always holds the curve: the tight bounding box can miss
+/// a curve's extremum when finding it overflows.
+pub(crate) fn drawable(geo: &Geometry, m: Affine, w: f64, h: f64) -> bool {
+    if !geo.paths.iter().all(|p| p.path.is_finite()) {
+        return false;
+    }
+    let dev = m.transform_rect_bbox(geo.outline().control_box().union(Rect::new(0.0, 0.0, w, h)));
+    dev.is_finite() && dev.width().max(dev.height()) <= MAX_DEVICE_EXTENT
+}
@@ -95,6 +95,7 @@ impl Default for RenderOpts<'_> {
    }
 }

+#[derive(Clone)]
 pub(crate) struct SlideFields {
    pub(crate) num: u32,
    /// Text for every date field instead of the date ([`RenderOpts::date_text`]).
@@ -1,4 +1,6 @@
-use super::geometry::{Caster, blur, border_outside, camera_turn, color, fill_opacity, outside_line, scale_of, shadow_local, shape_geometry};
+use super::geometry::{
+    Caster, blur, border_outside, camera_turn, color, drawable, fill_opacity, outside_line, scale_of, shadow_local, shape_geometry,
+};
 use super::opts::{RenderOpts, ShapeState, SlideFields};
 use super::raster::Image;
 use super::slide::{SlidePart, needs_filters, output_size};
@@ -134,6 +136,10 @@ impl Renderer {

    /// Background plus the master and layout graphics the slide shows.
    fn backdrop(&mut self, ctx: &mut RenderContext, f: &Frame, rctx: &Ctx, slide: &Slide, view: Affine) {
+        // Backdrop graphics never take shape states: their ids may clash with the slide's shapes.
+        let bopts = RenderOpts { state: None, date_text: f.opts.date_text.clone(), ..*f.opts };
+        let bf = Frame { pres: f.pres, opts: &bopts, fields: f.fields.clone() };
+        let f = &bf;
        self.background(ctx, f, rctx, Some(slide), view);
        let (show_layout, show_master) = resolve::show_master_shapes(slide, rctx.layout);
        if show_master {
@@ -209,14 +215,12 @@ impl Renderer {
        self.in_shadow_pass = false;
        let (mut ctx, w, h, view) = Self::canvas(pres, opts, needs_filters(pres, old.0) || needs_filters(pres, new.0));
        let (Some(co), Some(cn)) = (Ctx::for_slide(pres, old.0), Ctx::for_slide(pres, new.0)) else { return self.finish(ctx, w, h) };
-        // Backdrop graphics never take shape states: their ids may clash with the frame's shapes.
-        let bopts = RenderOpts { state: None, date_text: opts.date_text.clone(), ..*opts };
        if mix < 1.0 {
-            let f = Frame { pres, opts: &bopts, fields: Self::fields(pres, old.1, opts) };
+            let f = Frame { pres, opts, fields: Self::fields(pres, old.1, opts) };
            self.backdrop(&mut ctx, &f, &co, old.0, view);
        }
        if mix > 0.0 {
-            let f = Frame { pres, opts: &bopts, fields: Self::fields(pres, new.1, opts) };
+            let f = Frame { pres, opts, fields: Self::fields(pres, new.1, opts) };
            let layered = mix < 1.0;
            if layered {
                ctx.push_layer(None, None, Some(mix as f32), None, None);
@@ -585,6 +589,10 @@ impl Renderer {
            Some(pm) => self.morphs.geometry(pm, s, w, h),
            None => (self.scaled_geometry(s, m, depth, w, h), Vec::new()),
        };
+        if !drawable(&geo, m, w, h) {
+            log::warn!("render: shape {} skipped: its outline is not finite or far larger than any screen", s.id.0);
+            return;
+        }
        let (fill, fill_ph) = resolve::fill(rctx, s);
        let (line, line_ph) = resolve::line(rctx, s);
        let (effects, fx_ph) = resolve::effects(rctx, s);
@@ -1776,6 +1776,28 @@ fn the_editor_pasteboard_draws_shapes_off_the_slide() {
    assert!(drawn.x0 <= -100.0 && drawn.y1 >= 660.0 && drawn.x1 >= 960.0, "{drawn:?}");
 }

+#[test]
+fn animation_state_skips_layout_and_master_shapes_sharing_a_slide_shape_id() {
+    let mut p = Presentation::default();
+    let bar = |x| Shape {
+        id: ShapeId(77),
+        xfrm: Some(Xfrm::new(x, 400.0, 100.0, 60.0)),
+        fill: Some(Fill::solid(ColorRef::rgb(Rgba::rgb(200, 0, 0)))),
+        ..Default::default()
+    };
+    let lid = p.slides[0].layout;
+    let m = std::sync::Arc::make_mut(&mut p.masters[0]);
+    m.shapes.push(bar(100.0));
+    m.layouts.iter_mut().find(|l| l.id == lid).expect("layout").shapes.push(bar(400.0));
+    std::sync::Arc::make_mut(&mut p.slides[0]).shapes.push(bar(700.0));
+    let hide = |_: ShapeId| ShapeState { visible: false, ..Default::default() };
+    let img = render_slide(&p, 0, &RenderOpts { scale: 1.0, state: Some(&hide), ..Default::default() });
+    for x in [150, 450] {
+        assert_eq!(img.pixel(x, 430)[..3], [200, 0, 0], "the backdrop bar at x={x} stays");
+    }
+    assert_ne!(img.pixel(750, 430)[..3], [200, 0, 0], "the slide's own shape with that id is hidden");
+}
+
 #[test]
 fn master_graphics_off_the_slide_show_on_the_pasteboard() {
    let mut p = Presentation::default();
@@ -2951,3 +2973,59 @@ fn pie_data_labels_take_the_chart_text_colour_when_it_has_one() {
    assert!(count(&coloured, &red) > 30, "the labels take the chart's red: {} red pixels", count(&coloured, &red));
    assert!(count(&plain, &white) > count(&coloured, &white), "the labels were white before");
 }
+
+/// #1165: an ellipse sized at the EMU limit, crossing the slide, made vello's flattener allocate a
+/// buffer from its on-screen length and abort. It is skipped; the rest of the slide still draws.
+#[test]
+fn a_shape_far_larger_than_any_screen_is_skipped_not_flattened() {
+    let huge = Shape {
+        id: ShapeId(501),
+        geom: Geom::preset("ellipse"),
+        xfrm: Some(Xfrm::new(-5e17, -5e17, 1e18, 1e18)),
+        style: Some(ShapeStyle::accent(deckcraft_color::SchemeSlot::Accent2)),
+        ..Default::default()
+    };
+    let normal = Shape {
+        id: ShapeId(502),
+        xfrm: Some(Xfrm::new(100.0, 100.0, 200.0, 100.0)),
+        style: Some(ShapeStyle::accent(deckcraft_color::SchemeSlot::Accent1)),
+        ..Default::default()
+    };
+    let p = deck_with(vec![huge, normal]);
+    let img = render_slide(&p, 0, &RenderOpts { scale: 1.0, ..Default::default() });
+    let accent = p.masters[0].theme.colors.get(deckcraft_color::SchemeSlot::Accent1);
+    let px = img.pixel(200, 150);
+    assert!((px[0] as i32 - accent.r as i32).abs() <= 2, "{px:?} vs {accent:?}");
+    assert_eq!(img.pixel(50, 50), [255, 255, 255, 255], "the huge ellipse is not drawn");
+}
+
+/// #1165: a path with a NaN point is not drawn, even when the shape's frame is finite and small
+/// (a bounding box, or a union with the frame, would hide the NaN).
+#[test]
+fn a_shape_whose_outline_is_not_finite_is_not_drawable() {
+    let geo = |pts: &[(f64, f64)]| {
+        let mut path = kurbo::BezPath::new();
+        path.move_to(pts[0]);
+        for p in &pts[1..] {
+            path.line_to(*p);
+        }
+        deckcraft_geom::preset::Geometry {
+            paths: vec![deckcraft_geom::preset::SubPath { path, fill: deckcraft_geom::preset::FillMode::Norm, stroke: true, even_odd: false }],
+            text_rect: kurbo::Rect::ZERO,
+            handles: vec![],
+            sites: vec![],
+        }
+    };
+    let m = kurbo::Affine::IDENTITY;
+    assert!(crate::geometry::drawable(&geo(&[(0.0, 0.0), (100.0, 50.0)]), m, 100.0, 50.0));
+    assert!(!crate::geometry::drawable(&geo(&[(0.0, 0.0), (f64::NAN, 50.0)]), m, 100.0, 50.0));
+    assert!(!crate::geometry::drawable(&geo(&[(0.0, 0.0), (f64::INFINITY, 50.0)]), m, 100.0, 50.0));
+    assert!(!crate::geometry::drawable(&geo(&[(0.0, 0.0), (1e18, 50.0)]), m, 100.0, 50.0));
+    // A quadratic whose extremum overflows kurbo's bounding box: its control point still counts.
+    let mut path = kurbo::BezPath::new();
+    path.move_to((0.0, 0.0));
+    path.quad_to((1e308, 0.0), (0.0, 0.0));
+    let mut quad = geo(&[(0.0, 0.0), (1.0, 1.0)]);
+    quad.paths[0].path = path;
+    assert!(!crate::geometry::drawable(&quad, m, 100.0, 50.0));
+}
@@ -104,11 +104,20 @@ pub fn field_text(kind: &str, lang: Option<&str>, now: DateTime) -> Option<Strin
    let ampm = if now.hour < 12 { "AM" } else { "PM" };
    let (mi, s) = (now.minute, now.second);
    let short = short_date(&lang, now);
+    // British-style English writes the day before the month ("9 October 2026"). The punctuation
+    // follows PowerPoint on Windows per locale: Irish English has no comma after the weekday,
+    // British and Australian English put one after the month in `datetime3`, and South African
+    // English writes the weekday form day first too.
+    let day_first = matches!(lang.as_str(), "en-gb" | "en-au" | "en-nz" | "en-ie" | "en-in");
    let named = |text: String| english.then_some(text);
    match kind {
        "datetime" | "datetimeFigureOut" | "datetime1" => Some(short),
+        "datetime2" if lang == "en-ie" => named(format!("{day} {d} {month} {y}")),
+        "datetime2" if day_first || lang == "en-za" => named(format!("{day}, {d} {month} {y}")),
        "datetime2" => named(format!("{day}, {month} {d}, {y}")),
+        "datetime3" if matches!(lang.as_str(), "en-gb" | "en-au") => named(format!("{d} {month}, {y}")),
        "datetime3" => named(format!("{d} {month} {y}")),
+        "datetime4" if day_first => named(format!("{d} {month} {y}")),
        "datetime4" => named(format!("{month} {d}, {y}")),
        "datetime5" => named(format!("{d}-{mon}-{yy:02}")),
        "datetime6" => named(format!("{month} {yy:02}")),
@@ -183,7 +192,32 @@ mod tests {
        // Month names in another language: not computed (the field keeps its saved text).
        assert_eq!(field_text("datetime2", Some("de-DE"), FRI), None);
        assert_eq!(field_text("datetime12", Some("fr-FR"), FRI), None);
-        assert_eq!(field_text("datetime4", Some("en-GB"), FRI).as_deref(), Some("October 9, 2026"));
+        assert_eq!(field_text("datetime4", Some("en-GB"), FRI).as_deref(), Some("9 October 2026"));
+        assert_eq!(field_text("datetime2", Some("en-GB"), FRI).as_deref(), Some("Friday, 9 October 2026"));
+        assert_eq!(field_text("datetime4", Some("en-AU"), FRI).as_deref(), Some("9 October 2026"));
+        assert_eq!(field_text("datetime4", Some("en-US"), FRI).as_deref(), Some("October 9, 2026"));
+    }
+
+    /// The long English dates as PowerPoint on Windows shows them on Tuesday 27 October 2026, read
+    /// per run language (datetime2, datetime3, datetime4).
+    #[test]
+    fn long_english_dates_follow_each_locale() {
+        let tue = DateTime::new(2026, 10, 27, 9, 0, 0);
+        let rows = [
+            ("en-US", "Tuesday, October 27, 2026", "27 October 2026", "October 27, 2026"),
+            ("en-GB", "Tuesday, 27 October 2026", "27 October, 2026", "27 October 2026"),
+            ("en-AU", "Tuesday, 27 October 2026", "27 October, 2026", "27 October 2026"),
+            ("en-NZ", "Tuesday, 27 October 2026", "27 October 2026", "27 October 2026"),
+            ("en-IE", "Tuesday 27 October 2026", "27 October 2026", "27 October 2026"),
+            ("en-IN", "Tuesday, 27 October 2026", "27 October 2026", "27 October 2026"),
+            ("en-CA", "Tuesday, October 27, 2026", "27 October 2026", "October 27, 2026"),
+        ];
+        for (lang, d2, d3, d4) in rows {
+            assert_eq!(field_text("datetime2", Some(lang), tue).as_deref(), Some(d2), "{lang}");
+            assert_eq!(field_text("datetime3", Some(lang), tue).as_deref(), Some(d3), "{lang}");
+            assert_eq!(field_text("datetime4", Some(lang), tue).as_deref(), Some(d4), "{lang}");
+        }
+        assert_eq!(field_text("datetime2", Some("en-ZA"), tue).as_deref(), Some("Tuesday, 27 October 2026"));
    }

    #[test]
@@ -132,38 +132,60 @@ impl BoxGeom {
    }
 }

-/// Number shown for a paragraph at list level `lvl`, advancing the per-level counters.
-fn next_number(numbering: &mut [u32], lvl: usize, auto_num: bool, empty: bool) -> Option<u32> {
-    if auto_num && !empty {
-        if let Some(n) = numbering.get_mut(lvl) {
-            *n += 1;
-        }
-        for deeper in numbering.iter_mut().skip(lvl + 1) {
-            *deeper = 0;
-        }
-        numbering.get(lvl).copied()
-    } else if auto_num {
-        // Preview the next number without consuming it: empty paragraphs do not advance
-        // numbering in the saved document or affect later populated paragraphs.
-        numbering.get(lvl).map(|n| n.saturating_add(1))
-    } else {
-        if !empty {
-            for n in numbering.iter_mut().skip(lvl) {
+/// Number shown for a paragraph at list level `lvl`, advancing the per-level counters. `start_at`
+/// is the paragraph's numbering start (`None`: not numbered); `run_start` holds the start each
+/// level's current run of numbers began with, and a paragraph that changes it starts a new run
+/// (PowerPoint's "Start at").
+fn next_number(numbering: &mut [u32], run_start: &mut [u32], lvl: usize, start_at: Option<u32>, empty: bool) -> Option<u32> {
+    match start_at {
+        Some(start) if !empty => {
+            if let (Some(rs), Some(n)) = (run_start.get_mut(lvl), numbering.get_mut(lvl))
+                && *rs != start
+            {
+                *rs = start;
                *n = 0;
            }
+            if let Some(n) = numbering.get_mut(lvl) {
+                *n += 1;
+            }
+            for deeper in numbering.iter_mut().skip(lvl + 1) {
+                *deeper = 0;
+            }
+            numbering.get(lvl).copied()
+        }
+        // Preview the next number without consuming it: empty paragraphs do not advance
+        // numbering in the saved document or affect later populated paragraphs. A paragraph
+        // with its own start would begin a new run, so it previews that run's first number.
+        Some(start) => {
+            if run_start.get(lvl).is_some_and(|rs| *rs != start) {
+                Some(1)
+            } else {
+                numbering.get(lvl).map(|n| n.saturating_add(1))
+            }
+        }
+        None => {
+            if !empty {
+                for n in numbering.iter_mut().skip(lvl) {
+                    *n = 0;
+                }
+            }
+            None
        }
-        None
    }
 }

 fn shape_paragraphs(ctx: &Ctx, shape: &Shape, body: &TextBody, opts: &Opts, scale: f64, upright: Upright) -> Vec<ParaShaped> {
    let mut numbering: Vec<u32> = vec![0; 9];
+    let mut run_start: Vec<u32> = vec![0; 9];
    let mut shaped_paras: Vec<ParaShaped> = Vec::with_capacity(body.paragraphs.len());
    for (pi, para) in body.paragraphs.iter().enumerate() {
        let lvl = para.level.min(8) as usize;
        let pp = resolve::para(ctx, shape, para);
-        let auto_num = matches!(pp.bullet, Some(Bullet::AutoNum { .. }));
-        let number = next_number(&mut numbering, lvl, auto_num, para.is_empty());
+        let start_at = match &pp.bullet {
+            Some(Bullet::AutoNum { start_at, .. }) => Some(*start_at),
+            _ => None,
+        };
+        let number = next_number(&mut numbering, &mut run_start, lvl, start_at, para.is_empty());
        shaped_paras.push(shape_para(ctx, shape, body, pi, scale, opts, number, upright));
    }
    shaped_paras
@@ -1,7 +1,7 @@
 use super::autonum::autonum;
 use super::run::{RunEffects, TextShadow};
 use super::style::{Cell, Opts, ParaShaped, Style, face_chain, make_style};
-use super::symbol::{covers_symbol, map_symbol_bullet, symbol_font_char, symbol_map_char};
+use super::symbol::{covers_symbol, is_symbol_font, map_symbol_bullet, symbol_font_char, symbol_map_char};
 use super::{
    Arc, Bullet, Caps, Ctx, Fill, FontDb, FontFace, FontSlot, HashMap, ParaProps, RunKind, RunProps, ScriptTag, Shape, ShapeParams, TextBody,
    UnicodeSegmentation, bidi, resolve, script,
@@ -93,9 +93,11 @@ pub(crate) fn shape_para(
                Some(c) => c.to_string(),
                None => map_symbol_bullet(char, props.bullet_font.as_deref()),
            };
-            if !st.face.covers(ch.chars().next().unwrap_or('•')) {
-                st.face = db.face("Inter", "Regular");
-            }
+            bullet_face(db, &mut st, &ch);
+            // A face the cascade still picks may lack the bullet: draw the dot rather than .notdef.
+            let chars: Vec<char> = ch.chars().collect();
+            let ch = if deckcraft_fonts::covers_cluster(&st.face, &chars) { ch } else { "•".into() };
+            bullet_face(db, &mut st, &ch);
            Some((ch, st))
        }
        Some(Bullet::AutoNum { scheme, start_at }) => {
@@ -183,7 +185,9 @@ fn shape_cells(
        let Some(st) = styles.get(si) else { continue };
        let (sc, slot) = scripts.get(a).copied().unwrap_or((None, FontSlot::Latin));
        // Spaces, digits and punctuation stay in the face of the text before them when it can
-        // draw them, so a phrase isn't cut into items at every space.
+        // draw them, so a phrase isn't cut into items at every space; not in a symbol font
+        // (`a:sym`), which PowerPoint uses for the symbol codes alone (Wingdings' space is about
+        // four times a text font's).
        // Emoji, and pictographs asked to look like text (U+FE0E), pick their own face.
        let neutral =
            cluster.iter().all(|c| script::script_of(*c).is_none()) && !deckcraft_fonts::is_emoji_cluster(cluster) && !cluster.contains(&'\u{FE0E}');
@@ -200,7 +204,11 @@ fn shape_cells(
        let face = match (sym_face, prev.as_ref()) {
            (Some(f), _) => f,
            (None, Some(p))
-                if neutral && !p.is_color() && deckcraft_fonts::covers_cluster(p, cluster) && char_style.get(a.wrapping_sub(1)) == Some(&si) =>
+                if neutral
+                    && !p.is_color()
+                    && !is_symbol_font(&p.family)
+                    && deckcraft_fonts::covers_cluster(p, cluster)
+                    && char_style.get(a.wrapping_sub(1)) == Some(&si) =>
            {
                p.clone()
            }
@@ -275,7 +275,9 @@ pub fn map_symbol_bullet(c: &str, font: Option<&str>) -> String {
        };
        return m.to_string();
    }
-    if f.contains("wingdings") || f.contains("symbol") || ('\u{f000}'..='\u{f0ff}').contains(&first) {
+    // Only the legacy symbol fonts: "Noto Sans Symbols" and the like are Unicode fonts whose
+    // characters (❑ ❖) are drawn as they are. Private-use codes are mapped only when no font is named.
+    if f.contains("wingdings") || f == "symbol" || (font.is_none() && ('\u{f000}'..='\u{f0ff}').contains(&first)) {
        let code = (first as u32) & 0xff;
        // Wingdings 2 and 3 put different shapes at the same codes.
        if f.starts_with("wingdings 2") {
@@ -177,6 +177,27 @@ fn only_the_first_character_of_a_bullet_is_drawn() {
    assert_eq!(map_symbol_bullet("e\u{301}x", None), "e\u{301}");
 }

+#[test]
+fn bullet_in_an_unavailable_unicode_symbol_font_keeps_its_character() {
+    // Google Slides bullets in "Noto Sans Symbols" (not installed) draw ❑ ❖, not a generic dot (#1347).
+    for c in ["\u{2751}", "\u{2756}", "\u{f0a7}"] {
+        assert_eq!(map_symbol_bullet(c, Some("Noto Sans Symbols")), c);
+    }
+    // The legacy symbol fonts still map their codes.
+    assert_eq!(map_symbol_bullet("q", Some("Wingdings")), "\u{2751}");
+    let (p, mut sh) = setup("One", 600.0, 300.0);
+    let para = &mut sh.text.as_mut().unwrap().paragraphs[0];
+    para.props.bullet = Some(Bullet::Char { char: "\u{2751}".into() });
+    para.props.bullet_font = Some("Noto Sans Symbols".into());
+    let l = lay(&p, &sh, 600.0, 300.0);
+    let bullet = l.runs.iter().find(|r| r.chars == (0, 0)).expect("bullet run");
+    assert_eq!(bullet.glyphs.len(), 1);
+    let square = deckcraft_fonts::first_glyph(&bullet.face, &['\u{2751}']);
+    let expected = if square != 0 { square } else { deckcraft_fonts::first_glyph(&bullet.face, &['\u{2022}']) };
+    assert_ne!(expected, 0, "the selected face must draw ❑ or the fallback dot");
+    assert_eq!(bullet.glyphs[0].0, expected, "draw the requested bullet when covered, else the dot");
+}
+
 #[test]
 fn shrink_on_overflow() {
    let text = (0..30).map(|i| format!("Line number {i}")).collect::<Vec<_>>().join("\n");
@@ -1255,6 +1276,43 @@ fn symbol_font_characters_draw_in_the_sym_font() {
    assert!(families.iter().all(|(f, c)| c.0 == 1 || !f.eq_ignore_ascii_case(symbol)), "{families:?}");
 }

+#[test]
+fn a_space_after_a_symbol_font_character_keeps_the_runs_font() {
+    // PowerPoint stores "→ Only" typed in a Wingdings run as U+F0E0, a space and the words, all
+    // with `<a:sym typeface="Wingdings"/>`: only the symbol code draws in Wingdings. The space
+    // stayed in the arrow's face, and Wingdings' space is about four times as wide. Skipped
+    // without Wingdings.
+    let db = FontDb::global();
+    if !db.has_family("Wingdings") || !covers_symbol(&db.face("Wingdings", "Regular"), '\u{F0E0}') {
+        eprintln!("skipped: no installed Wingdings face draws U+F0E0");
+        return;
+    }
+    let laid = |split: bool| {
+        let (p, mut sh) = setup("\u{F0E0} Only", 900.0, 300.0);
+        let para = &mut sh.text.as_mut().unwrap().paragraphs[0];
+        para.props.bullet = Some(Bullet::None);
+        para.runs[0].props.font = Some("Arial".into());
+        para.runs[0].props.font_sym = Some("Wingdings".into());
+        if split {
+            // The arrow alone carries the symbol font.
+            let mut rest = para.runs[0].clone();
+            rest.text = " Only".into();
+            rest.props.font_sym = None;
+            para.runs[0].text = "\u{F0E0}".into();
+            para.runs.push(rest);
+        }
+        lay(&p, &sh, 900.0, 300.0)
+    };
+    let whole = laid(false);
+    let families: Vec<(String, (usize, usize))> = whole.runs.iter().map(|r| (r.face.family.clone(), r.chars)).collect();
+    assert!(families.iter().any(|(f, c)| f.eq_ignore_ascii_case("Wingdings") && c.0 == 0), "the arrow: {families:?}");
+    let in_wingdings = |i: usize| families.iter().any(|(f, c)| (c.0..c.1).contains(&i) && f.eq_ignore_ascii_case("Wingdings"));
+    assert!(!in_wingdings(1) && !in_wingdings(2), "the space and words: {families:?}");
+    // "Only" starts where it does when the arrow alone is in Wingdings.
+    let o = |l: &TextLayout| l.lines[0].caret_x[2];
+    assert!((o(&whole) - o(&laid(true))).abs() < 0.01, "{} vs {}", o(&whole), o(&laid(true)));
+}
+
 #[test]
 fn small_capitals_draw_smaller_than_the_capitals_beside_them() {
    let (p, mut sh) = setup("HxHx", 2000.0, 300.0);
@@ -1845,3 +1903,28 @@ fn an_empty_paragraph_keeps_its_paragraph_mark_height() {
    let h = l.lines[1].bottom - l.lines[1].top;
    assert!((h - h10).abs() < 0.5, "a 10pt empty paragraph should give {h10}, got {h}");
 }
+
+#[test]
+fn a_paragraph_with_its_own_start_at_restarts_the_count_there() {
+    // PowerPoint's "Start at" on a paragraph begins a new run of numbers at that value, so setting
+    // start k on paragraph k reads 1, 2, 3, not 1, 3, 5.
+    // The bullets' glyph ids next to those of the expected labels, as pairs (drawn, expected).
+    let check = |starts: &[u32], expect: &[u32]| {
+        let (p, mut sh) = setup("a\nb\nc\nd", 600.0, 300.0);
+        for (para, st) in sh.text.as_mut().unwrap().paragraphs.iter_mut().zip(starts) {
+            para.props.bullet = Some(Bullet::AutoNum { scheme: "arabicPeriod".into(), start_at: *st });
+        }
+        let l = lay(&p, &sh, 600.0, 300.0);
+        let bullets: Vec<_> = l.runs.iter().filter(|r| r.cells.is_empty()).collect();
+        assert_eq!(bullets.len(), expect.len());
+        for (b, n) in bullets.iter().zip(expect) {
+            let want = measure_str(&b.face, b.size, &format!("{n}.")).1.iter().map(|g| g.0).collect::<Vec<_>>();
+            assert_eq!(b.glyphs.iter().map(|g| g.0).collect::<Vec<_>>(), want, "expected {n}. for starts {starts:?}");
+        }
+    };
+    check(&[1, 2, 3, 4], &[1, 2, 3, 4]);
+    // The same start on every paragraph still counts on from it (a whole box numbered at once).
+    check(&[3, 3, 3, 3], &[3, 4, 5, 6]);
+    // A later paragraph with a new start begins a fresh run.
+    check(&[1, 1, 7, 7], &[1, 2, 7, 8]);
+}
@@ -164,7 +164,17 @@ impl SlideApp {
                    self.start_show(from, false);
                }
            }
-            "show.presenter" => self.ui.presenter_view = self.flag(p, self.ui.presenter_view),
+            "show.presenter" => {
+                self.ui.presenter_view = self.flag(p, self.ui.presenter_view);
+                // The browser build has one viewport: presenter view is drawn inside the page.
+                return Ok(json!({"on": self.ui.presenter_view, "window": !cfg!(target_arch = "wasm32")}));
+            }
+            "show.keepCursor" => {
+                self.ui.show_keep_cursor = self.flag(p, self.ui.show_keep_cursor);
+                if let Some(s) = self.show.as_mut() {
+                    s.keep_cursor = self.ui.show_keep_cursor;
+                }
+            }
            "show.end" => {
                self.show = None;
                self.media.stop_owned(media::Owner::Show);
@@ -36,6 +36,7 @@ impl SlideApp {
            self.show_instance = self.show_instance.wrapping_add(1).max(1);
            let mut show = show::Show::new(&d.doc, from, reading, self.ui.presenter_view && !reading);
            show.instance = self.show_instance;
+            show.keep_cursor = self.ui.show_keep_cursor;
            self.show = Some(show);
        }
    }
@@ -389,7 +389,9 @@ pub fn show(app: &mut SlideApp, ui: &mut Ui) {
        w.active.bg_stroke = Stroke::new(1.0, t.accent);
        egui::ScrollArea::vertical().auto_shrink([false, false]).show(ui, |ui| {
            egui::Frame::NONE.inner_margin(egui::Margin { left: 48, right: 36, top: 22, bottom: 32 }).show(ui, |ui| {
-                ui.set_max_width(CONTENT_W);
+                // set_max_width can also widen: in a window narrower than CONTENT_W it would push the
+                // page past the right margin and clip the tiles (#1421).
+                ui.set_max_width(ui.available_width().min(CONTENT_W));
                if bs.page != Page::Home {
                    ui.label(RichText::new(bs.page.label()).font(theme::bold(22.0)).color(t.text));
                    ui.add_space(16.0);
@@ -179,6 +179,25 @@ fn every_page_renders() {
    assert!(h.state_mut().run("app.backstage", json!({"page": "share"})).is_err(), "Share (cloud) isn't offered");
 }

+/// In a window narrower than the page's maximum width the New tiles stay inside the right margin (#1421).
+#[test]
+fn new_tiles_keep_the_right_margin_in_a_narrow_window() {
+    let mut h = Harness::builder().with_size(egui::vec2(1000.0, 900.0)).build_ui_state(
+        |ui, app: &mut SlideApp| {
+            app.logic(ui.ctx());
+            app.ui(ui);
+        },
+        new_app(),
+    );
+    h.state_mut().run("app.backstage", json!({"page": "new"})).unwrap();
+    h.run_steps(3);
+    let tiles = ["DeckCraft", "Harbor", "Ember", "Meadow", "Nocturne", "Paper", "Briefing"];
+    for label in tiles {
+        let r = h.get_by_label(label).rect();
+        assert!(r.right() <= 1000.0 - 36.0, "{label} ends at {}, inside the 36pt right margin", r.right());
+    }
+}
+
 /// A starter template from File › New opens its deck and leaves the File tab.
 #[test]
 fn new_template_opens_a_starter_deck() {
@@ -396,3 +396,7 @@ mod ruler_tests;

 #[cfg(test)]
 mod guides_tests;
+
+#[cfg(test)]
+#[path = "media_bar_tests.rs"]
+mod media_bar_tests;
@@ -259,6 +259,7 @@ fn dlg_setup_show(app: &mut SlideApp, ui: &mut Ui, d: &mut Dialog) -> bool {
    let nn = check(ui, d, "Show without narration", "nn", sh.without_narration);
    let na = check(ui, d, "Show without animation", "na", sh.without_animation);
    let ut = check(ui, d, "Use timings, if present", "ut", sh.use_timings);
+    let kc = check(ui, d, "Keep mouse cursor visible", "kc", app.ui.show_keep_cursor);
    let names: Vec<String> = app.session.active().map(|s| s.doc.custom_shows.iter().map(|c| c.name.clone()).collect()).unwrap_or_default();
    let chosen = d.fields.entry("custom".into()).or_insert_with(|| sh.custom_show.clone().unwrap_or_default()).clone();
    let field = ui.label("Slides");
@@ -279,6 +280,7 @@ fn dlg_setup_show(app: &mut SlideApp, ui: &mut Ui, d: &mut Dialog) -> bool {
        let ty = d.get("type", "speaker");
        let custom = d.fields.get("custom").cloned().unwrap_or_default();
        run(app, "show.setup", json!({"type": ty, "loop": lp, "noNarration": nn, "noAnimation": na, "useTimings": ut, "custom": custom}));
+        run(app, "show.keepCursor", json!({"on": kc}));
    }
    ok || cancel
 }
@@ -16,7 +16,7 @@ pub(crate) struct Runtime {

 impl Default for Runtime {
    fn default() -> Self {
-        Self { updater: Updater::new(&craft_update::suite::DECKCRAFT, VERSION), enabled: false, check_requested: false }
+        Self { updater: Updater::new(&crate::UPDATE_APP, VERSION), enabled: false, check_requested: false }
    }
 }

@@ -6,6 +6,15 @@
 #![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]
 #![forbid(unsafe_code)]

+/// DeckCraft as craft-update knows it, with its 128 px icon and accent colour: the update
+/// prompt shows both, and an AppImage's menu entry gets the icon.
+#[cfg(not(target_arch = "wasm32"))]
+pub const UPDATE_APP: craft_update::app::App = craft_update::app::App {
+    icon_png: Some(include_bytes!("../../../assets/app-icon/hicolor/128x128/apps/ai.storyteller.deckcraft.png")),
+    accent: Some([0xf0, 0x7a, 0x1e]),
+    ..craft_update::suite::DECKCRAFT
+};
+
 pub mod backstage;
 pub mod canvas;
 pub mod capture;
@@ -109,7 +118,13 @@ pub const UI_COMMANDS: &[(&str, &str, Option<&str>, &str)] = &[
    ("view.grayscale", "Grayscale", None, "{on?: bool}"),
    ("view.newWindow", "New Window", None, "{on?: bool, slide?: index, delta?: int}"),
    ("show.start", "Slide Show", Some("F5"), "{from?: index, custom?: name}"),
-    ("show.presenter", "Presenter View", None, "{on?: bool}"),
+    (
+        "show.presenter",
+        "Presenter View",
+        None,
+        "{on?: bool} → {on, window} (presenter view, with notes, a clock and the next slide, appears in its own separate window beside the show window when the show starts; window is false in the browser build, which draws it inside the page)",
+    ),
+    ("show.keepCursor", "Keep Mouse Cursor Visible", None, "{on?: bool}"),
    ("show.end", "End Show", None, "{}"),
    ("animation.preview", "Preview Animations", None, "{on?: bool, from?: effect index}"),
    ("app.home", "Home", None, "{on?}"),
@@ -295,8 +310,8 @@ pub struct SlideApp {
    pub(crate) notes_buf: (u64, usize, notes::Draft),
    /// Faces borrowed from the font database for text the interface fonts can't draw (#101).
    pub ui_fonts: uifonts::UiFonts,
-    /// Thumbnail pane drag (slide index, current drop index).
-    pub(crate) thumb_drag: Option<(usize, usize)>,
+    /// Slide drag in the thumbnail pane or the Slide Sorter: the dragged slides and the drop gap.
+    pub(crate) thumb_drag: Option<thumbs::SlideDrag>,
    /// Selection pane: folded groups, renaming, drag and drop.
    pub selpane: selpane::State,
    /// Arrange ▸ Align: Align to Slide (`true`) or Align Selected Objects, ticked for that selection.
@@ -445,6 +460,10 @@ mod ime_tests;
 #[cfg(test)]
 mod last_color_tests;
 #[cfg(test)]
+mod presenter_tests;
+#[cfg(test)]
+mod reflection_pane_tests;
+#[cfg(test)]
 mod replacefonts_tests;
 #[cfg(test)]
 mod reuse_picker_tests;
@@ -472,6 +472,9 @@ pub enum BarAction {
 pub fn control_bar(ui: &mut Ui, rect: Rect, status: Option<&VoiceStatus>, clip: &MediaClip) -> Option<BarAction> {
    let painter = ui.painter_at(rect.expand(2.0));
    painter.rect_filled(rect, CornerRadius::same(4), Color32::from_rgba_unmultiplied(28, 28, 32, 230));
+    // Sensing drags too keeps a press on the bar from reaching the editor canvas: there it would
+    // start a selection marquee, which hides the bar before the click lands.
+    ui.interact(rect, ui.scope_id().with("media_bar_back"), Sense::click_and_drag());
    let playing = status.is_some_and(|s| matches!(s.state, PlayState::Playing | PlayState::Loading));
    let duration = status.map(|s| s.duration).filter(|d| *d > 0.0).unwrap_or(clip.duration_ms as f64 / 1000.0);
    let pos = status.map(|s| s.position).unwrap_or(clip.trim_start_ms as f64 / 1000.0);
@@ -481,7 +484,7 @@ pub fn control_bar(ui: &mut Ui, rect: Rect, status: Option<&VoiceStatus>, clip:
    let button = |ui: &mut Ui, x: &mut f32, id: &str, paint: &dyn Fn(&egui::Painter, Rect)| -> bool {
        let r = Rect::from_min_size(pos2(*x, rect.min.y + 2.0), vec2(h - 4.0, h - 4.0));
        *x += h - 2.0;
-        let resp = ui.interact(r, ui.scope_id().with(("media_bar", id)), Sense::click());
+        let resp = ui.interact(r, ui.scope_id().with(("media_bar", id)), Sense::click_and_drag());
        let name = match id {
            "play" => "Play or pause media",
            "back" => "Back 0.25 seconds",
@@ -0,0 +1,72 @@
+//! The play/pause and timeline bar under a selected audio or video in the editor, clicked with the
+//! mouse: a press on it used to reach the canvas, start a selection marquee there and hide the bar
+//! before the click landed, so Play only worked in the slide show.
+
+use deckcraft_engine::Session;
+use deckcraft_model::ShapeId;
+use egui::{Modifiers, PointerButton, Pos2, pos2, vec2};
+use egui_kittest::Harness;
+use serde_json::json;
+
+use crate::{Services, SlideApp};
+
+/// 16-bit mono WAV of silence, `secs` long at 8 kHz.
+fn wav(secs: f64) -> Vec<u8> {
+    let data = vec![0u8; (8_000.0 * secs) as usize * 2];
+    let mut b = Vec::new();
+    b.extend_from_slice(b"RIFF");
+    b.extend_from_slice(&(36 + data.len() as u32).to_le_bytes());
+    b.extend_from_slice(b"WAVEfmt ");
+    for v in [16u32.to_le_bytes(), [1, 0, 1, 0], 8_000u32.to_le_bytes(), 16_000u32.to_le_bytes(), [2, 0, 16, 0]] {
+        b.extend_from_slice(&v);
+    }
+    b.extend_from_slice(b"data");
+    b.extend_from_slice(&(data.len() as u32).to_le_bytes());
+    b.extend_from_slice(&data);
+    b
+}
+
+fn click(h: &mut Harness<'_, SlideApp>, p: Pos2) {
+    h.hover_at(p);
+    h.run_steps(1);
+    h.event(egui::Event::PointerButton { pos: p, button: PointerButton::Primary, pressed: true, modifiers: Modifiers::NONE });
+    h.run_steps(1);
+    h.event(egui::Event::PointerButton { pos: p, button: PointerButton::Primary, pressed: false, modifiers: Modifiers::NONE });
+    h.run_steps(2);
+}
+
+#[test]
+fn play_on_the_editor_media_bar_plays_the_selected_clip() {
+    let mut s = Session::with_new();
+    s.execute("slide.new", &json!({"layout": "blank"})).unwrap();
+    let r = s.execute("insert.audio", &json!({"name": "tone.wav", "data": deckcraft_engine::cmd::base64_encode(&wav(2.0))})).unwrap();
+    let id = ShapeId(r["id"].as_u64().unwrap() as u32);
+    let app = SlideApp::new(s, Services::default());
+    let mut h = Harness::builder().with_size(vec2(1400.0, 900.0)).with_step_dt(1.0 / 60.0).build_ui_state(
+        |ui, app: &mut SlideApp| {
+            app.logic(ui.ctx());
+            app.ui(ui);
+        },
+        app,
+    );
+    h.run_steps(3);
+    let d = h.state().session.active().unwrap();
+    assert_eq!(d.selection.shapes, vec![id], "the inserted clip is selected");
+    let x = d.doc.slides[d.selection.slide].shape(id).unwrap().xfrm.unwrap();
+    let (slide, k) = (h.state().slide_rect.unwrap(), h.state().canvas_scale);
+    // The bar sits 6 points under the clip, centred, at least 230 wide; Play is its first button.
+    let (left, right, bottom) = (slide.min.x + x.x as f32 * k, slide.min.x + (x.x + x.w) as f32 * k, slide.min.y + (x.y + x.h) as f32 * k);
+    let w = (right - left).max(230.0);
+    let bar = pos2((left + right) / 2.0 - w / 2.0, bottom + 6.0);
+    assert!(h.state().media.status(id).is_none());
+
+    click(&mut h, bar + vec2(15.0, 13.0));
+    assert!(h.state().media.status(id).is_some(), "Play starts the clip");
+    let d = h.state().session.active().unwrap();
+    assert_eq!(d.selection.shapes, vec![id], "the click did not reach the slide behind the bar");
+    assert!(!h.state().session.tool.dragging());
+
+    // Between the buttons and the timeline the bar still keeps the press from the slide.
+    click(&mut h, bar + vec2(w - 30.0, 13.0));
+    assert_eq!(h.state().session.active().unwrap().selection.shapes, vec![id]);
+}
@@ -72,6 +72,24 @@ pub fn ui_shortcut(app: &mut SlideApp, key: egui::Key, m: Mods) -> bool {
        }
        (F, true, false, false) => "app.find",
        (H, true, false, false) => "app.replace",
+        (Num1 | Num2 | Num3 | Num4 | Num5 | Num6 | Num7 | Num8 | Num9, false, false, true) => {
+            if app.session.mac_keys || app.backstage.is_some() || app.session.active().is_some_and(|d| d.selection.text.is_some()) {
+                return false;
+            }
+            let idx = match key {
+                Num1 => 0,
+                Num2 => 1,
+                Num3 => 2,
+                Num4 => 3,
+                Num5 => 4,
+                Num6 => 5,
+                Num7 => 6,
+                Num8 => 7,
+                Num9 => 8,
+                _ => return false,
+            };
+            return crate::qat::run_index(app, idx);
+        }
        _ => return false,
    };
    let _ = app.run(id, json!({}));
@@ -14,6 +14,7 @@ mod animation;
 mod background;
 mod comments;
 mod designer;
+mod effect_presets;
 mod format_shape;
 mod smartart;
 mod thesaurus;
@@ -121,6 +122,9 @@ pub mod thumbs;
 #[cfg(test)]
 mod background_tests;

+#[cfg(test)]
+mod effect_presets_tests;
+
 #[cfg(test)]
 mod pattern_fill_tests;

@@ -300,6 +304,119 @@ mod tests {
        h.run_steps(2);
        assert!(alpha(&h).is_some_and(|a| (a - 0.6).abs() < 1e-9), "{:?}", alpha(&h));
    }
+
+    /// Slide background fill is one of the Fill options. It has no Color button or Transparency
+    /// slider of its own.
+    #[test]
+    fn slide_background_fill_is_a_fill_option() {
+        let mut h = fill_pane(None);
+        let fill = |h: &Harness<'_, SlideApp>| h.state().session.active().unwrap().selected_shapes()[0].fill.clone();
+        let undo = h.state().session.active().unwrap().history.undo.len();
+        h.get_by_label("Slide background fill").click();
+        h.run_steps(3);
+        assert_eq!(fill(&h), Some(Fill::Background));
+        assert_eq!(h.state().session.active().unwrap().history.undo.len(), undo + 1, "one undo step");
+        assert_eq!(h.get_by_label("Slide background fill").accesskit_node().toggled(), Some(egui::accesskit::Toggled::True));
+        assert_eq!(color_buttons(&h), 1, "only the line's Color button");
+        assert_eq!(h.query_all_by_role_and_label(egui::accesskit::Role::Slider, "Transparency").count(), 0);
+        // A shape that already has the background fill shows this option chosen, not Automatic.
+        let h = fill_pane(Some(json!({"background": true})));
+        assert_eq!(h.get_by_label("Slide background fill").accesskit_node().toggled(), Some(egui::accesskit::Toggled::True));
+        let automatic = h.query_all_by_label("Automatic").filter(|n| n.accesskit_node().toggled() == Some(egui::accesskit::Toggled::True)).count();
+        assert_eq!(automatic, 1, "only the line's Automatic is chosen");
+    }
+
+    /// A picture cannot save a slide background fill, so its Fill options leave it out. A group
+    /// that holds a shape keeps the option.
+    #[test]
+    fn a_picture_has_no_slide_background_fill_option() {
+        let pane = |group: bool| {
+            let mut s = Session::with_new();
+            s.execute("slide.new", &json!({"layout": "blank"})).unwrap();
+            let png = deckcraft_render::Image { width: 2, height: 2, pixels: [255, 0, 0, 255].repeat(4) }.to_png();
+            let pic =
+                s.execute("insert.picture", &json!({"data": deckcraft_engine::cmd::base64_encode(&png), "name": "red.png"})).unwrap()["id"].clone();
+            if group {
+                let shape = s.execute("shape.insert", &json!({"preset": "rect", "rect": [500.0, 40.0, 120.0, 80.0]})).unwrap()["id"].clone();
+                s.execute("edit.select", &json!({"ids": [pic, shape]})).unwrap();
+                s.execute("arrange.group", &json!({})).unwrap();
+                s.execute("shape.fill", &json!({"color": "#ff0000"})).unwrap();
+            }
+            let mut app = SlideApp::new(s, Services::default());
+            app.ui.pane = Some("format".into());
+            app.ui.format_tab = "fill".into();
+            let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_ui_state(
+                |ui, app: &mut SlideApp| {
+                    app.logic(ui.ctx());
+                    app.ui(ui);
+                },
+                app,
+            );
+            h.run_steps(3);
+            h
+        };
+        let h = pane(false);
+        assert!(h.query_by_label("Pattern fill").is_some(), "the Fill options are shown");
+        assert!(h.query_by_label("Slide background fill").is_none());
+        let mut h = pane(true);
+        h.get_by_label("Slide background fill").click();
+        h.run_steps(3);
+        let st = h.state().session.active().unwrap();
+        let group = st.selected_shapes()[0];
+        let fills: Vec<_> = group.children().iter().map(|m| m.fill.clone()).collect();
+        assert_eq!(fills[1], Some(Fill::Background), "the group's shape takes the fill");
+        assert!(matches!(fills[0], Some(Fill::Solid { .. })), "the picture keeps its fill: {:?}", fills[0]);
+        assert_eq!(group.fill, None, "the group's own fill is cleared");
+        assert_eq!(h.get_by_label("Slide background fill").accesskit_node().toggled(), Some(egui::accesskit::Toggled::True));
+        assert_eq!(h.query_all_by_role_and_label(egui::accesskit::Role::Slider, "Transparency").count(), 0);
+        assert_eq!(color_buttons(&h), 1, "only the line's Color button");
+    }
+
+    /// A group whose picture uses the group's fill keeps that fill, and still shows Slide
+    /// background fill chosen once its shapes have it.
+    #[test]
+    fn a_group_that_keeps_its_fill_shows_slide_background_fill() {
+        let mut s = Session::with_new();
+        s.execute("slide.new", &json!({"layout": "blank"})).unwrap();
+        let png = deckcraft_render::Image { width: 2, height: 2, pixels: [0, 0, 0, 0].repeat(4) }.to_png();
+        let pic = s.execute("insert.picture", &json!({"data": deckcraft_engine::cmd::base64_encode(&png), "name": "clear.png"})).unwrap()["id"]
+            .as_u64()
+            .unwrap();
+        let shape = s.execute("shape.insert", &json!({"preset": "rect", "rect": [500.0, 40.0, 120.0, 80.0]})).unwrap()["id"].as_u64().unwrap();
+        s.execute("edit.select", &json!({"ids": [pic, shape]})).unwrap();
+        s.execute("arrange.group", &json!({})).unwrap();
+        s.execute("shape.fill", &json!({"gradient": {"stops": [[0, "#ff0000"], [1, "#0000ff"]]}})).unwrap();
+        s.edit(|doc, _| {
+            for slide in &mut doc.slides {
+                let slide = std::sync::Arc::make_mut(slide);
+                if let Some(p) = slide.shape_mut(ShapeId(pic as u32)) {
+                    p.fill = Some(Fill::Group);
+                }
+            }
+            Ok(())
+        })
+        .unwrap();
+        let mut app = SlideApp::new(s, Services::default());
+        app.ui.pane = Some("format".into());
+        app.ui.format_tab = "fill".into();
+        let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_ui_state(
+            |ui, app: &mut SlideApp| {
+                app.logic(ui.ctx());
+                app.ui(ui);
+            },
+            app,
+        );
+        h.run_steps(3);
+        h.get_by_label("Slide background fill").click();
+        h.run_steps(3);
+        let st = h.state().session.active().unwrap();
+        assert!(matches!(st.selected_shapes()[0].fill, Some(Fill::Gradient(_))), "the group keeps the fill its picture uses");
+        assert_eq!(st.shape(ShapeId(shape as u32)).unwrap().fill, Some(Fill::Background));
+        assert_eq!(h.get_by_label("Slide background fill").accesskit_node().toggled(), Some(egui::accesskit::Toggled::True));
+        assert!(h.query_by_label("Rotate with shape").is_none(), "no editor for the group's kept gradient");
+        assert_eq!(h.query_all_by_role_and_label(egui::accesskit::Role::Slider, "Transparency").count(), 0);
+        assert_eq!(color_buttons(&h), 1, "only the line's Color button");
+    }
 }

 #[cfg(test)]
@@ -0,0 +1,202 @@
+//! Format Shape ▸ Effects: preset tiles that draw what each Shadow, Glow and Soft Edges preset does
+//! to a small card, so the choice is made by looking rather than by reading names.
+
+use deckcraft_model::style::Effects;
+use egui::{Color32, CornerRadius, Painter, Rect, Role, Sense, Stroke, StrokeKind, Ui, WidgetInfo, pos2, vec2};
+
+use crate::theme::Tokens;
+
+const TILE: egui::Vec2 = vec2(46.0, 38.0);
+const SHADOWS: [(&str, &str); 6] = [
+    ("none", "No shadow"),
+    ("outer", "Outer shadow"),
+    ("bottom", "Bottom shadow"),
+    ("center", "Centered shadow"),
+    ("inner", "Inner shadow"),
+    ("perspective", "Perspective shadow"),
+];
+/// The glow radii (pt) the ribbon's Glow menu offers.
+pub(super) const GLOWS: [f64; 4] = [5.0, 8.0, 11.0, 18.0];
+/// The soft-edge radii (pt) the ribbon's Soft Edges menu offers; 0 is "none".
+pub(super) const SOFT_EDGES: [f64; 6] = [0.0, 1.0, 2.5, 5.0, 10.0, 25.0];
+
+/// The `shape.effects` shadow preset id that `fx`'s current shadow came from.
+pub(super) fn shadow_preset_id(fx: &Effects) -> &'static str {
+    if fx.inner_shadow.is_some() {
+        return "inner";
+    }
+    match &fx.outer_shadow {
+        None => "none",
+        Some(s) if s.align == "bl" => "perspective",
+        Some(s) if s.dist == 0.0 => "center",
+        Some(s) if s.dir == 90.0 => "bottom",
+        Some(_) => "outer",
+    }
+}
+
+/// A row of shadow preset tiles; returns the id of the one clicked.
+pub(super) fn shadow_row(ui: &mut Ui, current: &str) -> Option<&'static str> {
+    let mut picked = None;
+    ui.horizontal_wrapped(|ui| {
+        for (id, label) in SHADOWS {
+            if tile(ui, label, id == current, |p, r| paint_shadow(p, r, id)).clicked() {
+                picked = Some(id);
+            }
+        }
+    });
+    picked
+}
+
+/// A row of glow tiles (the first clears it); returns the radius clicked, 0 for none.
+pub(super) fn glow_row(ui: &mut Ui, current: f64) -> Option<f64> {
+    let mut picked = None;
+    ui.horizontal_wrapped(|ui| {
+        for r in std::iter::once(0.0).chain(GLOWS) {
+            let label = if r == 0.0 { "No glow".to_string() } else { format!("{r} pt glow") };
+            if tile(ui, &label, r == current, |p, rect| paint_glow(p, rect, r)).clicked() {
+                picked = Some(r);
+            }
+        }
+    });
+    picked
+}
+
+/// A row of soft-edge tiles (the first clears it); returns the radius clicked, 0 for none.
+pub(super) fn soft_edge_row(ui: &mut Ui, current: f64) -> Option<f64> {
+    let mut picked = None;
+    ui.horizontal_wrapped(|ui| {
+        for r in SOFT_EDGES {
+            let label = if r == 0.0 { "No soft edges".to_string() } else { format!("{r} pt soft edges") };
+            if tile(ui, &label, r == current, |p, rect| paint_soft(p, rect, r)).clicked() {
+                picked = Some(r);
+            }
+        }
+    });
+    picked
+}
+
+fn tile(ui: &mut Ui, label: &str, selected: bool, paint: impl FnOnce(&Painter, Rect)) -> egui::Response {
+    let t = Tokens::get(ui.ctx());
+    let (rect, resp) = ui.allocate_exact_size(TILE, Sense::click());
+    resp.widget_info(|| WidgetInfo::selected(Role::Button, true, selected, label));
+    let p = ui.painter();
+    let round = CornerRadius::same(5);
+    p.rect_filled(rect, round, if resp.hovered() { t.hover } else { t.field_bg });
+    paint(&p.with_clip_rect(rect.shrink(1.0)), rect);
+    let stroke = if selected { Stroke::new(2.0, t.accent) } else { Stroke::new(1.0, t.border) };
+    p.rect_stroke(rect, round, stroke, StrokeKind::Inside);
+    resp.on_hover_text(label)
+}
+
+/// The sample card every preview draws on, centred in `tile`.
+fn card(tile: Rect) -> Rect {
+    Rect::from_center_size(tile.center(), vec2(22.0, 16.0))
+}
+
+fn card_fill(p: &Painter, r: Rect) {
+    p.rect_filled(r, CornerRadius::same(2), Tokens::get(p.ctx()).accent);
+}
+
+/// `layers` rounded rects growing from `r` by up to `spread`, each faint, so the edge falls off.
+fn halo(p: &Painter, r: Rect, spread: f32, color: Color32, layers: u32) {
+    for i in (1..=layers).rev() {
+        let k = i as f32 / layers as f32;
+        let a = (f32::from(color.a()) * (1.0 - k * 0.8) / layers as f32 * 2.0).min(255.0) as u8;
+        p.rect_filled(
+            r.expand(spread * k),
+            CornerRadius::same((2.0 + spread * k) as u8),
+            Color32::from_rgba_unmultiplied(color.r(), color.g(), color.b(), a),
+        );
+    }
+}
+
+fn paint_shadow(p: &Painter, tile: Rect, id: &str) {
+    let r = card(tile);
+    let ink = Color32::from_rgba_unmultiplied(0, 0, 0, 120);
+    match id {
+        "outer" => halo(p, r.translate(vec2(3.0, 3.0)), 3.0, ink, 4),
+        "bottom" => halo(p, r.translate(vec2(0.0, 4.0)), 3.0, ink, 4),
+        "center" => halo(p, r, 5.0, ink, 5),
+        "perspective" => {
+            let base = r.max.y + 1.0;
+            let slant = [pos2(r.min.x - 6.0, base), pos2(r.max.x - 8.0, base), pos2(r.max.x - 2.0, base + 5.0), pos2(r.min.x - 12.0, base + 5.0)];
+            p.add(egui::Shape::convex_polygon(slant.to_vec(), Color32::from_rgba_unmultiplied(0, 0, 0, 90), Stroke::NONE));
+        }
+        _ => {}
+    }
+    card_fill(p, r);
+    if id == "inner" {
+        for i in 0..4 {
+            let a = 110 - i * 25;
+            p.rect_stroke(
+                r.shrink(i as f32),
+                CornerRadius::same(2),
+                Stroke::new(1.0, Color32::from_rgba_unmultiplied(0, 0, 0, a as u8)),
+                StrokeKind::Inside,
+            );
+        }
+    }
+    if id == "none" {
+        p.line_segment([tile.left_bottom() + vec2(6.0, -6.0), tile.right_top() + vec2(-6.0, 6.0)], Stroke::new(1.5, Tokens::get(p.ctx()).text_faint));
+    }
+}
+
+fn paint_glow(p: &Painter, tile: Rect, radius: f64) {
+    let r = card(tile);
+    if radius > 0.0 {
+        // 18 pt fills the tile's margin; smaller radii scale down.
+        halo(p, r, (radius as f32 / 18.0 * 9.0).max(2.0), Tokens::get(p.ctx()).accent.gamma_multiply(0.9), 6);
+    }
+    card_fill(p, r);
+    if radius == 0.0 {
+        p.line_segment([tile.left_bottom() + vec2(6.0, -6.0), tile.right_top() + vec2(-6.0, 6.0)], Stroke::new(1.5, Tokens::get(p.ctx()).text_faint));
+    }
+}
+
+fn paint_soft(p: &Painter, tile: Rect, radius: f64) {
+    let t = Tokens::get(p.ctx());
+    let r = card(tile).expand(2.0);
+    card_fill(p, r);
+    // Rings of the tile's own background, opaque at the edge and clear inward, feather the rim.
+    let depth = (radius as f32 / 25.0 * 7.0).round().max(if radius > 0.0 { 1.0 } else { 0.0 }) as u32;
+    let bg = t.field_bg;
+    for i in 0..depth {
+        let a = (255.0 * (1.0 - i as f32 / depth as f32)) as u8;
+        let c = Color32::from_rgba_unmultiplied(bg.r(), bg.g(), bg.b(), a);
+        p.rect_stroke(r.shrink(i as f32), CornerRadius::same(2), Stroke::new(1.0, c), StrokeKind::Inside);
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use deckcraft_model::style::Shadow;
+    use deckcraft_model::{ColorRef, SchemeSlot};
+
+    fn shadow(dist: f64, dir: f64, align: &str, inner: bool) -> Shadow {
+        Shadow {
+            color: ColorRef::scheme(SchemeSlot::Dk1),
+            blur: 4.0,
+            dist,
+            dir,
+            inner,
+            sx: 1.0,
+            sy: 1.0,
+            kx: 0.0,
+            ky: 0.0,
+            align: align.into(),
+            rotate_with_shape: false,
+        }
+    }
+
+    #[test]
+    fn shadow_preset_id_names_each_preset() {
+        let with = |o: Option<Shadow>, i: Option<Shadow>| Effects { outer_shadow: o, inner_shadow: i, ..Effects::default() };
+        assert_eq!(shadow_preset_id(&with(None, None)), "none");
+        assert_eq!(shadow_preset_id(&with(Some(shadow(3.0, 45.0, "tl", false)), None)), "outer");
+        assert_eq!(shadow_preset_id(&with(Some(shadow(3.0, 90.0, "tl", false)), None)), "bottom");
+        assert_eq!(shadow_preset_id(&with(Some(shadow(0.0, 45.0, "tl", false)), None)), "center");
+        assert_eq!(shadow_preset_id(&with(Some(shadow(0.0, 90.0, "bl", false)), None)), "perspective");
+        assert_eq!(shadow_preset_id(&with(None, Some(shadow(3.0, 45.0, "tl", true)))), "inner");
+    }
+}
@@ -0,0 +1,79 @@
+//! Format Shape ▸ Effects: the Shadow, Glow and Soft Edges preset tiles.
+
+use deckcraft_engine::Session;
+use deckcraft_model::style::Effects;
+use egui::accesskit::Toggled;
+use egui_kittest::Harness;
+use egui_kittest::kittest::{NodeT, Queryable};
+use serde_json::json;
+
+use crate::{Services, SlideApp};
+
+fn harness() -> Harness<'static, SlideApp> {
+    let mut s = Session::with_new();
+    let r = s.execute("shape.insert", &json!({"preset": "rect", "rect": [80.0, 80.0, 200.0, 120.0]})).unwrap();
+    let id = r.get("id").and_then(|v| v.as_u64()).unwrap();
+    s.execute("edit.select", &json!({"ids": [id]})).unwrap();
+    let mut app = SlideApp::new(s, Services::default());
+    app.ui.pane = Some("format".into());
+    app.ui.format_tab = "effects".into();
+    let mut h = Harness::builder().with_size(egui::vec2(1800.0, 1100.0)).build_ui_state(
+        |ui, app: &mut SlideApp| {
+            app.logic(ui.ctx());
+            app.ui(ui);
+        },
+        app,
+    );
+    h.run_steps(3);
+    h
+}
+
+fn effects(h: &Harness<'_, SlideApp>) -> Effects {
+    h.state().session.active().unwrap().selected_shapes()[0].effects.clone().unwrap_or_default()
+}
+
+fn click(h: &mut Harness<'_, SlideApp>, label: &str) {
+    h.get_by_label(label).click();
+    h.run_steps(3);
+}
+
+#[test]
+fn preset_tiles_set_shadow_glow_and_soft_edges() {
+    let mut h = harness();
+    click(&mut h, "Bottom shadow");
+    let sw = effects(&h).outer_shadow.unwrap();
+    assert_eq!((sw.dir, sw.dist), (90.0, 3.0));
+    // The Size slider appears once there is a shadow.
+    assert!(h.query_all_by_label("Size").count() >= 2);
+
+    click(&mut h, "Inner shadow");
+    let fx = effects(&h);
+    assert!(fx.outer_shadow.is_none() && fx.inner_shadow.is_some());
+    click(&mut h, "No shadow");
+    let fx = effects(&h);
+    assert!(fx.outer_shadow.is_none() && fx.inner_shadow.is_none());
+
+    // A radius tile keeps the glow's colour and transparency.
+    h.state_mut().session.execute("shape.effects", &json!({"glowProps": {"color": "accent2", "transparency": 0.35, "radius": 8.0}})).unwrap();
+    h.run_steps(3);
+    let colour = effects(&h).glow.unwrap().color;
+    click(&mut h, "18 pt glow");
+    let glow = effects(&h).glow.unwrap();
+    assert_eq!(glow.radius, 18.0);
+    assert_eq!(glow.color, colour);
+    click(&mut h, "No glow");
+    assert!(effects(&h).glow.is_none());
+
+    click(&mut h, "10 pt soft edges");
+    assert_eq!(effects(&h).soft_edge, Some(10.0));
+    click(&mut h, "No soft edges");
+    assert_eq!(effects(&h).soft_edge, None);
+}
+
+#[test]
+fn the_current_preset_tile_is_marked_selected() {
+    let mut h = harness();
+    click(&mut h, "5 pt glow");
+    assert_eq!(h.get_by_label("5 pt glow").accesskit_node().toggled(), Some(Toggled::True));
+    assert_eq!(h.get_by_label("11 pt glow").accesskit_node().toggled(), Some(Toggled::False));
+}
@@ -1,3 +1,4 @@
+use super::effect_presets;
 use super::{Fill, Icon, ShapeKind, SlideApp, Tokens, Ui, color_button, cref_param, json, run, scheme, theme, vec2, widgets};

 /// Percent transparency (0 = opaque) of a solid fill, the same number `shape.fill`'s
@@ -47,17 +48,11 @@ fn format_tabs(app: &mut SlideApp, ui: &mut Ui, sh: &deckcraft_model::Shape) {

 fn effects_tab(app: &mut SlideApp, ui: &mut Ui, sh: &deckcraft_model::Shape) {
    ui.label(egui::RichText::new("Shadow").font(theme::bold(13.0)));
-    ui.horizontal_wrapped(|ui| {
-        for (l, v) in
-            [("None", "none"), ("Outer", "outer"), ("Bottom", "bottom"), ("Center", "center"), ("Inner", "inner"), ("Perspective", "perspective")]
-        {
-            if ui.button(l).clicked() {
-                run(app, "shape.effects", json!({"shadow": v}));
-            }
-        }
-    });
    let fx = sh.effects.clone().unwrap_or_default();
-    let shadow = fx.outer_shadow.as_ref().or(fx.inner_shadow.as_ref());
+    if let Some(v) = effect_presets::shadow_row(ui, effect_presets::shadow_preset_id(&fx)) {
+        run(app, "shape.effects", json!({"shadow": v}));
+    }
+    let shadow = fx.inner_shadow.as_ref().or(fx.outer_shadow.as_ref());
    if let Some(sw) = shadow {
        color_button(app, ui, "Color", None, |c| ("shape.effects".into(), json!({"shadowProps": {"color": c.as_ref().map(cref_param)}})));
        fx_slider(
@@ -72,6 +67,7 @@ fn effects_tab(app: &mut SlideApp, ui: &mut Ui, sh: &deckcraft_model::Shape) {
            "transparency",
            0.01,
        );
+        fx_slider(app, ui, ("shadow", sh.id.0, "s"), "Size", sw.sx * 100.0, 1.0..=200.0, "%", "shadowProps", "size", 0.01);
        fx_slider(app, ui, ("shadow", sh.id.0, "b"), "Blur", sw.blur, 0.0..=100.0, " pt", "shadowProps", "blur", 1.0);
        fx_slider(app, ui, ("shadow", sh.id.0, "a"), "Angle", sw.dir, 0.0..=359.0, "°", "shadowProps", "dir", 1.0);
        fx_slider(app, ui, ("shadow", sh.id.0, "d"), "Distance", sw.dist, 0.0..=200.0, " pt", "shadowProps", "dist", 1.0);
@@ -105,6 +101,9 @@ fn effects_tab(app: &mut SlideApp, ui: &mut Ui, sh: &deckcraft_model::Shape) {
    ui.add_space(6.0);
    ui.label(egui::RichText::new("Glow").font(theme::bold(13.0)));
    let radius = fx.glow.as_ref().map_or(0.0, |g| g.radius);
+    if let Some(r) = effect_presets::glow_row(ui, radius) {
+        run(app, "shape.effects", json!({"glowProps": {"radius": r}}));
+    }
    fx_slider(app, ui, ("glow", sh.id.0, "r"), "Size", radius, 0.0..=150.0, " pt", "glowProps", "radius", 1.0);
    if let Some(g) = &fx.glow {
        color_button(app, ui, "Color", None, |c| ("shape.effects".into(), json!({"glowProps": {"color": c.as_ref().map(cref_param)}})));
@@ -123,6 +122,9 @@ fn effects_tab(app: &mut SlideApp, ui: &mut Ui, sh: &deckcraft_model::Shape) {
    }
    ui.label(egui::RichText::new("Soft Edges").font(theme::bold(13.0)));
    let mut s = sh.effects.as_ref().and_then(|e| e.soft_edge).unwrap_or(0.0);
+    if let Some(r) = effect_presets::soft_edge_row(ui, s) {
+        run(app, "shape.effects", json!({"softEdges": r}));
+    }
    if ui.add(egui::Slider::new(&mut s, 0.0..=50.0).text("size (pt)")).drag_stopped() {
        run(app, "shape.effects", json!({"softEdges": s}));
    }
@@ -133,6 +135,125 @@ fn effects_tab(app: &mut SlideApp, ui: &mut Ui, sh: &deckcraft_model::Shape) {
    }
 }

+/// A group keeps no slide background fill of its own. It shows Slide background fill when every
+/// shape or text box in it has one, including when the group keeps a fill that a picture in it uses.
+fn members_have_background_fill(sh: &deckcraft_model::Shape) -> bool {
+    if !matches!(sh.kind, ShapeKind::Group { .. }) {
+        return false;
+    }
+    let (mut any, mut all) = (false, true);
+    deckcraft_model::walk(sh.children(), &mut |m, _| {
+        if matches!(m.kind, ShapeKind::Shape) {
+            any = true;
+            all &= m.fill == Some(Fill::Background);
+        }
+    });
+    any && all
+}
+
+/// Only a shape or text box saves a slide background fill. A group offers it when it holds one.
+fn selection_takes_background_fill(app: &SlideApp) -> bool {
+    let mut ok = false;
+    if let Some(st) = app.session.active() {
+        for s in st.selected_shapes() {
+            deckcraft_model::walk(std::slice::from_ref(s), &mut |m, _| ok |= matches!(m.kind, ShapeKind::Shape));
+        }
+    }
+    ok
+}
+
+/// Format Shape ▸ Size & Properties: size, rotation, scale, position and alt text.
+fn size_tab(app: &mut SlideApp, ui: &mut Ui, sh: &deckcraft_model::Shape, x: deckcraft_model::Xfrm, single: bool, uid: u64) {
+    let lock_id = ui.scope_id().with("fmt-lock-aspect");
+    let mut lock: bool = ui.data_mut(|d| d.get_temp(lock_id).unwrap_or(false));
+    let locked = lock;
+    // Scale is measured from the size the shape had when this tab first showed it, like the
+    // Size and Position dialog; the origin choice is kept for the session.
+    let base_id = ui.scope_id().with(("fmt-scale-base", uid, sh.id.0));
+    let (base_w, base_h): (f64, f64) = ui.data_mut(|d| d.get_temp(base_id).unwrap_or((x.w, x.h)));
+    ui.data_mut(|d| d.insert_temp(base_id, (base_w, base_h)));
+    let origin_id = ui.scope_id().with("fmt-origin-center");
+    let mut center: bool = single && ui.data_mut(|d| d.get_temp(origin_id).unwrap_or(false));
+    let len = app.session.prefs.units;
+    let mut fields = |ui: &mut Ui, label: &str, id: &str, v: f64, key: &str, cmd: &str, angle: bool| {
+        let (unit, suffix) = if angle { (1.0, "°") } else { (len.points_per_unit(), len.suffix()) };
+        ui.horizontal(|ui| {
+            ui.add_sized(vec2(90.0, 20.0), egui::Label::new(label));
+            if let Some(nv) = widgets::spinner(ui, id, label, v / unit, 0.1, suffix, 70.0) {
+                let mut p = json!({key: nv * unit});
+                if cmd == "shape.resize" && locked {
+                    p["lockAspect"] = json!(true);
+                }
+                run(app, cmd, p);
+            }
+        });
+    };
+    ui.label(egui::RichText::new("Size").font(theme::bold(13.0)));
+    fields(ui, "Height", "fh", x.h, "h", "shape.resize", false);
+    fields(ui, "Width", "fw", x.w, "w", "shape.resize", false);
+    fields(ui, "Rotation", "fr", x.rot, "deg", "shape.rotate", true);
+    for (label, id, cur, base, key) in [("Scale Height", "fsh", x.h, base_h, "h"), ("Scale Width", "fsw", x.w, base_w, "w")] {
+        ui.add_enabled_ui(single, |ui| {
+            ui.horizontal(|ui| {
+                ui.add_sized(vec2(90.0, 20.0), egui::Label::new(label));
+                let pct = if base > 0.0 { cur / base * 100.0 } else { 100.0 };
+                if let Some(nv) = widgets::spinner(ui, id, label, pct, 1.0, "%", 70.0)
+                    && nv > 0.0
+                {
+                    let mut p = json!({key: base * nv / 100.0});
+                    if locked {
+                        p["lockAspect"] = json!(true);
+                    }
+                    run(app, "shape.sizePosition", p);
+                }
+            })
+        });
+    }
+    if ui.checkbox(&mut lock, "Lock aspect ratio").changed() {
+        ui.data_mut(|d| d.insert_temp(lock_id, lock));
+    }
+    ui.add_space(6.0);
+    ui.label(egui::RichText::new("Position").font(theme::bold(13.0)));
+    ui.add_enabled_ui(single, |ui| {
+        ui.horizontal(|ui| {
+            ui.add_sized(vec2(90.0, 20.0), egui::Label::new("From"));
+            let combo =
+                craft_ui::ComboBox::from_id_salt("fmt-origin").selected_text(if center { "Center" } else { "Top Left Corner" }).show_ui(ui, |ui| {
+                    ui.selectable_value(&mut center, false, "Top Left Corner");
+                    ui.selectable_value(&mut center, true, "Center");
+                });
+            combo.response.widget_info(|| egui::WidgetInfo::labeled(egui::Role::ComboBox, true, "From"));
+        })
+    });
+    if single {
+        ui.data_mut(|d| d.insert_temp(origin_id, center));
+    }
+    let (dx, dy) = if center { (x.w / 2.0, x.h / 2.0) } else { (0.0, 0.0) };
+    // The spinner shows `value / unit`; `shape.move` takes the top-left corner, so a centre
+    // reading is shifted by half the size in both directions.
+    let (px, py) = (x.x + dx, x.y + dy);
+    let mut pos = |ui: &mut Ui, label: &str, id: &str, v: f64, off: f64, key: &str| {
+        ui.horizontal(|ui| {
+            ui.add_sized(vec2(90.0, 20.0), egui::Label::new(label));
+            if let Some(nv) = widgets::spinner(ui, id, label, v / len.points_per_unit(), 0.1, len.suffix(), 70.0) {
+                run(app, "shape.move", json!({key: nv * len.points_per_unit() - off}));
+            }
+        });
+    };
+    pos(ui, "Horizontal", "fx", px, dx, "x");
+    pos(ui, "Vertical", "fy", py, dy, "y");
+    ui.add_space(6.0);
+    ui.label(egui::RichText::new("Alt Text").font(theme::bold(13.0)));
+    let id = ui.scope_id().with(("alt", uid, sh.id.0));
+    let stored: Option<(String, String)> = ui.data_mut(|d| d.get_temp(id));
+    let mut alt = widgets::text_draft(stored, &sh.descr);
+    let r = ui.add(egui::TextEdit::multiline(&mut alt).hint_text("Alt text").desired_rows(3).desired_width(f32::INFINITY));
+    if r.lost_focus() && alt != sh.descr {
+        run(app, "shape.altText", json!({"text": alt}));
+    }
+    ui.data_mut(|d| d.insert_temp(id, (sh.descr.clone(), alt)));
+}
+
 /// Render the shape-format pane with fill/line, effects, size/properties, text, and picture tabs.
 pub(super) fn format_shape(app: &mut SlideApp, ui: &mut Ui) {
    let t = Tokens::get(ui.ctx());
@@ -142,51 +263,14 @@ pub(super) fn format_shape(app: &mut SlideApp, ui: &mut Ui) {
        return;
    };
    let x = deckcraft_engine::cmd::xfrm_of(&st.doc, &st.selection, &sh);
+    // Scale and a centre origin work from the shown shape's size, so they need a single shape.
+    let single = st.selected_shapes().len() == 1;
    let uid = st.uid;
    format_tabs(app, ui, &sh);
    ui.separator();
    match app.ui.format_tab.as_str() {
        "effects" => effects_tab(app, ui, &sh),
-        "size" => {
-            let lock_id = egui::Id::unique("fmt-lock-aspect");
-            let mut lock: bool = ui.data_mut(|d| d.get_temp(lock_id).unwrap_or(false));
-            let locked = lock;
-            let len = app.session.prefs.units;
-            let mut fields = |ui: &mut Ui, label: &str, id: &str, v: f64, key: &str, cmd: &str, angle: bool| {
-                let (unit, suffix) = if angle { (1.0, "°") } else { (len.points_per_unit(), len.suffix()) };
-                ui.horizontal(|ui| {
-                    ui.add_sized(vec2(90.0, 20.0), egui::Label::new(label));
-                    if let Some(nv) = widgets::spinner(ui, id, label, v / unit, 0.1, suffix, 70.0) {
-                        let mut p = json!({key: nv * unit});
-                        if cmd == "shape.resize" && locked {
-                            p["lockAspect"] = json!(true);
-                        }
-                        run(app, cmd, p);
-                    }
-                });
-            };
-            ui.label(egui::RichText::new("Size").font(theme::bold(13.0)));
-            fields(ui, "Height", "fh", x.h, "h", "shape.resize", false);
-            fields(ui, "Width", "fw", x.w, "w", "shape.resize", false);
-            fields(ui, "Rotation", "fr", x.rot, "deg", "shape.rotate", true);
-            if ui.checkbox(&mut lock, "Lock aspect ratio").changed() {
-                ui.data_mut(|d| d.insert_temp(lock_id, lock));
-            }
-            ui.add_space(6.0);
-            ui.label(egui::RichText::new("Position").font(theme::bold(13.0)));
-            fields(ui, "Horizontal", "fx", x.x, "x", "shape.move", false);
-            fields(ui, "Vertical", "fy", x.y, "y", "shape.move", false);
-            ui.add_space(6.0);
-            ui.label(egui::RichText::new("Alt Text").font(theme::bold(13.0)));
-            let id = ui.scope_id().with(("alt", uid, sh.id.0));
-            let stored: Option<(String, String)> = ui.data_mut(|d| d.get_temp(id));
-            let mut alt = widgets::text_draft(stored, &sh.descr);
-            let r = ui.add(egui::TextEdit::multiline(&mut alt).hint_text("Alt text").desired_rows(3).desired_width(f32::INFINITY));
-            if r.lost_focus() && alt != sh.descr {
-                run(app, "shape.altText", json!({"text": alt}));
-            }
-            ui.data_mut(|d| d.insert_temp(id, (sh.descr.clone(), alt)));
-        }
+        "size" => size_tab(app, ui, &sh, x, single, uid),
        "text" => {
            ui.label(egui::RichText::new("Text Fill").font(theme::bold(13.0)));
            color_button(app, ui, "Color", None, |c| match c {
@@ -269,23 +353,31 @@ pub(super) fn format_shape(app: &mut SlideApp, ui: &mut Ui) {
        _ => {
            // Fill & Line.
            ui.label(egui::RichText::new("Fill").font(theme::bold(13.0)));
+            let members_background = members_have_background_fill(&sh);
            let kind = match &sh.fill {
+                _ if members_background => "background",
                None => "auto",
                Some(Fill::None) => "none",
                Some(Fill::Solid { .. }) => "solid",
                Some(Fill::Gradient(_)) => "gradient",
                Some(Fill::Picture(_)) => "picture",
                Some(Fill::Pattern(_)) => "pattern",
+                Some(Fill::Background) => "background",
                _ => "auto",
            };
+            let background_ok = selection_takes_background_fill(app);
            for (l, k) in [
                ("No fill", "none"),
                ("Solid fill", "solid"),
                ("Gradient fill", "gradient"),
                ("Picture or texture fill", "picture"),
                ("Pattern fill", "pattern"),
+                ("Slide background fill", "background"),
                ("Automatic", "auto"),
            ] {
+                if k == "background" && !background_ok {
+                    continue;
+                }
                if ui.radio(kind == k, l).clicked() {
                    match k {
                        "none" => run(app, "shape.fill", json!({"none": true})),
@@ -297,6 +389,7 @@ pub(super) fn format_shape(app: &mut SlideApp, ui: &mut Ui) {
                        ),
                        "pattern" => run(app, "shape.fill", json!({"pattern": {"preset": "pct25", "fg": "accent1", "bg": "bg1"}})),
                        "picture" => pick_fill_picture(app),
+                        "background" => run(app, "shape.fill", json!({"background": true})),
                        _ => run(app, "shape.fill", json!({"reset": true})),
                    }
                }
@@ -312,7 +405,7 @@ pub(super) fn format_shape(app: &mut SlideApp, ui: &mut Ui) {
            }
            // `shape.fill {transparency}` changes a solid fill (an automatic one through its
            // effective color) and a picture fill; a gradient has a transparency per stop.
-            let transparency = matches!(sh.fill, None | Some(Fill::Solid { .. } | Fill::Picture(_)));
+            let transparency = !members_background && matches!(sh.fill, None | Some(Fill::Solid { .. } | Fill::Picture(_)));
            ui.horizontal(|ui| {
                if !transparency {
                    return;
@@ -336,10 +429,13 @@ pub(super) fn format_shape(app: &mut SlideApp, ui: &mut Ui) {
                    ui.data_mut(|d| d.insert_temp(id, v));
                }
            });
-            if let Some(Fill::Picture(pf)) = &sh.fill {
+            // A group that keeps a fill for its pictures shows no editor for that fill while its
+            // shapes have the slide background fill.
+            let shown_fill = sh.fill.as_ref().filter(|_| !members_background);
+            if let Some(Fill::Picture(pf)) = shown_fill {
                picture_fill_options(app, ui, sh.id.0, pf);
            }
-            if let Some(Fill::Gradient(g)) = &sh.fill {
+            if let Some(Fill::Gradient(g)) = shown_fill {
                let sc = scheme(app);
                if let Some(ng) = crate::fillui::gradient_editor(ui, "shape-grad", g, &sc) {
                    run(app, "shape.fill", json!({"gradient": crate::fillui::gradient_json(&ng)}));
@@ -350,7 +446,7 @@ pub(super) fn format_shape(app: &mut SlideApp, ui: &mut Ui) {
                    run(app, "shape.fill", json!({"gradient": crate::fillui::gradient_json(&ng)}));
                }
            }
-            if let Some(Fill::Pattern(pt)) = &sh.fill
+            if let Some(Fill::Pattern(pt)) = shown_fill
                && let Some(np) = crate::fillui::pattern_editor(ui, pt, &scheme(app))
            {
                run(app, "shape.fill", json!({"pattern": crate::fillui::pattern_json(&np)}));
@@ -478,8 +574,22 @@ fn fx_slider(
        } else {
            ui.data_mut(|d| d.remove::<f64>(sid));
        }
-        if r.drag_stopped() || r.lost_focus() || (r.changed() && !r.dragged()) {
-            ui.data_mut(|d| d.remove::<f64>(sid));
+        // `changed()` also fires when the slider only rounds the value it shows (55.000000000000007 to 55,
+        // or 0.5 to 1 on focus, which re-added a reflection the pane had just cleared): only a move to
+        // another shown value is an edit. Accessibility and keyboard edits are such moves too.
+        let shown_changed = r.changed() && v.round() != value.round();
+        // A slider that only had focus when another control took it (the Reflection "None" button)
+        // must not commit its stale value: only an edit the user made is committed on losing focus.
+        let edited_id = sid.with("edited");
+        if shown_changed {
+            ui.data_mut(|d| d.insert_temp(edited_id, true));
+        }
+        let edited = ui.data_mut(|d| d.get_temp::<bool>(edited_id)).unwrap_or(false);
+        if r.drag_stopped() || (r.lost_focus() && edited) || (shown_changed && !r.dragged()) {
+            ui.data_mut(|d| {
+                d.remove::<f64>(sid);
+                d.remove::<bool>(edited_id);
+            });
            run(app, "shape.effects", json!({key: {prop: v * scale}}));
        }
    });
@@ -1,13 +1,84 @@
 //! The slide thumbnail pane (Normal view): numbered thumbnails grouped by section, selection,
 //! drag-to-reorder, and the slide context menu.

+use std::collections::HashSet;
+
 use deckcraft_engine::Target;
-use egui::{Align2, Color32, CornerRadius, Rect, Sense, Stroke, Ui, pos2, vec2};
+use deckcraft_model::SlideId;
+use egui::{Align2, Color32, CornerRadius, Rect, Role, Sense, Stroke, Ui, WidgetInfo, pos2, vec2};
 use serde_json::json;

 use crate::SlideApp;
 use crate::theme::{self, Tokens};

+/// A slide drag in the thumbnail pane or the Slide Sorter.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub(crate) struct SlideDrag {
+    /// The presentation the drag started in; it is dropped, not applied, anywhere else.
+    pub uid: u64,
+    /// The dragged slides, in deck order.
+    pub ids: Vec<SlideId>,
+    /// The gap under the pointer: 0 is before the first slide, the slide count after the last.
+    pub slot: usize,
+}
+
+/// Starts dragging slide `i`: the whole slide selection when `i` is part of it, else `i` alone,
+/// which then becomes the selection, as in PowerPoint.
+pub(crate) fn start_slide_drag(app: &mut SlideApp, i: usize) {
+    let Some(st) = app.session.active() else { return };
+    let Some(id) = st.doc.slides.get(i).map(|s| s.id) else { return };
+    let selected: HashSet<SlideId> = st.selection.slides.iter().copied().collect();
+    let ids: Vec<SlideId> =
+        if selected.contains(&id) { st.doc.slides.iter().map(|s| s.id).filter(|x| selected.contains(x)).collect() } else { vec![id] };
+    let uid = st.uid;
+    if !selected.contains(&id) {
+        let _ = app.run("slide.go", json!({"index": i}));
+    }
+    app.thumb_drag = Some(SlideDrag { uid, ids, slot: i });
+}
+
+/// Whether a slide drag is under way in the active presentation. `button` is whether the
+/// primary button is held or was released this frame. A drag begun in another presentation, or
+/// one whose release this view never saw (the view changed under it), is discarded, so it never
+/// moves slides on some later, unrelated release.
+pub(crate) fn slide_drag_live(app: &mut SlideApp, button: bool) -> bool {
+    let uid = app.session.active().map(|st| st.uid);
+    if !button || app.thumb_drag.as_ref().is_some_and(|d| Some(d.uid) != uid) {
+        app.thumb_drag = None;
+    }
+    app.thumb_drag.is_some()
+}
+
+/// Whether the primary button is held or was released this frame: a slide drag is still alive.
+pub(crate) fn drag_button(ui: &Ui) -> bool {
+    ui.input(|i| i.pointer.primary_down() || i.pointer.any_released())
+}
+
+/// `slide.move`'s `to` for slides at `moving` (ascending indices) dropped at gap `slot`: the gap
+/// counted without them. `None` when the drop leaves the deck as it is.
+pub(crate) fn slides_move_dest(moving: &[usize], slot: usize) -> Option<usize> {
+    let first = *moving.first()?;
+    let dest = slot.saturating_sub(moving.iter().filter(|&&i| i < slot).count());
+    let one_run = moving.iter().enumerate().all(|(k, &i)| first.checked_add(k) == Some(i));
+    if one_run && dest == first { None } else { Some(dest) }
+}
+
+/// Ends the slide drag: one `slide.move` (one undo step) for all the dragged slides, unless the
+/// drop leaves them where they are, the drag began in another presentation, or one of them is gone.
+pub(crate) fn drop_slide_drag(app: &mut SlideApp) {
+    let Some(drag) = app.thumb_drag.take() else { return };
+    let Some(st) = app.session.active().filter(|st| st.uid == drag.uid) else { return };
+    let dragged: HashSet<SlideId> = drag.ids.iter().copied().collect();
+    let moving: Vec<usize> = st.doc.slides.iter().enumerate().filter(|(_, s)| dragged.contains(&s.id)).map(|(i, _)| i).collect();
+    if moving.len() != dragged.len() {
+        return;
+    }
+    if let Some(to) = slides_move_dest(&moving, drag.slot) {
+        let ids: Vec<u32> = drag.ids.iter().map(|id| id.0).collect();
+        let _ = app.run("slide.move", json!({"ids": ids, "to": to}));
+    }
+}
+
 /// Render the slide thumbnail pane, including section headers, selection, and scroll state.
 pub fn show(app: &mut SlideApp, ui: &mut Ui) {
    let t = Tokens::get(ui.ctx());
@@ -108,6 +179,8 @@ fn list(app: &mut SlideApp, ui: &mut Ui) {
            });
        }
        let (row, resp) = ui.allocate_exact_size(vec2(width, th + 16.0), Sense::click_and_drag());
+        let label = format!("Slide {}", i + 1);
+        resp.widget_info(|| WidgetInfo::labeled(Role::Button, true, &label));
        let img = crate::textures::device_pixel_rect(Rect::from_min_size(pos2(row.min.x + 30.0, row.min.y + 6.0), vec2(tw, th)), ppp);
        rects.push((i, row));
        let p = ui.painter();
@@ -174,7 +247,7 @@ fn list(app: &mut SlideApp, ui: &mut Ui) {
            app.start_show(i, false);
        }
        if resp.drag_started() {
-            app.thumb_drag = Some((i, i));
+            start_slide_drag(app, i);
        }
        resp.context_menu(|ui| slide_menu(app, ui, i));
    }
@@ -186,7 +259,7 @@ fn list(app: &mut SlideApp, ui: &mut Ui) {
        ui.scroll_to_rect(*row_rect, None);
    }
    // Drag reorder: insertion line.
-    if let Some((from, _)) = app.thumb_drag {
+    if slide_drag_live(app, drag_button(ui)) {
        if let Some(pp) = ui.input(|i| i.pointer.interact_pos()) {
            let mut to = doc.slides.len();
            for (i, r) in &rects {
@@ -195,19 +268,14 @@ fn list(app: &mut SlideApp, ui: &mut Ui) {
                    break;
                }
            }
-            app.thumb_drag = Some((from, to));
+            if let Some(d) = app.thumb_drag.as_mut() {
+                d.slot = to;
+            }
            let y = rects.iter().find(|(i, _)| *i == to).map(|(_, r)| r.min.y + 2.0).or_else(|| rects.last().map(|(_, r)| r.max.y)).unwrap_or(0.0);
            ui.painter().line_segment([pos2(26.0, y), pos2(width, y)], Stroke::new(2.0, t.accent));
        }
        if ui.input(|i| i.pointer.any_released()) {
-            if let Some((from, to)) = app.thumb_drag.take()
-                && to != from
-                && to != from + 1
-            {
-                let dest = if to > from { to - 1 } else { to };
-                let _ = app.run("slide.move", json!({"from": from, "to": dest}));
-            }
-            app.thumb_drag = None;
+            drop_slide_drag(app);
        }
    }
    // Click on empty space below: new slide prompt.
@@ -348,6 +416,7 @@ mod tests {
    #![allow(clippy::unwrap_used, clippy::expect_used)]

    use egui_kittest::Harness;
+    use egui_kittest::kittest::Queryable;

    use super::*;
    use crate::Services;
@@ -396,4 +465,124 @@ mod tests {
        let held = thumbs_scroll(&h);
        assert!((held - jumped).abs() < 1.0, "no re-scroll for a visible slide: {jumped} -> {held}");
    }
+
+    /// A tall window, so every thumbnail of a small deck is on screen.
+    fn tall_harness(slides: usize) -> (Harness<'static, SlideApp>, Vec<u32>) {
+        let mut s = Session::with_new();
+        while s.doc().unwrap().doc.slides.len() < slides {
+            s.execute("slide.new", &json!({})).unwrap();
+        }
+        let mut h = Harness::builder().with_size(egui::vec2(1200.0, 1600.0)).with_step_dt(1.0 / 60.0).build_ui_state(
+            |ui, app: &mut SlideApp| {
+                app.logic(ui.ctx());
+                app.ui(ui);
+            },
+            SlideApp::new(s, Services::default()),
+        );
+        h.run_steps(3);
+        let ids = order(&h);
+        (h, ids)
+    }
+
+    fn order(h: &Harness<'_, SlideApp>) -> Vec<u32> {
+        h.state().session.active().unwrap().doc.slides.iter().map(|s| s.id.0).collect()
+    }
+
+    #[test]
+    fn slides_move_dest_counts_without_the_moved_slides() {
+        // One slide: the gaps on either side of it leave it where it is.
+        assert_eq!(slides_move_dest(&[1], 1), None);
+        assert_eq!(slides_move_dest(&[1], 2), None);
+        assert_eq!(slides_move_dest(&[1], 0), Some(0));
+        assert_eq!(slides_move_dest(&[1], 4), Some(3));
+        // A run: any gap inside or around it is a no-op.
+        for slot in 2..=5 {
+            assert_eq!(slides_move_dest(&[2, 3, 4], slot), None, "slot {slot}");
+        }
+        assert_eq!(slides_move_dest(&[2, 3, 4], 0), Some(0));
+        assert_eq!(slides_move_dest(&[2, 3, 4], 6), Some(3));
+        // Scattered slides always gather, even at a gap between them.
+        assert_eq!(slides_move_dest(&[0, 2], 1), Some(0));
+        assert_eq!(slides_move_dest(&[0, 2], 0), Some(0));
+        assert_eq!(slides_move_dest(&[1, 3], 5), Some(3));
+        assert_eq!(slides_move_dest(&[], 3), None);
+        assert_eq!(slides_move_dest(&[usize::MAX], usize::MAX), None);
+    }
+
+    #[test]
+    fn dragging_selected_thumbnails_moves_them_together() {
+        let (mut h, ids) = tall_harness(4);
+        h.state_mut().run("slide.selectSlides", json!({"ids": [ids[0], ids[2]]})).unwrap();
+        h.run_steps(2);
+        let (first, last) = (h.get_by_label("Slide 1").rect(), h.get_by_label("Slide 4").rect());
+        // Below the middle of the last thumbnail: the gap after it.
+        crate::sorter::ui_tests::drag(&mut h, first.center(), egui::pos2(last.center().x, last.bottom() - 4.0));
+        assert_eq!(order(&h), [ids[1], ids[3], ids[0], ids[2]]);
+        let sel: Vec<u32> = h.state().session.active().unwrap().selection.slides.iter().map(|s| s.0).collect();
+        assert_eq!(sel, [ids[0], ids[2]], "the moved slides stay selected");
+        h.state_mut().run("edit.undo", json!({})).unwrap();
+        assert_eq!(order(&h), ids, "one undo puts both back");
+    }
+
+    #[test]
+    fn dragging_an_unselected_thumbnail_moves_only_it() {
+        let (mut h, ids) = tall_harness(4);
+        h.state_mut().run("slide.selectSlides", json!({"ids": [ids[0], ids[2]]})).unwrap();
+        h.run_steps(2);
+        let (second, first) = (h.get_by_label("Slide 2").rect(), h.get_by_label("Slide 1").rect());
+        crate::sorter::ui_tests::drag(&mut h, second.center(), egui::pos2(first.center().x, first.top() + 4.0));
+        assert_eq!(order(&h), [ids[1], ids[0], ids[2], ids[3]]);
+        let sel: Vec<u32> = h.state().session.active().unwrap().selection.slides.iter().map(|s| s.0).collect();
+        assert_eq!(sel, [ids[1]]);
+    }
+
+    /// A drag whose release no view saw (a double-click in the Slide Sorter opens Normal view
+    /// mid-gesture) is dropped, not left to move slides on the next unrelated release.
+    #[test]
+    fn a_slide_drag_without_a_held_button_is_dropped() {
+        let (mut h, ids) = tall_harness(3);
+        let app = h.state_mut();
+        app.run("slide.selectSlides", json!({"ids": [ids[0], ids[1]]})).unwrap();
+        start_slide_drag(app, 0);
+        if let Some(d) = app.thumb_drag.as_mut() {
+            d.slot = 3;
+        }
+        h.run_steps(2);
+        assert!(h.state().thumb_drag.is_none(), "no button held: the drag is over");
+        let last = h.get_by_label("Slide 3").rect();
+        h.hover_at(last.center());
+        h.run_steps(1);
+        h.event(egui::Event::PointerButton {
+            pos: last.center(),
+            button: egui::PointerButton::Primary,
+            pressed: false,
+            modifiers: egui::Modifiers::NONE,
+        });
+        h.run_steps(2);
+        assert_eq!(order(&h), ids, "a later release moves nothing");
+    }
+
+    /// A drag begun in one presentation never moves slides in another (switching mid-drag).
+    #[test]
+    fn a_slide_drag_does_not_follow_into_another_presentation() {
+        let (mut h, ids) = tall_harness(3);
+        let app = h.state_mut();
+        app.run("slide.selectSlides", json!({"ids": [ids[0], ids[1]]})).unwrap();
+        start_slide_drag(app, 0);
+        let drag = app.thumb_drag.clone().unwrap();
+        assert_eq!(drag.ids.iter().map(|s| s.0).collect::<Vec<_>>(), [ids[0], ids[1]]);
+        app.thumb_drag = Some(SlideDrag { slot: 3, ..drag.clone() });
+        app.run("file.new", json!({})).unwrap();
+        while app.session.active().unwrap().doc.slides.len() < 3 {
+            app.run("slide.new", json!({})).unwrap();
+        }
+        let other = app.session.active().unwrap().doc.slides.iter().map(|s| s.id.0).collect::<Vec<_>>();
+        assert!(!slide_drag_live(app, true), "the drag belongs to the first presentation");
+        app.thumb_drag = Some(SlideDrag { slot: 3, ..drag });
+        drop_slide_drag(app);
+        assert!(app.thumb_drag.is_none());
+        assert_eq!(app.session.active().unwrap().doc.slides.iter().map(|s| s.id.0).collect::<Vec<_>>(), other);
+        app.session.set_active(0);
+        assert_eq!(order(&h), ids, "and the first presentation is untouched");
+    }
 }
@@ -0,0 +1,18 @@
+//! JJ3: `show.presenter` answers the setting and where presenter view appears.
+#![allow(clippy::unwrap_used, clippy::expect_used)]
+
+use serde_json::json;
+
+use crate::{Services, SlideApp};
+use deckcraft_engine::Session;
+
+#[test]
+fn show_presenter_answers_on_and_window() {
+    let mut app = SlideApp::new(Session::with_new(), Services::default());
+    let v = app.run("show.presenter", json!({"on": true})).unwrap();
+    assert_eq!(v, json!({"on": true, "window": true}));
+    let v = app.run("show.presenter", json!({})).unwrap();
+    assert_eq!(v["on"], false, "no `on` toggles: {v}");
+    let doc = crate::UI_COMMANDS.iter().find(|c| c.0 == "show.presenter").unwrap().3;
+    assert!(doc.contains("separate window"), "{doc}");
+}
@@ -0,0 +1,73 @@
+//! Format Shape ▸ Effects (#1356): Reflection "None" clears the effect after another preset.
+#![allow(clippy::unwrap_used, clippy::expect_used)]
+
+use egui_kittest::Harness;
+use egui_kittest::kittest::Queryable;
+use serde_json::json;
+
+use crate::{Services, SlideApp};
+use deckcraft_engine::Session;
+
+fn has_reflection(h: &Harness<'_, SlideApp>) -> bool {
+    let st = h.state().session.active().unwrap();
+    let id = *st.selection.shapes.first().unwrap();
+    st.shape(id).unwrap().effects.as_ref().is_some_and(|e| e.reflection.is_some())
+}
+
+#[test]
+fn reflection_none_clears_after_a_second_preset() {
+    let mut s = Session::with_new();
+    s.execute("slide.new", &json!({"layout": "blank"})).unwrap();
+    let id = s.execute("shape.insert", &json!({"preset": "rect", "rect": [72.0, 36.0, 144.0, 108.0]})).unwrap()["id"].as_u64().unwrap();
+    s.execute("edit.select", &json!({"ids": [id]})).unwrap();
+    let mut app = SlideApp::new(s, Services::default());
+    app.ui.pane = Some("format".into());
+    app.ui.format_tab = "effects".into();
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_ui_state(
+        |ui, app: &mut SlideApp| {
+            app.logic(ui.ctx());
+            app.ui(ui);
+        },
+        app,
+    );
+    h.run_steps(3);
+    // The Shadow row has a "None" too; Reflection's is the later one.
+    for preset in ["Tight", "Half", "Full"] {
+        h.get_by_label(preset).click();
+        h.run_steps(4);
+        assert!(has_reflection(&h), "{preset} adds a reflection");
+        h.get_all_by_label("None").last().unwrap().click();
+        h.run_steps(4);
+        assert!(!has_reflection(&h), "None clears the {preset} reflection");
+    }
+}
+
+#[test]
+fn reflection_none_stays_cleared_when_a_slider_only_had_focus() {
+    let mut s = Session::with_new();
+    s.execute("slide.new", &json!({"layout": "blank"})).unwrap();
+    let id = s.execute("shape.insert", &json!({"preset": "rect", "rect": [72.0, 36.0, 144.0, 108.0]})).unwrap()["id"].as_u64().unwrap();
+    s.execute("edit.select", &json!({"ids": [id]})).unwrap();
+    let mut app = SlideApp::new(s, Services::default());
+    app.ui.pane = Some("format".into());
+    app.ui.format_tab = "effects".into();
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_ui_state(
+        |ui, app: &mut SlideApp| {
+            app.logic(ui.ctx());
+            app.ui(ui);
+        },
+        app,
+    );
+    h.run_steps(3);
+    h.get_by_label("Tight").click();
+    h.run_steps(4);
+    // Focus a reflection slider without editing it, then click "None": the slider's value must not
+    // be written back over the cleared reflection.
+    // The reflection's Size comes before the glow's (the same label).
+    h.get_all_by_role_and_label(egui::accesskit::Role::Slider, "Size").next().unwrap().focus();
+    h.run_steps(4);
+    assert!(h.get_all_by_role_and_label(egui::accesskit::Role::Slider, "Size").next().unwrap().is_focused(), "the reflection size slider has focus");
+    h.get_all_by_label("None").last().unwrap().click();
+    h.run_steps(4);
+    assert!(!has_reflection(&h), "a slider that only had focus does not re-add the reflection");
+}
@@ -237,6 +237,17 @@ pub fn show(app: &mut SlideApp, ui: &mut Ui) {
                });
            });
        let r = scroll.inner_rect;
+        // A gallery sized from this reads it on the next frame, so a change (a resize, a tab
+        // shown for the first time) asks for one; within half a point it is the same layout.
+        let spare = r.width() - scroll.content_size.x;
+        let moved = ui.ctx().data_mut(|d| {
+            let was = d.get_temp::<f32>(spare_room_id(&tab));
+            d.insert_temp(spare_room_id(&tab), spare);
+            was.is_none_or(|was| (was - spare).abs() > 0.5)
+        });
+        if moved {
+            ui.ctx().request_repaint();
+        }
        let overflow = (scroll.content_size.x - r.width()).max(0.0);
        let offset = scroll.state.clamped_offset().x;
        // Record the rendered offset for `InputTarget`: the same window point hits a different
@@ -263,6 +274,17 @@ pub fn show(app: &mut SlideApp, ui: &mut Ui) {
    });
 }

+fn spare_room_id(tab: &str) -> egui::Id {
+    egui::Id::unique(("ribbon_spare_room", tab))
+}
+
+/// The width the tab's groups left free in the ribbon on the last frame it was drawn; negative
+/// when they ran past its edge. A gallery that gives way to the groups after it sizes itself
+/// from this.
+pub(super) fn spare_room(ctx: &egui::Context, tab: &str) -> Option<f32> {
+    ctx.data(|d| d.get_temp::<f32>(spare_room_id(tab)))
+}
+
 /// A chevron over a ribbon edge that scrolls it; `true` on the frame it is clicked.
 fn edge_cue(ui: &mut Ui, rect: Rect, glyph: &str, hint: &str, t: &Tokens) -> bool {
    let resp = ui.interact(rect, ui.scope_id().with(glyph), Sense::click()).on_hover_text(hint);
@@ -407,6 +429,9 @@ mod master_layout_tests;
 #[cfg(test)]
 mod icons_popup_tests;

+#[cfg(test)]
+mod add_animation_menu_tests;
+
 #[cfg(test)]
 mod align_tests;

@@ -434,3 +459,6 @@ mod drawtable_tests;

 #[cfg(test)]
 mod inktoshape_tests;
+
+#[cfg(test)]
+mod picture_styles_tests;
@@ -0,0 +1,61 @@
+//! Add Animation (#1370): the menu scrolls, so the last effect can be reached and added.
+
+use deckcraft_engine::Session;
+use egui_kittest::Harness;
+use egui_kittest::kittest::Queryable;
+use serde_json::json;
+
+use crate::{Services, SlideApp};
+
+fn harness(size: egui::Vec2) -> Harness<'static, SlideApp> {
+    let mut session = Session::with_new();
+    let id = session.execute("shape.insert", &json!({"preset": "rect", "rect": [80.0, 80.0, 200.0, 120.0]})).unwrap()["id"].as_u64().unwrap();
+    session.execute("edit.select", &json!({"ids": [id]})).unwrap();
+    let mut app = SlideApp::new(session, Services::default());
+    app.ui.tab = "Animations".into();
+    let mut h = Harness::builder().with_size(size).with_step_dt(1.0 / 60.0).build_ui_state(
+        |ui, app: &mut SlideApp| {
+            app.logic(ui.ctx());
+            app.ui(ui);
+        },
+        app,
+    );
+    h.run_steps(3);
+    h
+}
+
+fn open_add_animation(h: &mut Harness<'static, SlideApp>, window: egui::Vec2) {
+    // The Animations ribbon is wider than a short window. The edge chevron is what a person uses
+    // to reach Add Animation; scroll-into-view on the button does not move that bar.
+    for _ in 0..12 {
+        let rect = h.get_by_label("Add Animation").rect();
+        if rect.min.x >= 8.0 && rect.max.x <= window.x - 8.0 {
+            break;
+        }
+        let Some(cue) = h.query_by_label("Scroll ribbon right") else { break };
+        cue.click();
+        h.run_steps(2);
+    }
+    h.get_by_label("Add Animation").click();
+    h.run_steps(3);
+}
+
+fn added_effect(h: &Harness<'_, SlideApp>) -> Option<(String, deckcraft_model::anim::AnimClass)> {
+    h.state().session.active().and_then(|d| d.current_slide()).and_then(|s| s.animations.first()).map(|a| (a.effect.clone(), a.class))
+}
+
+#[test]
+fn the_last_effect_is_reachable_by_scrolling() {
+    let size = egui::vec2(800.0, 700.0);
+    let mut h = harness(size);
+    open_add_animation(&mut h, size);
+    let before = h.get_by_label("Neutron — Motion").rect();
+    assert!(before.min.y > 700.0, "the last effect starts below the window: {before:?}");
+    h.get_by_label("Neutron — Motion").scroll_to_me();
+    h.run_steps(4);
+    let row = h.get_by_label("Neutron — Motion").rect();
+    assert!(row.min.y >= 0.0 && row.max.y <= 700.0, "a scrolled effect stays inside the window: {row:?}");
+    h.get_by_label("Neutron — Motion").click();
+    h.run_steps(3);
+    assert_eq!(added_effect(&h), Some(("neutron".into(), deckcraft_model::anim::AnimClass::Path)));
+}
@@ -103,24 +103,29 @@ pub(super) fn animations(app: &mut SlideApp, ui: &mut Ui) {
    });
    group(ui, |ui| {
        let r = big_button(ui, Icon::AddAnimation, "Add\nAnimation", has_sel);
+        // Every effect in one column is taller than a 1440p screen, so cap the height and scroll (#1370).
+        // The menu opens under the title bar and the ribbon; keep that chrome out of the cap.
+        let max_h = (r.ctx.viewport_rect().height() - 160.0).max(120.0);
        egui::Popup::menu(&r).width(260.0).show(|ui| {
-            for a in deckcraft_model::anim::ANIMATIONS.iter().filter(|a| a.2 != AnimClass::Media) {
-                if ui
-                    .button(format!(
-                        "{} — {}",
-                        a.1,
-                        match a.2 {
-                            AnimClass::Entrance => "Entrance",
-                            AnimClass::Emphasis => "Emphasis",
-                            AnimClass::Exit => "Exit",
-                            _ => "Motion",
-                        }
-                    ))
-                    .clicked()
-                {
-                    run(app, "animation.add", json!({"effect": a.0, "class": a.2.xml()}));
+            egui::ScrollArea::vertical().id_salt("add_animation").max_height(max_h).show(ui, |ui| {
+                for a in deckcraft_model::anim::ANIMATIONS.iter().filter(|a| a.2 != AnimClass::Media) {
+                    if ui
+                        .button(format!(
+                            "{} — {}",
+                            a.1,
+                            match a.2 {
+                                AnimClass::Entrance => "Entrance",
+                                AnimClass::Emphasis => "Emphasis",
+                                AnimClass::Exit => "Exit",
+                                _ => "Motion",
+                            }
+                        ))
+                        .clicked()
+                    {
+                        run(app, "animation.add", json!({"effect": a.0, "class": a.2.xml()}));
+                    }
                }
-            }
+            });
        });
        big(app, ui, Icon::AnimationPane, "Animation\nPane", "view.pane", json!({"pane": "animation"}));
        let r = big_button(ui, Icon::Trigger, "Trigger", cur.is_some());
--- a/Show More
+++ b/Show More