feat(installer): unify Windows setup and completion screens (INSTALLER-UI)

Picks up the startup prompt without the glyphs a font may lack (storytold/craft-libs#343, #344): the close mark is painted and the version pill is ASCII, so apps that panic on a missing glyph no longer take the prompt down.

Part of tracking issue storytold/craft-libs#319

.github/workflows/ci.yml

@@ -17,12 +17,45 @@ concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
+  # Keep the early manifest preflight separate from the reusable workflow. The shared gate
+  # also runs with require-craft-fonts: true, so the build script enforces actual required faces.
+  # Keep this pin identical to gate, freebsd.yml and release.yml.
+  font-pin:
+    runs-on: ubuntu-latest
+    env:
+      # Same craft-fonts commit as release.yml.
+      CRAFT_FONTS_REF: 37827adc41fd165f9a9234ac40f94dbad353aa69
+    steps:
+      - name: Check out craft-fonts
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          repository: storytold/craft-fonts
+          ref: ${{ env.CRAFT_FONTS_REF }}
+          path: craft-fonts
+      - name: Font pin gate
+        env:
+          # The only pin allowed to predate the reviewed Chinese manifest. It is a sentinel, not
+          # a proposed future SHA; update it together with all three workflow pins.
+          PENDING_CRAFT_FONTS_PIN: 43913056ce82a3fdad0ef69f6b88d1dc922a8104
+        run: |
+          manifest="$GITHUB_WORKSPACE/craft-fonts/fonts/simplified-chinese-manifest.txt"
+          if [ -f "$manifest" ]; then
+            echo "craft-fonts pin carries the reviewed simplified-Chinese manifest."
+          elif [ "$CRAFT_FONTS_REF" = "$PENDING_CRAFT_FONTS_PIN" ]; then
+            echo "::warning title=craft-fonts pin pending::The pinned craft-fonts commit has no fonts/simplified-chinese-manifest.txt, so CJK checks may skip. Advance ci.yml, freebsd.yml and release.yml together to the reviewed immutable SHA before claiming shipped Chinese fonts."
+          else
+            echo "::error title=craft-fonts pin missing Chinese manifest::CRAFT_FONTS_REF advanced past the known pending pin ($PENDING_CRAFT_FONTS_PIN) but still has no fonts/simplified-chinese-manifest.txt. Update the pin to the reviewed commit that carries it."
+            exit 1
+          fi
+
   gate:
+    needs: font-pin
     # Tracks @main so suite-wide CI fixes reach every app without a PR in each repository.
     uses: storytold/craft-common-actions/.github/workflows/gate.yml@main
     with:
       # Same craft-fonts commit as release.yml.
-      craft-fonts-ref: 43913056ce82a3fdad0ef69f6b88d1dc922a8104
+      craft-fonts-ref: 37827adc41fd165f9a9234ac40f94dbad353aa69
+      require-craft-fonts: true
       packages: >-
         libasound2-dev libxkbcommon-dev libwayland-dev libx11-dev libxrandr-dev libxi-dev
         libgl1-mesa-dev

.github/workflows/freebsd.yml

@@ -27,4 +27,8 @@ jobs:
     # Intentionally tracked at @main (not SHA-pinned) so org-wide CI improvements, security fixes, and build optimizations propagate without PR churn across all craftapp repos.
     uses: storytold/craft-common-actions/.github/workflows/freebsd.yml@main
     with:
-      craft-fonts-ref: 43913056ce82a3fdad0ef69f6b88d1dc922a8104
+      # Keep identical to ci.yml and release.yml. The shared FreeBSD workflow passes
+      # CRAFT_FONTS_DIR to its tests but has no CRAFT_FONTS_REQUIRED input yet, so it does not
+      # qualify the required Chinese input after the pin advances; that gate stays explicitly
+      # pending in docs/egui-037-migration-plan.md section 5.1.
+      craft-fonts-ref: 37827adc41fd165f9a9234ac40f94dbad353aa69

.github/workflows/release.yml

@@ -24,7 +24,10 @@ jobs:
     with:
       app-name: deckcraft
       app-title: DeckCraft
-      craft-fonts-ref: 43913056ce82a3fdad0ef69f6b88d1dc922a8104
+      # Keep identical to ci.yml and freebsd.yml. The shared release workflow sets
+      # CRAFT_FONTS_REQUIRED=1 in its packaging steps, so a pin without the reviewed Chinese
+      # manifest fails the release instead of silently skipping it.
+      craft-fonts-ref: 37827adc41fd165f9a9234ac40f94dbad353aa69
       version: ${{ inputs.version }}
     secrets:
       APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}

ATTRIBUTION.md

@@ -27,7 +27,7 @@ artwork. The ribbon and menu icons stay original drawings.
 | `assets/app-icon/icon-source.deckcraft` | DeckCraft contributors | made with `deckcraft-cli run` (see git history) | MIT OR Apache-2.0 | Source of the placeholder icon |
 | `docs/images/editor.png`, `docs/images/shape-format.png`, `docs/images/format-pane.png`, `docs/images/slide-sorter.png`, `docs/images/dark-mode.png`, `docs/images/sample-deck.png` | DeckCraft contributors | Screenshots of DeckCraft and slides rendered by `deckcraft-cli` from the built-in sample deck (original content; Inter font, OFL-1.1) | MIT OR Apache-2.0 | README screenshots |
 | `crates/media/tests/fixtures/tone*` (`tone.mp3`, `.m4a`, `.aac`, `.ogg`, `.opus`, `.flac`, `.wma`, `tone-alac.m4a`) | DeckCraft contributors | synthesised 0.5 s 440 Hz sine, encoded by `crates/media/tests/fixtures/make.sh` (ffmpeg as the encoder only) | CC0-1.0 | Audio decoding tests |
-| `crates/media/tests/fixtures/clip-*` (`clip-h264.mp4`, `clip-h264.mov`, `clip-hevc.mp4`, `clip-vp9.webm`, `clip-av1.mkv`) | DeckCraft contributors | 6 frames of a colour gradient generated by `make.sh` (python3), encoded by ffmpeg (x264 / x265 / libvpx / SVT-AV1 as encoders only) | CC0-1.0 | Video decoding tests |
+| `crates/media/tests/fixtures/clip-*` (`clip-h264.mp4`, `clip-h264.mov`, `clip-hevc.mp4`, `clip-vp8.webm`, `clip-vp9.webm`, `clip-av1.mkv`) | DeckCraft contributors | 6 frames of a colour gradient generated by `make.sh` (python3), encoded by ffmpeg (x264 / x265 / libvpx / libvpx-vp9 / SVT-AV1 as encoders only) | CC0-1.0 | Video decoding tests |
 | `crates/media/tests/fixtures/damaged/*` (`ebml-header.mkv`, `ebml-position.webm`, `demux-loop.mp4`, `demux-loop.m4a`) | DeckCraft contributors | the `clip-*` and `tone*` fixtures above with bytes changed by a mutation fuzzer | CC0-1.0 | Damaged media must not panic or hang |
 | `crates/media/tests/fixtures/damaged/*` (`stsc-count.m4a`, `stsz-size.m4a`) | DeckCraft contributors | `tone.m4a` above with bytes changed by a mutation fuzzer | CC0-1.0 | Damaged MP4 sample tables must not abort |
 | `crates/media/tests/fixtures/make.sh` | DeckCraft contributors | this repository | MIT OR Apache-2.0 | Regenerates the media fixtures |
@@ -41,8 +41,9 @@ artwork. The ribbon and menu icons stay original drawings.
 
 | Asset | Author | Source | Licence | Used for |
 |---|---|---|---|---|
-| Ubuntu Light (`Ubuntu-Light.ttf`, via the `epaint_default_fonts` crate 0.36) | Dalton Maag Ltd for Canonical | https://crates.io/crates/epaint_default_fonts | Ubuntu Font Licence 1.0 | Last-resort text face when no other font is available; UI fallback |
-| Hack Regular, Noto Emoji, emoji-icon-font (via `epaint_default_fonts` / egui) | Source Foundry; Google; Jakub Steiner et al. | https://crates.io/crates/epaint_default_fonts | MIT / Bitstream-Vera, OFL-1.1, MIT | egui UI fallback glyphs |
+| Ubuntu Light (`Ubuntu-Light.ttf`, via the `epaint_default_fonts` crate 0.37) | Dalton Maag Ltd for Canonical | https://crates.io/crates/epaint_default_fonts | Ubuntu Font Licence 1.0 | Last-resort text face when no other font is available; UI fallback |
+| Hack Regular, Noto Emoji (via `epaint_default_fonts` / egui) | Source Foundry; Google | https://crates.io/crates/epaint_default_fonts | MIT / Bitstream-Vera, OFL-1.1 | egui UI fallback glyphs |
+| `epaint_default_fonts::EGUI_ICONS`, `epaint_default_fonts::EMOJI_ICON` (dependency font inputs) | John Slegers | [egui 6d518fc7](https://github.com/storytold/egui/tree/6d518fc799681571963842f95b55a6b68431b15a/crates/epaint_default_fonts/fonts), [emoji-icon-font](https://github.com/jslegers/emoji-icon-font) | MIT (Copyright (c) 2014 John Slegers; full upstream text in `NOTICE`) | egui-icons.ttf is the five-glyph subset, included by default_fonts independently of monochrome_emoji_fonts; emoji-icon-font.ttf is the full monochrome fallback. Dependency assets unmodified here; no font file copied into this repository. |
 
 ## Embedded at build time from craft-fonts (`CRAFT_FONTS_DIR`)
 
@@ -58,9 +59,14 @@ families excluded by `crates/fonts/build.rs`:
 | Carlito, Caladea | OFL-1.1 | Metric-compatible stand-ins for documents that ask for Calibri / Cambria |
 | Liberation Sans, Serif, Mono | OFL-1.1 | Metric-compatible stand-ins for Arial, Times New Roman, Courier New |
 | Montserrat, Lato, Open Sans, Roboto, Merriweather, Playfair Display, Poppins, Nunito Sans | OFL-1.1 | Theme fonts |
-| BIZ UDPGothic, BIZ UDMincho, Shippori Mincho, Noto Sans Arabic | OFL-1.1 | Japanese and Arabic text |
+| BIZ UDPGothic, BIZ UDMincho, Shippori Mincho | OFL-1.1 | Japanese text |
+| Noto Sans Arabic, Noto Sans Hebrew | OFL-1.1 | Arabic and Hebrew text |
+| Noto Sans Thai, Noto Sans Georgian | OFL-1.1 | Thai and Georgian text |
+| NanumGothic | OFL-1.1 | Korean text and interface fallback |
+| Noto Sans Symbols, Noto Sans Symbols 2 | OFL-1.1 | Interface symbol fallback |
 
-Web (wasm32) builds embed only Inter Regular/Bold and BIZ UDPGothic Regular.
+Web (wasm32) builds embed only Inter Regular/Bold (and a Variable face where the Latin manifest
+provides one) and BIZ UDPGothic Regular.
 
 ## PDF writer colour profiles
 
@@ -75,3 +81,13 @@ is copied into this repository. The licence text is in `licenses/pdf-writer/LICE
 | `krilla 0.8.2 / icc/sGrey-v4.icc` | Clinton Ingram (Compact ICC Profiles) | https://github.com/LaurenzV/krilla/blob/3ffdf0588cf98050aad6edba51ca70162e1fb5b5/crates/krilla/icc/sGrey-v4.icc | CC0-1.0 | `00c0f94e09127520a17dc0e1d9264b5702081d96dbdb1549ee88e3631ce42a9d` | PDF export colour profiles |
 | `krilla 0.8.2 / icc/sRGB-v2-magic.icc` | Clinton Ingram (Compact ICC Profiles) | https://github.com/LaurenzV/krilla/blob/3ffdf0588cf98050aad6edba51ca70162e1fb5b5/crates/krilla/icc/sRGB-v2-magic.icc | CC0-1.0 | `af4efe28f6d311799865f325ba39184a2e978b113ca74124d60af7de22b105f4` | PDF export colour profiles |
 | `krilla 0.8.2 / icc/sRGB-v4.icc` | Clinton Ingram (Compact ICC Profiles) | https://github.com/LaurenzV/krilla/blob/3ffdf0588cf98050aad6edba51ca70162e1fb5b5/crates/krilla/icc/sRGB-v4.icc | CC0-1.0 | `c56e1685d888f5edb92fe07f2750f387f8fe8e91b32ff8fb0b56bfbbb9458353` | PDF export colour profiles |
+
+### Optional native Chinese fallback
+
+Native builds also read craft-fonts' `fonts/simplified-chinese-manifest.txt` when present.
+This opt-in does not enter the wasm font allowlist. Font bytes and the full licence remain
+in craft-fonts, including the LXGW Reserved Font Names and original Klee notice.
+
+| Family | Author | Source | Licence | Use |
+|---|---|---|---|---|
+| LXGW WenKai Lite Regular 1.530 | LXGW; original Klee Project Authors / Fontworks | https://github.com/lxgw/LxgwWenKai-Lite/tree/b712c83d98acf977bacfb7fb010207802808bda9 | OFL-1.1, unmodified upstream font | Native Chinese glyph fallback after existing UI faces; font SHA256 `f799a538a3355877e597a0ae04050e897932c9ae7689eb9227c2953c5dd549ea`, OFL SHA256 `0333a85fe077b6849f8e417acc44e8bd879442ceb681e271acf93e2d57fd4e2e` |

Cargo.toml

@@ -4,7 +4,7 @@ members = ["crates/*", "apps/*", "xtask"]
 default-members = ["crates/*", "apps/deckcraft", "apps/deckcraft-cli"]
 
 [workspace.package]
-version = "0.10.0"
+version = "0.11.1"
 edition = "2024"
 license = "MIT OR Apache-2.0"
 rust-version = "1.95"
@@ -61,15 +61,17 @@ vello_common = { version = "0.2", default-features = false }
 image = { version = "0.25", default-features = false, features = ["png", "jpeg", "webp", "gif", "tiff", "bmp"] }
 craft-media = { git = "https://github.com/storytold/craft-libs", rev = "f0ad6c1e1d297908915f4be315b0fcfc9be7b5d4", version = "=0.1.0", default-features = false }
 craft-pdf = { git = "https://github.com/storytold/craft-libs", rev = "9f75d3dc19b4b514c4f3d4847ed1ec1b0e86b4ef", version = "=0.1.0", default-features = false, features = ["write", "write-simple-text"] }
+craft-update = { git = "https://github.com/storytold/craft-libs", version = "=0.1.0", rev = "495e5971bc024aa96e6ed318cb6e7cd3a0103184", features = ["egui"] }
 i_overlay = "9"
 quick-xml = "0.41"
 zip = { version = "3", default-features = false, features = ["deflate"] }
 
 # ui
-egui = "0.36"
-egui_extras = { version = "0.36", default-features = false }
-eframe = { version = "0.36", default-features = false }
-egui_kittest = "0.36"
+egui = { version = "0.37", default-features = false }
+egui_extras = { version = "0.37", default-features = false }
+eframe = { version = "0.37", default-features = false }
+egui_kittest = "0.37"
+web-time = "1.1"
 rfd = "0.17"
 arboard = { version = "3.6", default-features = false }
 
@@ -104,3 +106,18 @@ debug = 0
 
 [patch.crates-io]
 krilla = { git = "https://github.com/storytold/craft-libs", rev = "9f75d3dc19b4b514c4f3d4847ed1ec1b0e86b4ef", version = "=0.8.2" }
+ecolor = { git = "https://github.com/storytold/egui.git", rev = "6d518fc799681571963842f95b55a6b68431b15a" }
+emath = { git = "https://github.com/storytold/egui.git", rev = "6d518fc799681571963842f95b55a6b68431b15a" }
+epaint = { git = "https://github.com/storytold/egui.git", rev = "6d518fc799681571963842f95b55a6b68431b15a" }
+epaint_default_fonts = { git = "https://github.com/storytold/egui.git", rev = "6d518fc799681571963842f95b55a6b68431b15a" }
+egui = { git = "https://github.com/storytold/egui.git", rev = "6d518fc799681571963842f95b55a6b68431b15a" }
+egui-winit = { git = "https://github.com/storytold/egui.git", rev = "6d518fc799681571963842f95b55a6b68431b15a" }
+egui-wgpu = { git = "https://github.com/storytold/egui.git", rev = "6d518fc799681571963842f95b55a6b68431b15a" }
+egui_glow = { git = "https://github.com/storytold/egui.git", rev = "6d518fc799681571963842f95b55a6b68431b15a" }
+egui_extras = { git = "https://github.com/storytold/egui.git", rev = "6d518fc799681571963842f95b55a6b68431b15a" }
+egui_kittest = { git = "https://github.com/storytold/egui.git", rev = "6d518fc799681571963842f95b55a6b68431b15a" }
+egui_system_font_provider = { git = "https://github.com/storytold/egui.git", rev = "6d518fc799681571963842f95b55a6b68431b15a" }
+eframe = { git = "https://github.com/storytold/egui.git", rev = "6d518fc799681571963842f95b55a6b68431b15a" }
+egui_demo_lib = { git = "https://github.com/storytold/egui.git", rev = "6d518fc799681571963842f95b55a6b68431b15a" }
+egui_inspection = { git = "https://github.com/storytold/egui.git", rev = "6d518fc799681571963842f95b55a6b68431b15a" }
+winit = { git = "https://github.com/storytold/winit.git", rev = "a517b3846ee8457d84ee4975110bfda6797c44dc" }

NOTICE

@@ -18,7 +18,13 @@ list (author, source, license) is in ATTRIBUTION.md.
 - Builds made with craft-fonts (CRAFT_FONTS_DIR; all official releases) embed the fonts listed in
   ATTRIBUTION.md (Inter, Carlito, Caladea, Liberation, Montserrat, Lato, Open Sans, Roboto,
   Merriweather, Playfair Display, Poppins, Nunito Sans, BIZ UD, Shippori Mincho, Noto Sans
-  Arabic) under the SIL Open Font License 1.1; their licence texts ship with release packages.
+  Arabic, Noto Sans Thai, Noto Sans Georgian, NanumGothic, Noto Sans Symbols, Noto Sans Symbols 2,
+  Noto Sans Hebrew) under the SIL Open Font License 1.1; their licence texts ship with release
+  packages (the exact font files and OFL texts are retained in craft-fonts releases). Native
+  builds may additionally read craft-fonts' separate Simplified Chinese manifest and embed LXGW
+  WenKai Lite 1.530 under OFL-1.1; its OFL text ships with release packages, and the exact font
+  and licence files are retained in craft-fonts with the LXGW Reserved Font Names. That face is
+  not in the web payload.
 - Lucide icon paths embedded in crates/engine/src/icon_data.rs (Insert › Icons), release 1.56.0,
   commit 440a1e1dfb1e712505308da46bead3c28b1f1398, https://github.com/lucide-icons/lucide.
   ISC License, Copyright (c) 2026 Lucide Icons and Contributors. Icons Lucide derives from Feather
@@ -80,3 +86,20 @@ Code dependencies
   (https://github.com/saucecontrol/Compact-ICC-Profiles) are CC0-1.0; the profile
   licence is retained in licenses/pdf-writer/LICENSE-ICC.txt and exact files, sources
   and hashes are in ATTRIBUTION.md.
+
+
+egui icon font subset (dependency asset)
+----------------------------------------
+epaint_default_fonts 0.37 embeds egui-icons.ttf, a five-glyph subset of
+emoji-icon-font by John Slegers. The full monochrome emoji-icon-font fallback
+uses the same MIT license. Upstream license text follows unchanged.
+
+MIT License
+
+Copyright (c) 2014 John Slegers
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

ROADMAP.md

@@ -2,10 +2,13 @@
 
 **Stage: alpha** · next: beta, ~20 points and ~120–210 h away
 
-> **Last reviewed:** 2026-10-14 · **Last updated:** 2026-10-23 · **Change:** trivial (progress log: scroll bars on the zoomed slide pane, #1157; previous: minor, native chart payloads stored in bounded ZIP members; previous: major, community PR wave 2026-10-14: ~60 landed items in the progress log, among them the Font, Paragraph, Photo Album, theme colour and font and Date and Time dialogs, presenter and show controls, the SmartArt Text Pane and PPTX corpus slices; breadth 84% after `cargo xtask parity`, ready stays ~55%, stage stays alpha; duplicated rows and headers folded; previous: minor, hours to ~95% per audience added) · **Target:** Microsoft PowerPoint for Mac 16.113 (Microsoft 365)
+> **Last reviewed:** 2026-10-14 · **Last updated:** 2026-10-24 · **Change:** trivial (progress log: Edit Points handle drags with Shift, Ctrl/Cmd or Alt/Option set the point type; previous: trivial, progress log: scroll bars on the zoomed slide pane, #1157; previous: minor, native chart payloads stored in bounded ZIP members; previous: major, community PR wave 2026-10-14: ~60 landed items in the progress log, among them the Font, Paragraph, Photo Album, theme colour and font and Date and Time dialogs, presenter and show controls, the SmartArt Text Pane and PPTX corpus slices; breadth 84% after `cargo xtask parity`, ready stays ~55%, stage stays alpha; duplicated rows and headers folded; previous: minor, hours to ~95% per audience added) · **Target:** Microsoft PowerPoint for Mac 16.113 (Microsoft 365)
+> **Last reviewed:** 2026-10-14 · **Last updated:** 2026-10-24 · **Change:** trivial (progress log: Ctrl+wheel zoom during the slide show, #1286; previous: trivial, scroll bars on the zoomed slide pane, #1157; previous: minor, native chart payloads stored in bounded ZIP members; previous: major, community PR wave 2026-10-14: ~60 landed items in the progress log, among them the Font, Paragraph, Photo Album, theme colour and font and Date and Time dialogs, presenter and show controls, the SmartArt Text Pane and PPTX corpus slices; breadth 84% after `cargo xtask parity`, ready stays ~55%, stage stays alpha; duplicated rows and headers folded; previous: minor, hours to ~95% per audience added) · **Target:** Microsoft PowerPoint for Mac 16.113 (Microsoft 365)
+> **Last reviewed:** 2026-10-14 · **Last updated:** 2026-10-24 · **Change:** trivial (progress log: picture and embedded object fills; previous: trivial, scroll bars on the zoomed slide pane, #1157; previous: minor, native chart payloads stored in bounded ZIP members; previous: major, community PR wave 2026-10-14: ~60 landed items in the progress log, among them the Font, Paragraph, Photo Album, theme colour and font and Date and Time dialogs, presenter and show controls, the SmartArt Text Pane and PPTX corpus slices; breadth 84% after `cargo xtask parity`, ready stays ~55%, stage stays alpha; duplicated rows and headers folded; previous: minor, hours to ~95% per audience added) · **Target:** Microsoft PowerPoint for Mac 16.113 (Microsoft 365)
 > **Last reviewed:** 2026-10-14 · **Last updated:** 2026-10-22 · **Change:** trivial (fill and outline edits reach group members, #1079; stage and scores unchanged) · **Target:** Microsoft PowerPoint for Mac 16.113 (Microsoft 365)
 > **Last reviewed:** 2026-10-14 · **Last updated:** 2026-10-20 · **Change:** trivial (empty chart number-format sections hide values; previous: minor, native chart payloads stored in bounded ZIP members; previous: major, community PR wave 2026-10-14: ~60 landed items in the progress log, among them the Font, Paragraph, Photo Album, theme colour and font and Date and Time dialogs, presenter and show controls, the SmartArt Text Pane and PPTX corpus slices; breadth 84% after `cargo xtask parity`, ready stays ~55%, stage stays alpha; duplicated rows and headers folded; previous: minor, hours to ~95% per audience added) · **Target:** Microsoft PowerPoint for Mac 16.113 (Microsoft 365)
 > **Last reviewed:** 2026-10-14 · **Last updated:** 2026-10-18 · **Change:** minor (Symbol-font characters (U+F0xx) remap to the installed Symbol face's real Unicode on macOS, so they draw from Symbol instead of a look-alike; previous: minor, native chart payloads stored in bounded ZIP members; previous: major, community PR wave 2026-10-14: ~60 landed items in the progress log, among them the Font, Paragraph, Photo Album, theme colour and font and Date and Time dialogs, presenter and show controls, the SmartArt Text Pane and PPTX corpus slices; breadth 84% after `cargo xtask parity`, ready stays ~55%, stage stays alpha; duplicated rows and headers folded; previous: minor, hours to ~95% per audience added) · **Target:** Microsoft PowerPoint for Mac 16.113 (Microsoft 365)
+> **Last reviewed:** 2026-10-14 · **Last updated:** 2026-10-21 · **Change:** minor (proofing language for the whole presentation; previous: minor, native chart payloads stored in bounded ZIP members; previous: major, community PR wave 2026-10-14: ~60 landed items in the progress log, among them the Font, Paragraph, Photo Album, theme colour and font and Date and Time dialogs, presenter and show controls, the SmartArt Text Pane and PPTX corpus slices; breadth 84% after `cargo xtask parity`, ready stays ~55%, stage stays alpha; duplicated rows and headers folded; previous: minor, hours to ~95% per audience added) · **Target:** Microsoft PowerPoint for Mac 16.113 (Microsoft 365)
 
 DeckCraft aims at full PowerPoint parity, and to be better: faster, open (a documented zip+JSON
 format plus PPTX), scriptable by agents (CLI, JSON control channel, MCP), and available everywhere
@@ -134,18 +137,31 @@ app's JSON control channel (`deckcraft --control PORT`).
 
 | Date | What landed |
 |---|---|
+| 2026-10-24 | AutoFormat as you type: a paragraph that starts with `*`, `-`, `--`, `>`, `<>`, `1.`, `1)`, `I.`, `i.`, `A.`, `a.` or `a)` and a space or tab becomes a bulleted or numbered list in that style; Backspace right after puts the typed text back, and Tools ▸ AutoCorrect and `text.autocorrect {lists}` turn it off |
+| 2026-10-24 | Tables: while the caret is in a cell, dragging into another cell selects that range of cells (shaded, merged cells taken in whole), and Shift+arrow grows or shrinks it; formatting applies to the selected cells only, and Delete clears their text and keeps the table |
+| 2026-10-24 | Preferences ▸ Measurement units: inches or centimetres. The Format pane's Size and Position fields, Shape Format ▸ Size on the ribbon, the Slide Size dialog and the ruler show and take the chosen unit; the deck still stores points (#1326) |
+| 2026-10-23 | Chart text colour: `chart.options {textColor}` and Font Color on a selected chart colour its title, axes, legend and data labels; the colour is written to the chart part (`c:txPr` on the axes, legend, labels and chart, the title's run defaults) so an imported chart keeps its `txPr` colours through an edit and a save; text without a colour of its own takes PowerPoint's default, the theme's text colour at 65 % plus 35 % (595959 on a light theme, light grey on a dark one) |
+| 2026-10-24 | A picture's own fill shows behind its transparent pixels, and an embedded object (an old equation, `p:oleObj`) takes the fill and outline of its fallback picture, as PowerPoint for Mac draws them (synthetic probe: a half-transparent PNG on orange and on yellow with an outline); on a private 166-deck corpus 51 slides of equations on coloured boxes move closer to PowerPoint's PDF, none further |
 | 2026-10-23 | Format Background ▸ Apply to All also sets the background of the slide masters the slides use (and clears their layouts' overrides), so new slides keep it (#891) |
 | 2026-10-22 | Table text takes the master's other-text style (`otherStyle`), shapes and text boxes the presentation's default text style, as PowerPoint for Mac draws them (synthetic probe: 14 pt cells under a 14 pt `otherStyle` and a 26 pt `defaultTextStyle`); a private deck's table had been drawn 20 pt instead of 18 |
 | 2026-10-18 | Find (Ctrl+F): "Find what:" has the keyboard as soon as the dialog opens, and keeps it after Enter finds a match, so the search can be typed and changed without clicking the field (#951) |
+| 2026-10-24 | Columns dialog: Home › Columns › More Columns… and Format Shape › Text Box › Columns… set the number of text columns (1 to 16) and the spacing between them in inches, in one undo step; `format.columns` with no fields opens it, and a key left out keeps the text box's own value |
 | 2026-10-18 | Duplicate (Ctrl+D) repeats a move: duplicate a shape, move the copy, and the next Duplicate places its copy the same distance further on, as in PowerPoint (#966) |
 | 2026-10-22 | Slide Show: while animations play, each frame draws only the slide's shapes over the slide's backdrop (background, master and layout graphics), rendered once and ahead of time. A full-slide picture with a glow in the layout re-rendered at every frame held animations to 2–3 frames a second (~390 ms a frame at 1080p); now ~28 ms |
 | 2026-10-22 | Animation Pane ▸ Play From: with an effect selected, the pane's play button starts the canvas preview at that effect, with the effects before it already played. With nothing selected it is still Play All |
 | 2026-10-21 | Opening a .pptx puts the text of shapes without an anchor at the top even when the theme's shape defaults (`spDef`) centre new shapes, as PowerPoint for Mac draws them; checked with a synthetic probe and on a private 166-deck corpus (51 slides closer to PowerPoint's PDF, none further) |
 | 2026-10-23 | A shape with no fill and no line (a text box) no longer draws its shape-level glow as a halo round its box; the text's own glow is all PowerPoint shows |
+| 2026-10-24 | Slide Show: Ctrl+wheel (Cmd+wheel on a Mac) over the slide zooms in and out around the pointer, four notches per doubling, up to 4×, as in PowerPoint; zooming back to the whole slide leaves the zoom, and the plain wheel still turns the page (#1286) |
 | 2026-10-23 | Normal view: a slide zoomed past the window gets a horizontal and a vertical scroll bar on the axes that overflow; drag the thumb or click the track to reach every edge (#1157) |
 | 2026-10-22 | Shape Fill and Shape Outline format the members of a selected group, including nested groups, in one undo step. Fill transparency retains each member's effective colour (#1079) |
 | 2026-10-21 | 3-D contours, extrusion depths and bevels keep their size in points inside a group whose child coordinates scale its shapes: a 1 pt contour on a small extruded cube in a legacy group drew hundreds of points wide, a band across the slide |
+| 2026-10-21 | Groups nest at most 32 deep (`arrange.group` refuses more), as deep as PPTX import reads and slides draw: a deck grouped 39 or more levels deep saved without complaint and then could not be opened again |
+| 2026-10-21 | Review › Language has *Whole presentation*: one proofing language for every text box, table cell, note, master and layout, and the default for new text (`format.languageAll`, one undo step); the per-selection language still works |
 | 2026-10-20 | Chart number formats with explicit empty positive, negative or zero sections hide the corresponding labels, including all values with three semicolons; a blank whole format still uses General. Synthetic formatter regressions |
+| 2026-10-22 | Chart bars and their legend keys draw the series' own pattern fill (`a:pattFill`, now read and written) and draw nothing for `a:noFill`, with the series outline where it has one, as PowerPoint for Mac does (synthetic probe); they took the palette's colour before. Lines, areas and markers use a pattern's foreground colour |
+| 2026-10-24 | Format Shape and Format Background ▸ Pattern fill: a gallery of the 48 preset patterns PowerPoint offers, drawn in the current colors, with Foreground and Background color menus. Format Shape could only set 25 % in accent 1 on background 1, and Format Background listed 10 presets by their XML names |
+| 2026-10-21 | Reuse Slides: pick which slides of the other presentation to insert from a list (`slide.reuseList`, #1103) |
+| 2026-10-21 | Slide list and slide sorter: Shift+click selects a range of slides and Ctrl+Shift+click adds it to the selection (`slide.selectRange`, #1105) |
 | 2026-10-18 | Native chart sidecar bytes move from JSON arrays into referenced ZIP entries, with shared media byte/item limits and bounded reads; older inline sidecars still load. Synthetic format regressions cover large workbooks and malformed members |
 | 2026-10-18 | Slide thumbnails and the Slide Sorter render only the slides in view: on a deck of more than 600 slides they used to evict their own thumbnails, so the pane flashed white and never finished (#969) |
 | 2026-10-18 | Resizing with the mouse snaps the edge being dragged to the slide, guides and other shapes: a fixed edge that already lined up used to take the snap and leave the dragged edge free, and a fixed edge near a line shifted the dragged one (#961) |
@@ -154,18 +170,33 @@ app's JSON control channel (`deckcraft --control PORT`).
 | 2026-10-19 | README: the Linux runtime libraries a tarball or musl install has to provide — the `dlopen`ed X11/Vulkan/GL/dialog libraries with their Alpine and Void package names, the software-Vulkan fallback, and why fontconfig and freetype are not among them (#955) |
 | 2026-10-17 | Opening a file caps absurd effect sizes (glow, soft edges, shadows, reflections, on shapes, text and table text) at what Format Shape allows: a glow of 10^18 pt in a .pptx made rendering ask for 34 GB and abort |
 | 2026-10-17 | Opening a .deckcraft file whose shapes repeat an id gives the repeats fresh ids (groups, layouts and masters too), so the deck validates and edits by id find one shape |
+| 2026-10-24 | Edit Points: hold Shift, Ctrl or Alt while dragging a point's handle to make it a smooth, straight or corner point, as in PowerPoint (Cmd and Option work as Ctrl and Alt on the Mac); the point keeps that type for the next drag |
 | 2026-10-17 | Edit Points: turning a shape into a freeform is one undo step, so Undo brings the original shape back (it used to stay a freeform) |
 | 2026-10-17 | While a placeholder's text is being edited, a click on a shape in front of it selects that shape instead of moving the caret, as in PowerPoint (#931) |
 | 2026-10-16 | Symbol-font characters: a run's U+F0xx symbol code (from `<a:sym typeface="Symbol"/>`) now draws from the installed Symbol face even when it has no private-use mapping — Apple's Symbol on macOS maps the glyphs to real Unicode, so the code is remapped to that character (the Adobe Symbol encoding) instead of falling to a look-alike. Bullets and metafile text take the same remap |
 | 2026-10-15 | Native saves keep an imported chart's embedded workbook, drawings and relationships; headless PPTX → edit → native save/reopen → PPTX tests verify the payloads and stale-workbook rejection |
+| 2026-10-18 | Charts: a series' own data-label setting is honoured — numbers PowerPoint shows on a graph no longer disappear, and a bare `c:showVal` means on (#868) |
+| 2026-10-15 | Render: quick styles render on empty placeholders — the fill gate now checks for style and line overrides too (#832) |
+| 2026-10-15 | Canvas: the resize cursor follows the handle's rotated diagonal — rotated shapes showed the wrong diagonal cursor (#745) |
+| 2026-10-20 | Tests: the Options dialog's Cancel, Esc and close button put the settings back the way they were (#878) |
+| 2026-10-20 | Tests: Ctrl+A in the slide sorter selects every slide, as in PowerPoint (#936) |
+| 2026-10-18 | Thumbnails: navigating slides with the arrow keys scrolls the thumbnail pane to keep the current slide visible (#917) |
 | 2026-10-15 | PPTX trigger sequences keep separate On Click steps, including paragraph builds; synthetic import/edit/save/reopen and headless show regressions |
 | 2026-10-16 | Export: PNG with a transparent background — the slide background is left out, only the slide's content is drawn (Export… dialog, File › Export, web download, `file.export`/`file.render` `transparentBackground`, `deckcraft-cli render --transparent`) (#784) |
 | 2026-10-16 | Arrange ▸ Align: Align to Slide and Align Selected Objects, as in PowerPoint. One object aligns to the slide and several to each other until the other choice is ticked; the choice holds for that selection and also drives Distribute |
 | 2026-10-16 | Fitted canvas: discrete mouse-wheel steps navigate immediately, including rapid and batched input, while trackpad gestures retain their cooldown and zoomed slides still pan. |
+| 2026-10-16 | PPTX import: a paragraph build edited in PowerPoint (paragraphs with their own start, other shapes' effects in between, builds by 2nd-level paragraphs) takes PowerPoint's clicks in the show; it used to be rebuilt as one build, 34 clicks instead of 10 on the reporter's slide. Paragraph builds with sub-points save as PowerPoint writes them (#844) |
 | 2026-10-15 | CLI: .txt and .md export includes table cell text, which it used to skip silently (#814) |
 | 2026-10-15 | A `.pptx` slide that can't be read is reported, not dropped in silence: `lostSlides` from `file.open`, a message and a repaired copy in the app, a warning from `deckcraft-cli` (#203) |
 | 2026-10-16 | AutoFormat as you type: ordinals (1st, 22nd, 103rd) get superscript suffixes after a space or punctuation; Tools ▸ AutoCorrect and `text.autocorrect {ordinals}` turn it off |
 | 2026-10-16 | A PowerPoint Show (`.ppsx`) opened from the command line or the file association starts its slide show, as in PowerPoint; File › Open still opens it for editing (#862) |
+| 2026-10-15 | Canvas: the Format and Animation Painter override the cursor to show the tool is armed (#830) |
+| 2026-10-24 | Edit Points: Esc pressed before the mouse button is released cancels a point or handle drag, as in PowerPoint, and leaves the shape as it was with no undo step. Edit Points stays on after the cancel |
+| 2026-10-15 | Edit Points: right-click a segment for Straight/Curved Segment, a point for Open/Close Path (`shape.segmentType`, `shape.openPath`, `shape.closePath`); Delete Segment and Add Point in the menu still to come |
+| 2026-10-24 | Edit Points: right-click a segment for Add Point (at the pointer), Delete Segment (a closed outline opens there; grayed out on an open one) and Open/Close Path, as in PowerPoint (`shape.deleteSegment`) |
+| 2026-10-15 | Design › Browse for Themes… with a `.pptx` or `.potx` brings its slide master and layouts, not just the theme: the master the current slide uses is replaced (a preserved one stays beside it), the template stretches to the deck's slide size, and each slide moves to the layout with the same name or kind and keeps its content. One undo step (#807) |
+| 2026-10-15 | Clicking the frame of a text box or placeholder selects the box whole, so it can be moved, duplicated or deleted; only a click inside puts the caret in the text (#787) |
+| 2026-10-15 | Review › Compare: Reject and Reject All drop revisions without applying them (`review.reject`); Accept All skips what was rejected |
 | 2026-10-15 | PDF export and rendering: `anchorCtr` centres the drawn text block — right-aligned text no longer ran past the box edge (#736) |
 | 2026-10-14 | connected MCP rejects unrelated, malformed, incomplete and oversized replies without replay; buffered unsolicited bytes force a fresh connection before sending (#718) |
 | 2026-10-14 | Empty bulleted and numbered paragraphs show gray markers while editing, including on first click and after Enter. Markers use the list style and stay out of slide shows and exports. |
@@ -262,9 +293,16 @@ app's JSON control channel (`deckcraft --control PORT`).
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-10-24 | trivial | Progress log: selecting a range of table cells by dragging. Scores and milestone names unchanged |
+| 2026-10-24 | trivial | Progress log: measurement units in centimetres (#1326). Scores unchanged |
 | 2026-10-22 | trivial | Progress log: Animation Pane ▸ Play From. Scores unchanged |
+| 2026-10-24 | trivial | Progress log: Ctrl+wheel zoom during the slide show (#1286). Scores and milestone names unchanged |
 | 2026-10-23 | trivial | Progress log: scroll bars on the zoomed slide pane (#1157). Scores and milestone names unchanged |
+| 2026-10-24 | trivial | Progress log: the Columns dialog. Scores and milestone names unchanged |
+| 2026-10-24 | trivial | Progress log: Edit Points handle drags with Shift, Ctrl/Cmd or Alt/Option. Scores and milestone names unchanged |
 | 2026-10-20 | trivial | Explicit empty chart number-format sections hide their values; blank whole-code General fallback is retained. Synthetic formatter regressions; chart-element scores and readiness estimates unchanged |
+| 2026-10-21 | trivial | Progress log: Reuse Slides picker (#1103). Scores and milestone names unchanged |
+| 2026-10-21 | trivial | Progress log: slide range selection (#1105). Scores and milestone names unchanged |
 | 2026-10-18 | minor | Native chart payloads use referenced ZIP members and share media byte/item limits; old inline sidecars remain readable. Synthetic tests cover multi-megabyte layout, all shape owners, shared budgets, missing/corrupt members and invalid references. Scores and milestone scope unchanged |
 | 2026-10-16 | minor | Symbol-font U+F0xx codes remap to the installed Symbol face's real Unicode (Apple Symbol on macOS) |
 | 2026-10-15 | trivial | Progress log: chart package parts survive a native save. Scores and milestone names unchanged |
@@ -272,10 +310,15 @@ app's JSON control channel (`deckcraft --control PORT`).
 | 2026-10-15 | trivial | Progress log: PPTX trigger click-step round trip. Feature scores and milestone names unchanged |
 | 2026-10-16 | trivial | Progress log: PNG export with a transparent background (#784) |
 | 2026-10-16 | trivial | Progress log: a `.ppsx` from the system starts the slide show (#862) |
+| 2026-10-24 | trivial | Progress log: picture and embedded object fills |
 | 2026-10-22 | trivial | Progress log: table text takes the master's other-text style |
 | 2026-10-16 | trivial | Progress log: responsive mouse-wheel navigation on the fitted canvas |
 | 2026-10-21 | trivial | Progress log: theme `spDef` anchor no longer applied to a file's own shapes |
 | 2026-10-21 | trivial | Progress log: 3-D sizes in scaled groups stay in points |
+| 2026-10-22 | trivial | Progress log: chart series pattern and no fills |
+| 2026-10-15 | trivial | Progress log: Browse for Themes applies a template's master and layouts (#807) |
+| 2026-10-15 | trivial | Progress log: Compare Reject and Reject All |
+| 2026-10-16 | trivial | Progress log: PPTX paragraph builds edited in PowerPoint keep their clicks (#844) |
 | 2026-10-14 | trivial | remote MCP checks reply IDs, envelopes and bounded newline framing (#718) |
 | 2026-10-14 | minor | Gray list markers on empty paragraphs while editing; caret keeps the list indent before typing |
 | 2026-10-14 | minor | Community PR wave folded: headline breadth 84% over 191 features (P0 92%, P1 82%, P2 55%) and the feature-area breadths from `cargo xtask parity`; one row per area; Upcoming item 2 merged; per-PR count notes dropped from the progress log. Ready stays ~55%, stage alpha |
@@ -341,3 +384,27 @@ app's JSON control channel (`deckcraft --control PORT`).
 | 2026-10-10 | minor | Stage checked against the new core-workflow gate: passes, stays alpha |
 | 2026-10-10 | major | Restructured to craftrules `standards/progress-docs.md`: stage, two numbers, dimensions, features, languages; parity estimate moved to docs/target-app-parity.md, "Working today" to its evidence section, the alpha checklist to docs/roadmap.md |
 | 2026-10-07 | major | Alpha checklist (~80% to a self-defined alpha), breadth ~80%, overall ~62%, ~190 h to full parity |
+
+## Packaging update — 2026-10-10
+
+Windows setup now uses the shared `craft-installer` native UI source, with install/repair/remove
+completion, cancellation and failure screens. Existing MSI ownership and upgrade identities are
+preserved; unattended modes remain unattended. Source/generator checks pass; native Windows
+installer acceptance with real release payloads is still pending. See [setup validation](packaging/windows/README.md).
+
+## Packaging update (2026-10-11)
+
+Windows setup now uses the suite's shared `craft-installer` UI, preserving existing folder,
+shortcut and launch options and app-owned installation policy. Install, uninstall and repair
+have explicit completion screens; cancellation and failure have separate endings. Source/profile
+checks, WiX UI library compilation for x64/x86/ARM64, PowerShell parsing and package identity
+comparisons pass. Native fixture MSI linking/UI tables pass on all three architectures, and
+Windows full UI install/repair/uninstall, x86 install/remove, folder upgrades, desktop choices
+and launch checks pass with fixtures. Native evidence and real-release acceptance limits
+are linked from
+[Windows packaging](packaging/windows/README.md).
+
+Windows Settings removal now opens the shared completion screen. Quiet install/removal
+remains unattended; Settings labels preserve compatibility with existing Launchers, and
+previous Modify policy is retained. Windows 11 fixture verification covers both installation
+scopes and x64/x86 removal, with full MSI validation on x64/x86/ARM64.

apps/deckcraft-cli/src/main.rs

@@ -407,7 +407,7 @@ fn frame_paths(out: &str, ts: &[f64]) -> Result<Vec<String>, String> {
         return Ok(vec![out.to_string()]);
     }
     let p = std::path::Path::new(out);
-    let stem = p.file_stem().and_then(|x| x.to_str()).unwrap_or("frame");
+    let stem = p.file_stem().and_then(std::ffi::OsStr::to_str).unwrap_or("frame");
     let mut paths: Vec<String> = Vec::with_capacity(ts.len());
     for t in ts {
         let path = p.with_file_name(format!("{stem}-t{t:.3}.png")).to_string_lossy().into_owned();

apps/deckcraft-web/index.html

@@ -5,7 +5,7 @@
   <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=no">
   <title>DeckCraft</title>
   <link data-trunk rel="rust" data-bin="deckcraft-web" data-wasm-opt="z" data-weak-refs />
-  <link data-trunk rel="icon" href="../../assets/app-icon/hicolor/32x32/apps/ai.storyteller.deckcraft.png" />
+  <link data-trunk rel="icon" href="../../assets/app-icon/deckcraft.ico" />
   <style>
     html, body { margin: 0; padding: 0; width: 100%; height: 100%; overflow: hidden; background: #262626; }
     #deckcraft_canvas { position: absolute; inset: 0; width: 100%; height: 100%; display: block; }

apps/deckcraft-web/src/web.rs

@@ -11,6 +11,8 @@ const VIDEO_EXTS: &[&str] = &["mp4", "m4v", "mov", "webm"];
 const CANVAS_ID: &str = "deckcraft_canvas";
 const LOADING_ID: &str = "deckcraft_loading";
 
+/// Start the browser shell: install logging, locate the canvas, launch the eframe runner,
+/// build the sample or blank deck, and replace the loading element when launch finishes.
 pub fn start() {
     eframe::WebLogger::init(log::LevelFilter::Info).ok();
     wasm_bindgen_futures::spawn_local(async {
@@ -36,6 +38,7 @@ pub fn start() {
                     if let Some(rs) = &cc.wgpu_render_state {
                         log::info!("deckcraft-web {}: wgpu backend {:?}", env!("CARGO_PKG_VERSION"), rs.adapter.get_info().backend);
                     }
+                    deckcraft_ui_egui::install_ime_pass_hooks(&cc.egui_ctx);
                     let inbox: Inbox = Inbox::default();
                     let mut app = SlideApp::new(Session::new(), services(inbox.clone(), cc.egui_ctx.clone()));
                     let q = query();
@@ -74,11 +77,17 @@ struct WebShell {
 }
 
 impl eframe::App for WebShell {
+    /// Delegate one eframe logic pass to the wrapped application.
     fn logic(&mut self, ctx: &egui::Context, _frame: &mut eframe::Frame) {
-        let dropped = ctx.input_mut(|i| std::mem::take(&mut i.raw.dropped_files));
-        for f in dropped {
-            // Capture the document and slide now. The bytes arrive later, after the user may
-            // have switched slides.
+        self.app.logic(ctx);
+    }
+
+    /// Consume browser drops with fresh input, capture the identity before the asynchronous read,
+    /// and deliver the id, name, and bytes through the inbox.
+    fn raw_input_hook(&mut self, ctx: &egui::Context, raw: &mut egui::RawInput) {
+        // Browsers cannot read dropped files synchronously. Consume this pass's drops here, with
+        // fresh input, and capture the document/slide before the asynchronous read finishes.
+        for f in std::mem::take(&mut raw.dropped_files) {
             let id = self.app.begin_external_file("drop");
             let inbox = self.inbox.clone();
             let ctx = ctx.clone();
@@ -97,11 +106,7 @@ impl eframe::App for WebShell {
                 }
             });
         }
-        self.app.logic(ctx);
-    }
-
-    fn raw_input_hook(&mut self, _ctx: &egui::Context, raw: &mut egui::RawInput) {
-        self.app.raw_input_hook(raw);
+        self.app.raw_input_hook(ctx, raw);
     }
 
     fn ui(&mut self, ui: &mut egui::Ui, _frame: &mut eframe::Frame) {

apps/deckcraft/Cargo.toml

@@ -25,6 +25,7 @@ chrono = { workspace = true }
 winresource = "0.1"
 
 [target.'cfg(not(target_arch = "wasm32"))'.dependencies]
+craft-update = { workspace = true }
 rfd = { workspace = true }
 arboard = { workspace = true, features = ["image-data"] }
 image = { workspace = true }

apps/deckcraft/src/apple_events.rs

@@ -41,8 +41,9 @@ pub fn poll(inbox: &Inbox, app: &mut SlideApp, ctx: &egui::Context) {
             Event::Open(paths) => {
                 for p in paths.iter().filter_map(|p| p.to_str()) {
                     if let Err(e) = app.open_path(p) {
-                        log::error!("{p}: {e}");
-                        app.set_status(format!("Couldn't open {p}: {e}"));
+                        let safe_p = p.replace(['\r', '\n'], " ");
+                        log::error!("{safe_p}: {e}");
+                        app.set_status(format!("Couldn't open {safe_p}: {e}"));
                     }
                 }
             }

apps/deckcraft/src/control_server.rs

@@ -66,6 +66,13 @@ pub fn start(port: u16, ctx: egui::Context) -> Receiver<ControlRequest> {
 /// core busy until it recovers.
 const ACCEPT_RETRY: Duration = Duration::from_millis(100);
 
+/// The longest a connection refused as busy is drained before it is closed.
+const REFUSED_GRACE: Duration = Duration::from_millis(250);
+
+/// Refused connections drained at once, each on a thread of its own. Past this many, a refused
+/// connection gets the busy reply and is closed without a drain.
+const MAX_REFUSING: usize = 16;
+
 /// The connections `incoming` accepts, calling `wait` after each failed accept.
 fn accepted<T>(incoming: impl Iterator<Item = std::io::Result<T>>, mut wait: impl FnMut()) -> impl Iterator<Item = T> {
     incoming.filter_map(move |stream| stream.map_err(|_| wait()).ok())
@@ -75,12 +82,14 @@ fn accepted<T>(incoming: impl Iterator<Item = std::io::Result<T>>, mut wait: imp
 fn serve_listener(listener: TcpListener, limits: Limits, ctx: egui::Context) -> Receiver<ControlRequest> {
     let (tx, rx) = sync_channel::<ControlRequest>(limits.queue.max(1));
     let active = Arc::new(AtomicUsize::new(0));
+    let refusing = Arc::new(AtomicUsize::new(0));
     std::thread::spawn(move || {
         for mut stream in accepted(listener.incoming(), || std::thread::sleep(ACCEPT_RETRY)) {
             let _ = stream.set_write_timeout(Some(limits.write_timeout));
             if active.fetch_add(1, Ordering::SeqCst) >= limits.max_clients {
                 active.fetch_sub(1, Ordering::SeqCst);
                 let _ = writeln!(stream, "{}", json!({"ok": false, "error": "busy: too many control connections"}));
+                refuse(stream, &refusing, limits.write_timeout.min(REFUSED_GRACE));
                 continue;
             }
             let slot = Slot(Arc::clone(&active));
@@ -98,6 +107,27 @@ fn serve_listener(listener: TcpListener, limits: Limits, ctx: egui::Context) ->
     rx
 }
 
+/// Close a connection that was told it is refused. A peer that wrote a line before it read the
+/// reply would see only a reset, so the connection is drained for up to `grace` first, on a
+/// thread of its own: the accepting thread goes straight back to accepting. Past
+/// [`MAX_REFUSING`] drains at once, the connection is closed without one.
+fn refuse(stream: TcpStream, refusing: &Arc<AtomicUsize>, grace: Duration) {
+    if refusing.fetch_add(1, Ordering::SeqCst) >= MAX_REFUSING {
+        refusing.fetch_sub(1, Ordering::SeqCst);
+        return;
+    }
+    let slot = Slot(Arc::clone(refusing));
+    let spawned = std::thread::Builder::new().name("control-refused".into()).spawn(move || {
+        let _slot = slot;
+        if let Ok(read) = stream.try_clone() {
+            close_politely(&stream, &mut BufReader::new(read), grace);
+        }
+    });
+    if spawned.is_err() {
+        log::warn!("control server could not start a thread to close a refused connection");
+    }
+}
+
 /// Holds one connection slot; gives it back when the client thread ends, however it ends.
 struct Slot(Arc<AtomicUsize>);
 
@@ -192,14 +222,16 @@ fn close_politely(out: &TcpStream, reader: &mut BufReader<TcpStream>, grace: Dur
     // Enough for a pipelined line or two; a peer that keeps talking is dropped at the deadline.
     // The timeout is what is left of the grace before each read, not the whole of it: a peer that
     // sends a byte just before each one expires would otherwise hold this thread, and its slot,
-    // for close to twice as long as the deadline says.
+    // for close to twice as long as the deadline says. The timeout is set on the handle that
+    // reads: on Windows, a read timeout set on one handle of a `try_clone` pair can fail to apply
+    // to reads through the other.
     const MAX_DRAIN: usize = 64 << 10;
     let until = Instant::now() + grace;
     let mut sink = [0u8; 4 << 10];
     let mut drained = 0;
     while drained < MAX_DRAIN {
         let left = until.saturating_duration_since(Instant::now());
-        if left.is_zero() || out.set_read_timeout(Some(left)).is_err() {
+        if left.is_zero() || reader.get_ref().set_read_timeout(Some(left)).is_err() {
             break;
         }
         match reader.read(&mut sink) {
@@ -388,8 +420,11 @@ mod tests {
     /// depended on the timing of the two.
     #[test]
     fn a_pipelined_peer_still_reads_why_its_line_was_rejected() {
-        let (addr, rx) = server(small());
-        for _ in 0..12 {
+        // A slot comes back only when the thread serving a peer ends, which can be after the next
+        // peer connects, so every peer has a slot of its own.
+        const PEERS: usize = 12;
+        let (addr, rx) = server(Limits { max_clients: PEERS, ..small() });
+        for _ in 0..PEERS {
             let (mut r, mut w) = client(addr);
             w.write_all(b"hello\n").unwrap();
             // A second line, written after the first as a script writes it: it races the close.
@@ -403,6 +438,69 @@ mod tests {
         assert!(rx.try_recv().is_err(), "a line after the rejection was dispatched");
     }
 
+    /// A peer refused because every connection is taken still reads why when it had already
+    /// written a line: closing with that line unread resets the connection and discards the
+    /// reply. Repeated because it depends on the timing of the two.
+    #[test]
+    fn a_pipelined_peer_refused_as_busy_still_reads_why() {
+        let (addr, rx) = server(Limits { max_clients: 1, idle_timeout: Duration::from_secs(30), ..small() });
+        ui(rx);
+        // Take the only slot, and make sure it is being served.
+        let (mut hr, mut hw) = client(addr);
+        writeln!(hw, r#"{{"id":1,"method":"m"}}"#).unwrap();
+        assert!(reply(&mut hr).is_some());
+        for _ in 0..50 {
+            let (mut r, mut w) = client(addr);
+            let _ = w.write_all(b"{\"id\":2,\"method\":\"m\"}\n");
+            let replies = replies_until_closed(&mut r);
+            assert_eq!(replies.len(), 1, "{replies:?}");
+            assert!(replies[0]["error"].as_str().unwrap_or_default().starts_with("busy"), "{replies:?}");
+        }
+    }
+
+    /// Peers refused as busy that stay connected without sending anything do not hold up the
+    /// connections after them: each one's drain runs to its deadline on a thread of its own, and
+    /// past `MAX_REFUSING` drains at once a refused connection is closed without one.
+    #[test]
+    fn silent_refused_peers_do_not_delay_the_next_refusal() {
+        let (addr, rx) = server(Limits { max_clients: 1, idle_timeout: Duration::from_secs(30), ..small() });
+        ui(rx);
+        let (mut hr, mut hw) = client(addr);
+        writeln!(hw, r#"{{"id":1,"method":"m"}}"#).unwrap();
+        assert!(reply(&mut hr).is_some());
+        // Twenty drains of 250 ms each, one after another, would take five seconds.
+        let silent: Vec<_> = (0..MAX_REFUSING + 4).map(|_| client(addr)).collect();
+        let start = Instant::now();
+        let (mut r, _w) = client(addr);
+        let refused = reply(&mut r).unwrap();
+        assert!(refused["error"].as_str().unwrap_or_default().starts_with("busy"), "{refused}");
+        assert!(start.elapsed() < Duration::from_secs(1), "refused after {:?}", start.elapsed());
+        drop(silent);
+    }
+
+    /// A peer that keeps its connection open after its line was rejected gives its slot back at
+    /// the drain deadline (the write timeout), not at the idle timeout.
+    #[test]
+    fn a_rejected_peer_that_stays_connected_frees_its_slot_at_the_deadline() {
+        let (addr, rx) = server(Limits { max_clients: 1, idle_timeout: Duration::from_secs(30), ..small() });
+        ui(rx);
+        let (mut r, mut w) = client(addr);
+        w.write_all(b"hello\n").unwrap();
+        assert_eq!(reply(&mut r).unwrap()["ok"], false);
+        // `w` stays open, sending nothing.
+        let deadline = Instant::now() + Duration::from_secs(4);
+        loop {
+            let (mut dr, mut dw) = client(addr);
+            writeln!(dw, r#"{{"id":2,"method":"m"}}"#).unwrap();
+            if reply(&mut dr).is_some_and(|v| v["ok"] == true) {
+                break;
+            }
+            assert!(Instant::now() < deadline, "slot never freed");
+            std::thread::sleep(Duration::from_millis(50));
+        }
+        drop(w);
+    }
+
     #[test]
     fn oversized_line_closes_connection() {
         let (addr, rx) = server(small());
@@ -427,7 +525,9 @@ mod tests {
 
     #[test]
     fn connection_limit_refuses_then_frees_slot() {
-        let (addr, rx) = server(small());
+        // `a` sends nothing. Under a 300 ms idle timeout, a slow run could close it before the
+        // third peer connected, and that peer then took its slot instead of reading `busy`.
+        let (addr, rx) = server(Limits { idle_timeout: Duration::from_secs(30), ..small() });
         ui(rx);
         let a = client(addr);
         let (mut br, mut bw) = client(addr);
@@ -454,17 +554,18 @@ mod tests {
     #[test]
     fn blocked_ui_times_out_and_full_queue_is_busy() {
         let (addr, rx) = server(small());
-        // No UI: the first request fills the one-slot queue and times out; the second finds it full.
+        // No UI: the request that reaches the one-slot queue first fills it and times out; the
+        // other finds it full. Each connection has its own thread, so either request can be first.
         let (mut ar, mut aw) = client(addr);
         let (mut br, mut bw) = client(addr);
         writeln!(aw, r#"{{"id":1,"method":"m"}}"#).unwrap();
-        std::thread::sleep(Duration::from_millis(50));
         writeln!(bw, r#"{{"id":2,"method":"m"}}"#).unwrap();
-        let b = reply(&mut br).unwrap();
-        assert!(b["error"].as_str().unwrap().starts_with("busy"));
-        assert_eq!(b["id"], 2);
         let a = reply(&mut ar).unwrap();
-        assert_eq!(a["error"], "timeout");
+        let b = reply(&mut br).unwrap();
+        assert_eq!((&a["id"], &b["id"]), (&json!(1), &json!(2)));
+        let mut errors = [a["error"].as_str().unwrap_or_default(), b["error"].as_str().unwrap_or_default()];
+        errors.sort_unstable();
+        assert_eq!(errors, ["busy: too many queued requests", "timeout"], "{a} {b}");
         drop(rx);
     }
 

apps/deckcraft/src/main.rs

@@ -42,8 +42,9 @@ impl eframe::App for App {
         apple_events::poll(&self.1, &mut self.0, ctx);
         self.0.logic(ctx);
     }
-    fn raw_input_hook(&mut self, _ctx: &egui::Context, raw: &mut egui::RawInput) {
-        self.0.raw_input_hook(raw);
+    /// Forward native raw input to the wrapped application once per pass.
+    fn raw_input_hook(&mut self, ctx: &egui::Context, raw: &mut egui::RawInput) {
+        self.0.raw_input_hook(ctx, raw);
     }
     fn ui(&mut self, ui: &mut egui::Ui, _frame: &mut eframe::Frame) {
         self.0.ui(ui);
@@ -180,10 +181,19 @@ fn app_icon() -> Option<egui::IconData> {
     eframe::icon_data::from_png_bytes(png).map_err(|e| log::warn!("app icon: {e}")).ok()
 }
 
+/// Install logging, parse startup arguments and environment, launch the native app, and
+/// propagate an eframe startup failure.
 fn main() -> eframe::Result {
     // First, so every start-up record (and the engine's panic hook, installed with the first
     // Session) is captured; see `logging`.
     let logger = logging::install();
+    if let Some(done) = craft_update::self_update::finish(&craft_update::suite::DECKCRAFT, &std::env::args_os().skip(1).collect::<Vec<_>>()) {
+        if let Err(e) = done {
+            eprintln!("DeckCraft update helper failed: {e}");
+            std::process::exit(1);
+        }
+        return Ok(());
+    }
     let (control_port, files, sample, show) =
         match startup(std::env::var("DECKCRAFT_CONTROL_PORT").ok().and_then(|p| p.parse().ok()), std::env::args().skip(1)) {
             Startup::Help => {
@@ -255,8 +265,10 @@ fn main() -> eframe::Result {
         "DeckCraft",
         options,
         Box::new(move |cc| {
+            deckcraft_ui_egui::install_ime_pass_hooks(&cc.egui_ctx);
             let mut app = SlideApp::new(Session::new(), services());
             load_prefs(&mut app);
+            app.enable_update_checks();
             // AutoRecover: reopen what a previous run left unsaved, then keep it current.
             if std::env::var_os("DECKCRAFT_NO_RECOVERY").is_none() {
                 app.session.recovery_dir = deckcraft_engine::recovery::default_dir();

contributors/people.toml

@@ -59,3 +59,9 @@ real_name = "Ryan C. Shoemaker"
 real_name = "Marco Arnulfo"
 display_name = "Marco Arnulfo"
 sync_github_name = false
+
+[people.GhostMitra]
+sync_github_name = true
+
+[people.Katacc]
+sync_github_name = true

crates/anim/src/show.rs

@@ -1,10 +1,10 @@
 //! Slide show navigation: click steps, slide order (hidden slides, custom shows, ranges), loop
 //! and automatic advance.
 
-use std::collections::BTreeMap;
+use std::collections::{BTreeMap, HashMap};
 
-use deckcraft_model::Presentation;
 use deckcraft_model::text::{Action, Hyperlink};
+use deckcraft_model::{Presentation, SlideId};
 
 use crate::Timeline;
 use crate::interact::SlideRun;
@@ -29,18 +29,8 @@ pub enum ShowAction {
     Exit,
 }
 
-/// Can a link from a (possibly untrusted) deck be opened outside the show? Only web pages and
-/// mail: `file:`, `javascript:`, relative paths and other schemes (OS protocol handlers) are not
-/// opened on a click.
-pub fn safe_url(url: &str) -> bool {
-    let u = url.trim();
-    let Some((scheme, rest)) = u.split_once(':') else { return false };
-    match scheme.to_ascii_lowercase().as_str() {
-        "http" | "https" => rest.starts_with("//") && rest.len() > 2,
-        "mailto" => !rest.is_empty(),
-        _ => false,
-    }
-}
+// Which links the show opens on a click; PDF export writes the same ones.
+pub use deckcraft_model::text::safe_url;
 
 /// What a clicked link does in the show (`ShowState::follow`).
 #[derive(Clone, Debug, PartialEq, Eq)]
@@ -83,12 +73,25 @@ pub struct ShowState {
     pub zoom: Option<(usize, usize)>,
 }
 
+/// Index of each slide by id (the first slide wins a duplicate id), so resolving a custom show
+/// costs the sum of its two lists, not their product.
+fn slide_indices(pres: &Presentation) -> HashMap<SlideId, usize> {
+    let mut map = HashMap::with_capacity(pres.slides.len());
+    for (i, s) in pres.slides.iter().enumerate() {
+        map.entry(s.id).or_insert(i);
+    }
+    map
+}
+
 /// Slide indices the show visits in order: the custom show or range from Set Up Slide Show, minus
 /// hidden slides.
 pub fn show_order(pres: &Presentation) -> Vec<usize> {
     let n = pres.slides.len();
     let base: Vec<usize> = match pres.show.custom_show.as_ref().and_then(|name| pres.custom_shows.iter().find(|c| &c.name == name)) {
-        Some(cs) => cs.slides.iter().filter_map(|id| pres.slides.iter().position(|s| s.id == *id)).collect(),
+        Some(cs) => {
+            let index = slide_indices(pres);
+            cs.slides.iter().filter_map(|id| index.get(id).copied()).collect()
+        }
         None => match pres.show.range {
             Some((a, b)) => {
                 let a = (a.max(1) as usize).saturating_sub(1);
@@ -104,12 +107,9 @@ pub fn show_order(pres: &Presentation) -> Vec<usize> {
 /// Visible slides of custom show `name`, in that show's order.
 fn custom_indices(pres: &Presentation, name: &str) -> Option<Vec<usize>> {
     let cs = pres.custom_shows.iter().find(|c| c.name == name)?;
-    let order: Vec<usize> = cs
-        .slides
-        .iter()
-        .filter_map(|id| pres.slides.iter().position(|s| s.id == *id))
-        .filter(|&i| pres.slides.get(i).is_some_and(|s| !s.hidden))
-        .collect();
+    let index = slide_indices(pres);
+    let order: Vec<usize> =
+        cs.slides.iter().filter_map(|id| index.get(id).copied()).filter(|&i| pres.slides.get(i).is_some_and(|s| !s.hidden)).collect();
     if order.is_empty() { None } else { Some(order) }
 }
 

crates/anim/src/tests.rs

@@ -7,7 +7,10 @@ use deckcraft_model::{
     AnimClass, AnimStart, Animation, ColorRef, CustomShow, Presentation, Rgba, Shape, ShapeId, Slide, SlideId, TextBody, Transition, Xfrm,
 };
 
-use crate::*;
+use crate::{
+    AnimState, Layer, LinkJump, MotionPath, ShowAction, ShowState, Source, Timeline, TriggerPlay, default_path, ease, morph_crop, morph_frame,
+    morph_pairs, morph_xfrm, show_order, transition_frame, transition_layers,
+};
 
 const W: f64 = 960.0;
 const H: f64 = 540.0;
@@ -1082,3 +1085,53 @@ fn show_returns_to_the_zoom_slide() {
     s.goto(&p, 4);
     assert_eq!(s.next(&p), ShowAction::Slide(5));
 }
+
+#[test]
+fn custom_show_resolves_duplicate_ids_to_the_first_slide() {
+    let mut p = pres(3);
+    Arc::make_mut(&mut p.slides[2]).id = p.slides[0].id;
+    p.custom_shows = vec![CustomShow { name: "Dup".into(), slides: vec![p.slides[0].id, SlideId(1001), SlideId(424_242)] }];
+    p.show.custom_show = Some("Dup".into());
+    assert_eq!(show_order(&p), vec![0, 1]);
+}
+
+#[test]
+fn custom_show_with_many_entries_resolves_quickly() {
+    let mut p = pres(20_000);
+    let ids: Vec<SlideId> = p.slides.iter().map(|s| s.id).collect();
+    p.custom_shows = vec![CustomShow { name: "All".into(), slides: ids.iter().rev().copied().collect() }];
+    p.show.custom_show = Some("All".into());
+    let t = std::time::Instant::now();
+    let order = show_order(&p);
+    assert_eq!(order.len(), 20_000);
+    assert_eq!(order[0], 19_999);
+    assert!(t.elapsed().as_secs() < 5);
+}
+
+#[test]
+fn timeline_targets_the_first_shape_with_a_duplicate_id() {
+    let mut s = slide_with(vec![anim(7, AnimClass::Entrance, "fade", AnimStart::OnClick)]);
+    s.shapes[0] = shape(7, "first");
+    s.shapes[1] = shape(7, "second");
+    s.shapes[0].xfrm = Some(Xfrm::new(10.0, 10.0, 20.0, 20.0));
+    let tl = Timeline::new(&s, W, H);
+    assert_eq!(tl.effects().len(), 1);
+    assert_eq!(tl.steps(), 1);
+}
+
+#[test]
+fn many_by_paragraph_animations_on_one_shape_share_paragraph_targets() {
+    let mut s = slide_with(vec![]);
+    s.shapes[0].text = Some(TextBody::from_text("one\ntwo\nthree"));
+    s.animations = (0..2_000)
+        .map(|_| {
+            let mut a = anim(1, AnimClass::Path, "customPath", AnimStart::OnClick);
+            a.text_build = TextBuild::ByParagraph;
+            a.path = Some("M 0 0 L 0.5 0.5 E".into());
+            a
+        })
+        .collect();
+    let tl = Timeline::new(&s, W, H);
+    assert_eq!(tl.effects().len(), 6_000);
+    assert_eq!(tl.paragraph_targets(ShapeId(1)), vec![0, 1, 2]);
+}

crates/anim/src/tests_interact.rs

@@ -6,7 +6,7 @@ use std::sync::Arc;
 use deckcraft_model::text::Action;
 use deckcraft_model::{AnimClass, AnimStart, Animation, Presentation, Shape, ShapeId, Slide, SlideId, Transition, Xfrm};
 
-use crate::*;
+use crate::{Click, HitShape, LinkJump, ShowAction, ShowState, Target, Timeline};
 
 fn shape(id: u32) -> Shape {
     Shape { id: ShapeId(id), name: format!("S{id}"), xfrm: Some(Xfrm::new(100.0, 100.0, 200.0, 100.0)), ..Default::default() }

crates/anim/src/timeline.rs

@@ -1,10 +1,11 @@
 //! A slide's animation sequence: click steps, effect start times and per-shape state over time.
 
 use std::collections::{HashMap, HashSet};
+use std::sync::Arc;
 
-use deckcraft_model::anim::TextBuild;
+use deckcraft_model::anim::{BuildRole, TextBuild, paragraph_build_roles};
 use deckcraft_model::style::Fill;
-use deckcraft_model::{AnimClass, AnimStart, Animation, ColorScheme, Rgba, SchemeSlot, ShapeId, Slide, Xfrm};
+use deckcraft_model::{AnimClass, AnimStart, Animation, ColorScheme, Rgba, SchemeSlot, Shape, ShapeId, Slide, Xfrm};
 
 use crate::AnimState;
 use crate::effects::{EffectSpec, exit_base, motion_path};
@@ -12,7 +13,6 @@ use crate::effects::{EffectSpec, exit_base, motion_path};
 /// Delay between paragraphs of a by-paragraph build that isn't on click (seconds).
 pub const PARAGRAPH_STAGGER: f64 = 0.5;
 const MAX_EFFECTS: usize = 100_000;
-const MAX_PARAGRAPHS: usize = 1_000;
 const MAX_ITERATIONS: f64 = 1.0e6;
 
 /// Which sequence an effect belongs to.
@@ -86,7 +86,9 @@ enum After {
 #[derive(Clone, Debug)]
 struct Effect {
     timing: EffectTiming,
-    spec: EffectSpec,
+    /// Shared by every paragraph effect of one animation, so a large motion path is not copied
+    /// per paragraph.
+    spec: Arc<EffectSpec>,
     after: After,
 }
 
@@ -163,6 +165,14 @@ impl Timeline {
         let accent = scheme.map(|s| s.get(SchemeSlot::Accent1)).unwrap_or(Rgba::rgb(0x15, 0x60, 0x82));
 
         let mut tl = Timeline::default();
+        if slide.animations.is_empty() {
+            return tl;
+        }
+        // Every shape by id, built once: resolving each animation's target by tree search would
+        // cost shapes x animations.
+        let shapes = shape_index(&slide.shapes);
+        // Paragraph targets of each shape, worked out for its first by-paragraph animation only.
+        let mut para_cache: HashMap<ShapeId, Arc<Vec<Option<usize>>>> = HashMap::new();
         // Group the animations by sequence in one pass, sequences in order of first appearance
         // (main first), so many distinct triggers cost linear work, not a scan per trigger.
         let mut seqs: Vec<(Sequence, Vec<usize>)> = vec![(Sequence::Main, Vec::new())];
@@ -191,34 +201,38 @@ impl Timeline {
                 if tl.effects.len() >= MAX_EFFECTS {
                     break;
                 }
-                let shape = slide.shape(a.shape);
+                let shape = shapes.get(&a.shape).copied();
                 // Paragraph targets of this animation.
-                let paras: Vec<Option<usize>> = match (a.paragraph, a.text_build) {
-                    (Some(p), _) => vec![Some(p as usize)],
+                let paras: Arc<Vec<Option<usize>>> = match (a.paragraph, a.text_build) {
+                    (Some(p), _) => Arc::new(vec![Some(p as usize)]),
                     (None, TextBuild::ByParagraph) => {
-                        let mut v: Vec<Option<usize>> = vec![];
-                        if let Some(t) = shape.and_then(|s| s.text.as_ref()) {
-                            let filled = |p: &deckcraft_model::text::Paragraph| p.runs.iter().any(|r| !r.text.trim().is_empty());
-                            let top = t.paragraphs.iter().filter(|p| filled(p)).map(|p| p.level).min().unwrap_or(0);
-                            let mut owner: Option<usize> = None;
-                            for (i, p) in t.paragraphs.iter().enumerate() {
-                                if p.level <= top && filled(p) && v.len() < MAX_PARAGRAPHS {
-                                    owner = Some(i);
-                                    v.push(Some(i));
-                                } else if let Some(o) = owner
-                                    && grouped.insert((a.shape, i, o))
-                                {
-                                    tl.groups.push((a.shape, i, o));
+                        let cached = para_cache.entry(a.shape).or_insert_with(|| {
+                            let mut v: Vec<Option<usize>> = vec![];
+                            if let Some(t) = shape.and_then(|s| s.text.as_ref()) {
+                                for (i, role) in paragraph_build_roles(t).into_iter().enumerate() {
+                                    match role {
+                                        BuildRole::Top => v.push(Some(i)),
+                                        BuildRole::Member(o) => {
+                                            if grouped.insert((a.shape, i, o)) {
+                                                tl.groups.push((a.shape, i, o));
+                                            }
+                                        }
+                                        BuildRole::Unowned => {}
+                                    }
                                 }
                             }
-                        }
-                        if v.is_empty() { vec![None] } else { v }
+                            if v.is_empty() {
+                                v.push(None)
+                            }
+                            Arc::new(v)
+                        });
+                        Arc::clone(cached)
                     }
-                    _ => vec![None],
+                    _ => Arc::new(vec![None]),
                 };
                 let xf = xfrm_of(a.shape).or_else(|| shape.and_then(|s| s.xfrm)).unwrap_or(Xfrm::new(sw / 4.0, sh / 4.0, sw / 2.0, sh / 2.0));
                 let xf = sanitize_xfrm(xf, sw, sh);
-                let spec = build_spec(a, xf, sw, sh, &resolve);
+                let spec = Arc::new(build_spec(a, xf, sw, sh, &resolve));
                 let dur = secs(a.duration_ms);
                 let delay = secs(a.delay_ms);
                 let until_next_click = a.repeat == u32::MAX;
@@ -287,7 +301,7 @@ impl Timeline {
                             span,
                             class: a.class,
                         },
-                        spec: spec.clone(),
+                        spec: Arc::clone(&spec),
                         after: after.clone(),
                     });
                 }
@@ -298,12 +312,13 @@ impl Timeline {
             }
         }
         // Base colours of animated shapes.
+        let mut colored: HashSet<ShapeId> = HashSet::new();
         for e in &tl.effects {
             let id = e.timing.shape;
-            if tl.colors.iter().any(|(s, _)| *s == id) {
+            if !colored.insert(id) {
                 continue;
             }
-            let c = match slide.shape(id).and_then(|s| s.fill.as_ref()) {
+            let c = match shapes.get(&id).copied().and_then(|s| s.fill.as_ref()) {
                 Some(Fill::Solid { color }) => resolve(color),
                 _ => accent,
             };
@@ -536,6 +551,23 @@ fn status(e: &EffectTiming, step: usize, t: f64) -> Status {
     Status::Active(p.clamp(0.0, 1.0))
 }
 
+/// Shapes by id in the order `Slide::shape` searches (a shape before its children, groups at most
+/// 64 deep); the first shape with an id wins a duplicate.
+fn shape_index(shapes: &[Shape]) -> HashMap<ShapeId, &Shape> {
+    fn walk<'a>(shapes: &'a [Shape], depth: usize, out: &mut HashMap<ShapeId, &'a Shape>) {
+        if depth > 64 {
+            return;
+        }
+        for s in shapes {
+            out.entry(s.id).or_insert(s);
+            walk(s.children(), depth + 1, out);
+        }
+    }
+    let mut out = HashMap::new();
+    walk(shapes, 0, &mut out);
+    out
+}
+
 fn build_spec(a: &Animation, xf: Xfrm, sw: f64, sh: f64, resolve: &dyn Fn(&deckcraft_model::ColorRef) -> Rgba) -> EffectSpec {
     let effect = if a.class == AnimClass::Exit { exit_base(&a.effect).to_string() } else { a.effect.clone() };
     let path = if a.class == AnimClass::Path { Some(motion_path(&a.effect, &a.option, a.path.as_deref())) } else { None };

crates/anim/src/transition_fx.rs

@@ -9,7 +9,10 @@ use std::f64::consts::PI;
 
 use crate::easing::ease;
 use crate::transition::{FULL, Layer, R, Source};
-use crate::transition_geom::*;
+use crate::transition_geom::{
+    Cam, V3, boundary, card, center, clip, dir, edge, ein, eout, facing_shade, fan, field, hash64, moved, offset, poly_layers, pow_inout, q2,
+    rect_poly, rnd, rot, rot_quad, scale_rect, scaled, soft_rect, ss, v3, win,
+};
 
 use Source::{Black, New, NewBack, NewContent, Old, OldBack, OldContent, White};
 

crates/av1/src/cdef.rs

@@ -1,7 +1,7 @@
 //! CDEF (7.15).
 
 use crate::frame::{FrameBuf, Plane};
-use crate::spec_tables::*;
+use crate::spec_tables::{CDEF_DIRECTIONS, CDEF_PRI_TAPS, CDEF_SEC_TAPS, CDEF_UV_DIR, DIV_TABLE};
 use crate::state::FrameState;
 
 /// Run CDEF on `fs.cur`; returns the CdefFrame, or None when no block is filtered (CdefFrame
@@ -242,14 +242,14 @@ fn filter_rows<const W: usize>(
     }
     for i in 0..h {
         let ci = ((i + 2) * PAD_STRIDE + 2) as isize;
-        let Some(&x) = b16.get(ci as usize..).and_then(|r| r.first_chunk::<W>()) else {
+        let Some(&x) = b16.get(ci as usize..).and_then(<[_]>::first_chunk::<W>) else {
             return;
         };
         let (mut sum, mut max, mut min) = ([0i16; W], x, x);
         for &(off, weight, thr, adj) in taps {
             let (weight, thr) = (weight as i16, thr as i16);
             let start = (ci + off) as usize;
-            let Some(p) = b16.get(start..).and_then(|r| r.first_chunk::<W>()) else {
+            let Some(p) = b16.get(start..).and_then(<[_]>::first_chunk::<W>) else {
                 return;
             };
             for j in 0..W {

crates/av1/src/cdf.rs

@@ -1,6 +1,26 @@
 //! The adaptive CDF arrays (spec 6.8.2 init_non_coeff_cdfs / init_coeff_cdfs, load_cdfs).
 
-use crate::spec_tables::*;
+use crate::spec_tables::{
+    DEFAULT_ANGLE_DELTA_CDF, DEFAULT_CFL_ALPHA_CDF, DEFAULT_CFL_SIGN_CDF, DEFAULT_COEFF_BASE_CDF, DEFAULT_COEFF_BASE_EOB_CDF, DEFAULT_COEFF_BR_CDF,
+    DEFAULT_COMP_BWD_REF_CDF, DEFAULT_COMP_GROUP_IDX_CDF, DEFAULT_COMP_MODE_CDF, DEFAULT_COMP_REF_CDF, DEFAULT_COMP_REF_TYPE_CDF,
+    DEFAULT_COMPOUND_IDX_CDF, DEFAULT_COMPOUND_MODE_CDF, DEFAULT_COMPOUND_TYPE_CDF, DEFAULT_DC_SIGN_CDF, DEFAULT_DELTA_LF_CDF, DEFAULT_DELTA_Q_CDF,
+    DEFAULT_DRL_MODE_CDF, DEFAULT_EOB_EXTRA_CDF, DEFAULT_EOB_PT_16_CDF, DEFAULT_EOB_PT_32_CDF, DEFAULT_EOB_PT_64_CDF, DEFAULT_EOB_PT_128_CDF,
+    DEFAULT_EOB_PT_256_CDF, DEFAULT_EOB_PT_512_CDF, DEFAULT_EOB_PT_1024_CDF, DEFAULT_FILTER_INTRA_CDF, DEFAULT_FILTER_INTRA_MODE_CDF,
+    DEFAULT_INTER_INTRA_CDF, DEFAULT_INTER_INTRA_MODE_CDF, DEFAULT_INTER_TX_TYPE_SET1_CDF, DEFAULT_INTER_TX_TYPE_SET2_CDF,
+    DEFAULT_INTER_TX_TYPE_SET3_CDF, DEFAULT_INTERP_FILTER_CDF, DEFAULT_INTRA_TX_TYPE_SET1_CDF, DEFAULT_INTRA_TX_TYPE_SET2_CDF, DEFAULT_INTRABC_CDF,
+    DEFAULT_IS_INTER_CDF, DEFAULT_MOTION_MODE_CDF, DEFAULT_MV_BIT_CDF, DEFAULT_MV_CLASS_CDF, DEFAULT_MV_CLASS0_BIT_CDF, DEFAULT_MV_CLASS0_FR_CDF,
+    DEFAULT_MV_CLASS0_HP_CDF, DEFAULT_MV_FR_CDF, DEFAULT_MV_HP_CDF, DEFAULT_MV_JOINT_CDF, DEFAULT_MV_SIGN_CDF, DEFAULT_NEW_MV_CDF,
+    DEFAULT_PALETTE_SIZE_2_UV_COLOR_CDF, DEFAULT_PALETTE_SIZE_2_Y_COLOR_CDF, DEFAULT_PALETTE_SIZE_3_UV_COLOR_CDF, DEFAULT_PALETTE_SIZE_3_Y_COLOR_CDF,
+    DEFAULT_PALETTE_SIZE_4_UV_COLOR_CDF, DEFAULT_PALETTE_SIZE_4_Y_COLOR_CDF, DEFAULT_PALETTE_SIZE_5_UV_COLOR_CDF, DEFAULT_PALETTE_SIZE_5_Y_COLOR_CDF,
+    DEFAULT_PALETTE_SIZE_6_UV_COLOR_CDF, DEFAULT_PALETTE_SIZE_6_Y_COLOR_CDF, DEFAULT_PALETTE_SIZE_7_UV_COLOR_CDF, DEFAULT_PALETTE_SIZE_7_Y_COLOR_CDF,
+    DEFAULT_PALETTE_SIZE_8_UV_COLOR_CDF, DEFAULT_PALETTE_SIZE_8_Y_COLOR_CDF, DEFAULT_PALETTE_UV_MODE_CDF, DEFAULT_PALETTE_UV_SIZE_CDF,
+    DEFAULT_PALETTE_Y_MODE_CDF, DEFAULT_PALETTE_Y_SIZE_CDF, DEFAULT_PARTITION_W8_CDF, DEFAULT_PARTITION_W16_CDF, DEFAULT_PARTITION_W32_CDF,
+    DEFAULT_PARTITION_W64_CDF, DEFAULT_PARTITION_W128_CDF, DEFAULT_REF_MV_CDF, DEFAULT_RESTORATION_TYPE_CDF, DEFAULT_SEGMENT_ID_CDF,
+    DEFAULT_SEGMENT_ID_PREDICTED_CDF, DEFAULT_SINGLE_REF_CDF, DEFAULT_SKIP_CDF, DEFAULT_SKIP_MODE_CDF, DEFAULT_TX_8X8_CDF, DEFAULT_TX_16X16_CDF,
+    DEFAULT_TX_32X32_CDF, DEFAULT_TX_64X64_CDF, DEFAULT_TXB_SKIP_CDF, DEFAULT_TXFM_SPLIT_CDF, DEFAULT_UNI_COMP_REF_CDF, DEFAULT_USE_OBMC_CDF,
+    DEFAULT_USE_SGRPROJ_CDF, DEFAULT_USE_WIENER_CDF, DEFAULT_UV_MODE_CFL_ALLOWED_CDF, DEFAULT_UV_MODE_CFL_NOT_ALLOWED_CDF, DEFAULT_WEDGE_INDEX_CDF,
+    DEFAULT_WEDGE_INTER_INTRA_CDF, DEFAULT_Y_MODE_CDF, DEFAULT_ZERO_MV_CDF, FRAME_LF_COUNT, MV_CONTEXTS,
+};
 
 /// Every CDF array listed by init_non_coeff_cdfs and init_coeff_cdfs. Each innermost array holds
 /// N cumulative values (the last is 32768) plus the adaptation counter.

crates/av1/src/decoder.rs

@@ -17,7 +17,11 @@ use crate::cdf::Cdfs;
 use crate::frame::FrameBuf;
 use crate::header::{FilmGrainParams, FrameHeader, HeaderState, LoopFilterDeltas, RefInfo, SegmentationFeatures, SequenceHeader, default_gm_params};
 use crate::par::Pool;
-use crate::spec_tables::*;
+use crate::spec_tables::{
+    ALTREF_FRAME, ALTREF2_FRAME, BWDREF_FRAME, DEFAULT_INTRA_FRAME_Y_MODE_CDF, DIV_MULT, GOLDEN_FRAME, INTRA_FRAME, INTRA_ONLY_FRAME, KEY_FRAME,
+    LAST_FRAME, LAST2_FRAME, MAX_FRAME_DISTANCE, MAX_OFFSET_HEIGHT, MAX_OFFSET_WIDTH, MFMV_STACK_SIZE, NUM_REF_FRAMES, PRIMARY_REF_NONE,
+    REFMVS_LIMIT, REFS_PER_FRAME,
+};
 use crate::state::{FrameShared, FrameState, TileState};
 use crate::stats::{DecodeStats, Stage, Timer};
 use crate::tile::TileDecoder;
@@ -61,7 +65,7 @@ impl<T: Clone> Slot<T> {
     }
 
     fn set(&self, v: Result<T>) {
-        let mut g = self.value.lock().unwrap_or_else(|e| e.into_inner());
+        let mut g = self.value.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
         *g = Some(v);
         self.cv.notify_all();
     }
@@ -71,12 +75,12 @@ impl<T: Clone> Slot<T> {
     }
 
     fn wait(&self) -> Result<T> {
-        let mut g = self.value.lock().unwrap_or_else(|e| e.into_inner());
+        let mut g = self.value.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
         loop {
             if let Some(v) = g.as_ref() {
                 return v.clone();
             }
-            g = self.cv.wait(g).unwrap_or_else(|e| e.into_inner());
+            g = self.cv.wait(g).unwrap_or_else(std::sync::PoisonError::into_inner);
         }
     }
 }
@@ -462,6 +466,9 @@ impl Decoder {
                     let mut r = BitReader::new(payload);
                     let shown = self.frame_header(&mut r, temporal_id, spatial_id)?;
                     if let Some(o) = shown {
+                        if out.iter().filter(|(o, _, _)| matches!(o, Output::Existing { .. })).count() >= 32 {
+                            return Err(Error::Invalid("too many frame outputs in chunk"));
+                        }
                         out.push((o, tu, spatial_id));
                         continue;
                     }

crates/av1/src/frame.rs

@@ -16,7 +16,7 @@ const POOL_MAX_SAMPLES: usize = 96 << 20;
 fn zeroed(len: usize) -> Vec<u16> {
     if len >= POOL_MIN_LEN {
         let found = {
-            let mut pool = PLANE_POOL.lock().unwrap_or_else(|e| e.into_inner());
+            let mut pool = PLANE_POOL.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
             pool.iter().position(|v| v.capacity() >= len && v.capacity() <= 2 * len).map(|i| pool.swap_remove(i))
         };
         if let Some(mut v) = found {
@@ -52,8 +52,8 @@ impl Drop for Plane {
     fn drop(&mut self) {
         if self.data.capacity() >= POOL_MIN_LEN {
             let v = std::mem::take(&mut self.data);
-            let mut pool = PLANE_POOL.lock().unwrap_or_else(|e| e.into_inner());
-            let kept: usize = pool.iter().map(|b| b.capacity()).sum();
+            let mut pool = PLANE_POOL.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
+            let kept: usize = pool.iter().map(Vec::capacity).sum();
             if kept + v.capacity() <= POOL_MAX_SAMPLES {
                 pool.push(v);
             }

crates/av1/src/header.rs

@@ -1,7 +1,14 @@
 //! Sequence header (5.5) and uncompressed frame header (5.9) parsing.
 
 use crate::bits::BitReader;
-use crate::spec_tables::*;
+use crate::spec_tables::{
+    AFFINE, ALTREF_FRAME, ALTREF2_FRAME, BWDREF_FRAME, GM_ABS_ALPHA_BITS, GM_ABS_TRANS_BITS, GM_ABS_TRANS_ONLY_BITS, GM_ALPHA_PREC_BITS,
+    GM_TRANS_ONLY_PREC_BITS, GM_TRANS_PREC_BITS, GOLDEN_FRAME, IDENTITY, INTER_FRAME, INTRA_ONLY_FRAME, KEY_FRAME, LAST_FRAME, MAX_SEGMENTS,
+    MAX_TILE_AREA, MAX_TILE_COLS, MAX_TILE_ROWS, MAX_TILE_WIDTH, NUM_REF_FRAMES, ONLY_4X4, PRIMARY_REF_NONE, REF_FRAME_LIST, REFS_PER_FRAME,
+    RESTORATION_TILESIZE_MAX, RESTORE_NONE, RESTORE_SGRPROJ, RESTORE_SWITCHABLE, RESTORE_WIENER, ROTZOOM, SEG_LVL_ALT_Q, SEG_LVL_MAX,
+    SEG_LVL_REF_FRAME, SELECT_INTEGER_MV, SELECT_SCREEN_CONTENT_TOOLS, SUPERRES_DENOM_BITS, SUPERRES_DENOM_MIN, SUPERRES_NUM, SWITCH_FRAME,
+    TOTAL_REFS_PER_FRAME, TRANSLATION, TX_MODE_LARGEST, TX_MODE_SELECT, WARPEDMODEL_PREC_BITS,
+};
 use crate::{Error, Result};
 
 pub const EIGHTTAP: u8 = 0;
@@ -899,6 +906,9 @@ impl FrameHeader {
             let mut widest = 0;
             let mut start = 0;
             while start < sb_cols {
+                if t.mi_col_starts.len() >= MAX_TILE_COLS {
+                    return Err(Error::Invalid("tile_cols exceeds MAX_TILE_COLS"));
+                }
                 t.mi_col_starts.push(start << sb_shift);
                 let max_width = (sb_cols - start).min(max_tile_width_sb);
                 let size = r.ns(max_width)? + 1;
@@ -916,6 +926,9 @@ impl FrameHeader {
             let max_tile_height_sb = (max_tile_area_sb / widest.max(1)).max(1);
             let mut start = 0;
             while start < sb_rows {
+                if t.mi_row_starts.len() >= MAX_TILE_ROWS {
+                    return Err(Error::Invalid("tile_rows exceeds MAX_TILE_ROWS"));
+                }
                 t.mi_row_starts.push(start << sb_shift);
                 let max_height = (sb_rows - start).min(max_tile_height_sb);
                 let size = r.ns(max_height)? + 1;

crates/av1/src/inter.rs

@@ -5,7 +5,16 @@ use std::sync::OnceLock;
 
 use crate::frame::Plane;
 use crate::mvpred::round2_signed64;
-use crate::spec_tables::*;
+use crate::spec_tables::{
+    BLOCK_8X8, BLOCK_SIZES, COMPOUND_AVERAGE, COMPOUND_DIFFWTD, COMPOUND_DISTANCE, COMPOUND_INTRA, COMPOUND_WEDGE, DIV_LUT, DIV_LUT_BITS,
+    DIV_LUT_PREC_BITS, EIGHTTAP, EIGHTTAP_SHARP, EIGHTTAP_SMOOTH, FILTER_BITS, GLOBAL_GLOBALMV, GLOBALMV, II_H_PRED, II_SMOOTH_PRED, II_V_PRED,
+    II_WEIGHTS_1D, INTRA_FRAME, LAST_FRAME, LOCALWARP, LS_MV_MAX, MASK_MASTER_SIZE, MAX_FRAME_DISTANCE, MAX_SB_SIZE, MI_HEIGHT_LOG2, MI_WIDTH_LOG2,
+    NUM_4X4_BLOCKS_HIGH, NUM_4X4_BLOCKS_WIDE, OBMC, OBMC_MASK_2, OBMC_MASK_4, OBMC_MASK_8, OBMC_MASK_16, OBMC_MASK_32, QUANT_DIST_LOOKUP,
+    QUANT_DIST_WEIGHT, REF_SCALE_SHIFT, SCALE_SUBPEL_BITS, SUBPEL_BITS, SUBPEL_FILTERS, SUBPEL_MASK, TRANSLATION, WARP_PARAM_REDUCE_BITS,
+    WARPED_FILTERS, WARPEDDIFF_PREC_BITS, WARPEDMODEL_NONDIAGAFFINE_CLAMP, WARPEDMODEL_PREC_BITS, WARPEDMODEL_TRANS_CLAMP, WARPEDPIXEL_PREC_SHIFTS,
+    WEDGE_BITS, WEDGE_CODEBOOK, WEDGE_HORIZONTAL, WEDGE_MASTER_OBLIQUE_EVEN, WEDGE_MASTER_OBLIQUE_ODD, WEDGE_MASTER_VERTICAL, WEDGE_OBLIQUE27,
+    WEDGE_OBLIQUE63, WEDGE_OBLIQUE117, WEDGE_OBLIQUE153, WEDGE_TYPES, WEDGE_VERTICAL,
+};
 use crate::tile::TileDecoder;
 
 const PRED_STRIDE: usize = 128;
@@ -678,7 +687,7 @@ fn hpass<const W: usize>(src: &[u16], hf: &[i16; 8], out: &mut [i32], half: i32,
     let mut acc = [half; W];
     for t in 0..8 {
         let f = hf[t] as i32;
-        let Some(p) = src.get(t..).and_then(|s| s.first_chunk::<W>()) else {
+        let Some(p) = src.get(t..).and_then(<[_]>::first_chunk::<W>) else {
             return;
         };
         for j in 0..W {
@@ -699,7 +708,7 @@ fn vpass<const W: usize>(rows: &[i32], vf: &[i16; 8], out: &mut [i32], half: i32
     let mut acc = [half; W];
     for t in 0..8 {
         let f = vf[t] as i32;
-        let Some(p) = rows.get(t * W..).and_then(|s| s.first_chunk::<W>()) else {
+        let Some(p) = rows.get(t * W..).and_then(<[_]>::first_chunk::<W>) else {
             return;
         };
         for j in 0..W {

crates/av1/src/inter_info.rs

@@ -3,7 +3,14 @@
 use crate::Result;
 use crate::header::{EIGHTTAP, SWITCHABLE};
 use crate::mvpred::MvP;
-use crate::spec_tables::*;
+use crate::spec_tables::{
+    ALTREF_FRAME, ALTREF2_FRAME, BLOCK_8X8, BLOCK_32X32, BLOCK_64X64, BLOCK_128X128, BWDREF_FRAME, CLASS0_SIZE, COMP_NEWMV_CTXS, COMPOUND_AVERAGE,
+    COMPOUND_DIFFWTD, COMPOUND_DISTANCE, COMPOUND_INTRA, COMPOUND_MODE_CTX_MAP, COMPOUND_REFERENCE, COMPOUND_WEDGE, GLOBAL_GLOBALMV, GLOBALMV,
+    GOLDEN_FRAME, INTRA_FRAME, INTRABC_DELAY_PIXELS, LAST_FRAME, LAST2_FRAME, LAST3_FRAME, LOCALWARP, MV_CLASS_0, MV_INTRABC_CONTEXT,
+    MV_JOINT_HNZVNZ, MV_JOINT_HNZVZ, MV_JOINT_HZVNZ, NEAR_NEARMV, NEAR_NEWMV, NEAREST_NEARESTMV, NEAREST_NEWMV, NEARESTMV, NEARMV, NEW_NEARESTMV,
+    NEW_NEARMV, NEW_NEWMV, NEWMV, NUM_4X4_BLOCKS_HIGH, NUM_4X4_BLOCKS_WIDE, OBMC, REF_SCALE_SHIFT, SEG_LVL_GLOBALMV, SEG_LVL_REF_FRAME, SEG_LVL_SKIP,
+    SIMPLE, SINGLE_REFERENCE, SIZE_GROUP, TRANSLATION, UNIDIR_COMP_REFERENCE, UV_CFL_PRED, WEDGE_BITS,
+};
 use crate::tile::TileDecoder;
 
 fn block_width(bs: usize) -> usize {

crates/av1/src/intra.rs

@@ -1,7 +1,11 @@
 //! Intra prediction (spec 7.11.2), palette prediction (7.11.4) and chroma from luma (7.11.5).
 
 use crate::frame::Plane;
-use crate::spec_tables::*;
+use crate::spec_tables::{
+    ANGLE_STEP, D67_PRED, DC_PRED, DR_INTRA_DERIVATIVE, INTRA_EDGE_KERNEL, INTRA_EDGE_TAPS, INTRA_FILTER_SCALE_BITS, INTRA_FILTER_TAPS,
+    MODE_TO_ANGLE, SM_WEIGHTS_TX_4X4, SM_WEIGHTS_TX_8X8, SM_WEIGHTS_TX_16X16, SM_WEIGHTS_TX_32X32, SM_WEIGHTS_TX_64X64, SMOOTH_H_PRED, SMOOTH_PRED,
+    SMOOTH_V_PRED, V_PRED,
+};
 use crate::transform::round2;
 
 /// Inputs of the intra prediction process that come from the block.

crates/av1/src/mvpred.rs

@@ -1,7 +1,10 @@
 //! Motion vector prediction processes (spec 7.10): find_mv_stack, has_overlappable_candidates
 //! and find_warp_samples.
 
-use crate::spec_tables::*;
+use crate::spec_tables::{
+    GLOBAL_GLOBALMV, GLOBALMV, IDENTITY, INTRA_FRAME, LEAST_SQUARES_SAMPLES_MAX, MAX_REF_MV_STACK_SIZE, MV_BORDER, NEAR_NEWMV, NEAREST_NEWMV,
+    NEW_NEARESTMV, NEW_NEARMV, NEW_NEWMV, NEWMV, NUM_4X4_BLOCKS_HIGH, NUM_4X4_BLOCKS_WIDE, REF_CAT_LEVEL, TRANSLATION, WARPEDMODEL_PREC_BITS,
+};
 use crate::tile::TileDecoder;
 
 pub(crate) type MvP = [i32; 2];

crates/av1/src/postfilter.rs

@@ -1,7 +1,10 @@
 //! In-loop post filters run by decode_frame_wrapup: loop filter (7.14), CDEF (7.15),
 //! super-resolution upscaling (7.16) and loop restoration (7.17).
 
-use crate::spec_tables::*;
+use crate::spec_tables::{
+    GLOBAL_GLOBALMV, GLOBALMV, INTRA_FRAME, MAX_LOOP_FILTER, NEARESTMV, NUM_4X4_BLOCKS_HIGH, NUM_4X4_BLOCKS_WIDE, SEG_LVL_ALT_LF_Y_V, TX_HEIGHT,
+    TX_WIDTH,
+};
 use crate::state::FrameState;
 use crate::stats::{DecodeStats, Stage, Timer};
 

crates/av1/src/restoration.rs

@@ -1,7 +1,11 @@
 //! Super-resolution upscaling (7.16) and loop restoration (7.17).
 
 use crate::frame::{FrameBuf, Plane};
-use crate::spec_tables::*;
+use crate::spec_tables::{
+    FILTER_BITS, RESTORE_NONE, RESTORE_SGRPROJ, RESTORE_WIENER, SGR_PARAMS, SGRPROJ_MTABLE_BITS, SGRPROJ_PRJ_BITS, SGRPROJ_RECIP_BITS,
+    SGRPROJ_RST_BITS, SGRPROJ_SGR_BITS, SUPERRES_EXTRA_BITS, SUPERRES_FILTER_OFFSET, SUPERRES_FILTER_TAPS, SUPERRES_SCALE_BITS, SUPERRES_SCALE_MASK,
+    UPSCALE_FILTER,
+};
 use crate::state::FrameState;
 
 /// Upscale a frame horizontally from FrameWidth to UpscaledWidth (7.16).

crates/av1/src/state.rs

@@ -9,7 +9,7 @@
 use crate::decoder::RefFrame;
 use crate::frame::{FrameBuf, MiInfo};
 use crate::header::{FrameHeader, RefInfo, SequenceHeader};
-use crate::spec_tables::*;
+use crate::spec_tables::{DEFAULT_INTRA_FRAME_Y_MODE_CDF, NUM_REF_FRAMES, RESTORE_NONE, SUBSAMPLED_SIZE};
 use std::ops::{Deref, DerefMut};
 use std::sync::Arc;
 

crates/av1/src/tile.rs

@@ -6,7 +6,27 @@ use crate::cdf::Cdfs;
 use crate::frame::{MiInfo, Mv};
 use crate::header::{FrameHeader, NONE, SequenceHeader};
 use crate::intra::{IntraParams, is_directional_mode, predict_intra, round2_signed};
-use crate::spec_tables::*;
+use crate::spec_tables::{
+    AC_QLOOKUP, ADJUSTED_TX_SIZE, ADST_FLIPADST, BLOCK_4X4, BLOCK_8X8, BLOCK_64X64, BLOCK_128X128, BR_CDF_SIZE, CFL_SIGN_NEG, CFL_SIGN_ZERO,
+    COEFF_BASE_CTX_OFFSET, COEFF_BASE_POS_CTX_OFFSET, COEFF_BASE_RANGE, COMPOUND_AVERAGE, DC_PRED, DC_QLOOKUP, DCT_DCT, DCT_FLIPADST,
+    DEFAULT_SCAN_4X4, DEFAULT_SCAN_4X8, DEFAULT_SCAN_4X16, DEFAULT_SCAN_8X4, DEFAULT_SCAN_8X8, DEFAULT_SCAN_8X16, DEFAULT_SCAN_8X32,
+    DEFAULT_SCAN_16X4, DEFAULT_SCAN_16X8, DEFAULT_SCAN_16X16, DEFAULT_SCAN_16X32, DEFAULT_SCAN_32X8, DEFAULT_SCAN_32X16, DEFAULT_SCAN_32X32,
+    DELTA_LF_SMALL, DELTA_Q_SMALL, FILTER_INTRA_MODE_TO_INTRA_DIR, FLIPADST_ADST, FLIPADST_DCT, FLIPADST_FLIPADST, FRAME_LF_COUNT, H_ADST, H_DCT,
+    H_FLIPADST, H_PRED, IDTX, II_DC_PRED, II_H_PRED, II_V_PRED, INTRA_FRAME, INTRA_MODE_CONTEXT, MAG_REF_OFFSET_WITH_TX_CLASS, MAX_ANGLE_DELTA,
+    MAX_LOOP_FILTER, MAX_TX_DEPTH_TABLE, MAX_TX_SIZE_RECT, MAX_VARTX_DEPTH, MCOL_SCAN_4X4, MCOL_SCAN_4X8, MCOL_SCAN_4X16, MCOL_SCAN_8X4,
+    MCOL_SCAN_8X8, MCOL_SCAN_8X16, MCOL_SCAN_16X4, MCOL_SCAN_16X8, MCOL_SCAN_16X16, MI_HEIGHT_LOG2, MI_WIDTH_LOG2, MODE_TO_TXFM, MROW_SCAN_4X4,
+    MROW_SCAN_4X8, MROW_SCAN_4X16, MROW_SCAN_8X4, MROW_SCAN_8X8, MROW_SCAN_8X16, MROW_SCAN_16X4, MROW_SCAN_16X8, MROW_SCAN_16X16,
+    NUM_4X4_BLOCKS_HIGH, NUM_4X4_BLOCKS_WIDE, NUM_BASE_LEVELS, PALETTE_COLOR_CONTEXT, PALETTE_COLOR_HASH_MULTIPLIERS, PALETTE_COLORS,
+    PALETTE_NUM_NEIGHBORS, PARTITION_HORZ, PARTITION_HORZ_4, PARTITION_HORZ_A, PARTITION_HORZ_B, PARTITION_NONE, PARTITION_SPLIT, PARTITION_SUBSIZE,
+    PARTITION_VERT, PARTITION_VERT_4, PARTITION_VERT_A, PARTITION_VERT_B, QM_OFFSET, QUANTIZER_MATRIX, RESTORE_NONE, RESTORE_SGRPROJ, RESTORE_WIENER,
+    SEG_LVL_SKIP, SGR_PARAMS, SGRPROJ_PARAMS_BITS, SGRPROJ_PRJ_BITS, SGRPROJ_PRJ_SUBEXP_K, SIG_REF_DIFF_OFFSET, SIG_REF_DIFF_OFFSET_NUM, SIMPLE,
+    SMOOTH_H_PRED, SMOOTH_PRED, SMOOTH_V_PRED, SPLIT_TX_SIZE, SUPERRES_NUM, TX_4X4, TX_4X8, TX_4X16, TX_8X4, TX_8X8, TX_8X16, TX_8X32, TX_16X4,
+    TX_16X8, TX_16X16, TX_16X32, TX_16X64, TX_32X8, TX_32X16, TX_32X32, TX_32X64, TX_64X16, TX_64X32, TX_64X64, TX_CLASS_2D, TX_CLASS_HORIZ,
+    TX_CLASS_VERT, TX_HEIGHT, TX_HEIGHT_LOG2, TX_MODE_SELECT, TX_SET_DCTONLY, TX_SET_INTER_1, TX_SET_INTER_2, TX_SET_INTER_3, TX_SET_INTRA_1,
+    TX_SET_INTRA_2, TX_SIZE_SQR, TX_SIZE_SQR_UP, TX_SIZES, TX_SIZES_ALL, TX_TYPE_IN_SET_INTER, TX_TYPE_IN_SET_INTRA, TX_TYPE_INTER_INV_SET1,
+    TX_TYPE_INTER_INV_SET2, TX_TYPE_INTER_INV_SET3, TX_TYPE_INTRA_INV_SET1, TX_TYPE_INTRA_INV_SET2, TX_WIDTH, TX_WIDTH_LOG2, UV_CFL_PRED, V_ADST,
+    V_DCT, V_FLIPADST, V_PRED,
+};
 use crate::state::{FrameShared, TileState};
 use crate::symbol::SymbolDecoder;
 use crate::transform::inverse_transform_2d;

crates/av1/src/transform.rs

@@ -1,6 +1,9 @@
 //! Inverse transforms (spec 7.13), implemented step by step as specified.
 
-use crate::spec_tables::*;
+use crate::spec_tables::{
+    ADST_ADST, ADST_DCT, ADST_FLIPADST, COS128_LOOKUP, DCT_ADST, DCT_DCT, DCT_FLIPADST, FLIPADST_ADST, FLIPADST_DCT, FLIPADST_FLIPADST, H_ADST,
+    H_DCT, H_FLIPADST, TRANSFORM_ROW_SHIFT, TX_HEIGHT_LOG2, TX_WIDTH_LOG2, V_ADST, V_DCT, V_FLIPADST,
+};
 
 #[inline(always)]
 fn round2_64(x: i64, n: u32) -> i32 {

crates/color/src/lib.rs

@@ -34,7 +34,8 @@ impl Rgba {
     }
     /// `RRGGBB` or `#RRGGBB` (also `RRGGBBAA`).
     pub fn from_hex(s: &str) -> Option<Self> {
-        let s = s.trim().trim_start_matches('#');
+        let s = s.trim();
+        let s = s.strip_prefix('#').unwrap_or(s);
         if !s.bytes().all(|b| b.is_ascii_hexdigit()) {
             return None;
         }
@@ -515,10 +516,257 @@ pub fn preset(name: &str) -> Option<Rgba> {
     Some(Rgba::rgb(c.0, c.1, c.2))
 }
 
+/// Every preset colour name a file may write (`ST_PresetColorVal`, with the later editions' aliases).
+pub const PRESET_NAMES: [&str; 190] = [
+    "aliceBlue",
+    "antiqueWhite",
+    "aqua",
+    "aquamarine",
+    "azure",
+    "beige",
+    "bisque",
+    "black",
+    "blanchedAlmond",
+    "blue",
+    "blueViolet",
+    "brown",
+    "burlyWood",
+    "cadetBlue",
+    "chartreuse",
+    "chocolate",
+    "coral",
+    "cornflowerBlue",
+    "cornsilk",
+    "crimson",
+    "cyan",
+    "darkBlue",
+    "darkCyan",
+    "darkGoldenrod",
+    "darkGray",
+    "darkGrey",
+    "darkGreen",
+    "darkKhaki",
+    "darkMagenta",
+    "darkOliveGreen",
+    "darkOrange",
+    "darkOrchid",
+    "darkRed",
+    "darkSalmon",
+    "darkSeaGreen",
+    "darkSlateBlue",
+    "darkSlateGray",
+    "darkSlateGrey",
+    "darkTurquoise",
+    "darkViolet",
+    "dkBlue",
+    "dkCyan",
+    "dkGoldenrod",
+    "dkGray",
+    "dkGrey",
+    "dkGreen",
+    "dkKhaki",
+    "dkMagenta",
+    "dkOliveGreen",
+    "dkOrange",
+    "dkOrchid",
+    "dkRed",
+    "dkSalmon",
+    "dkSeaGreen",
+    "dkSlateBlue",
+    "dkSlateGray",
+    "dkSlateGrey",
+    "dkTurquoise",
+    "dkViolet",
+    "deepPink",
+    "deepSkyBlue",
+    "dimGray",
+    "dimGrey",
+    "dodgerBlue",
+    "firebrick",
+    "floralWhite",
+    "forestGreen",
+    "fuchsia",
+    "gainsboro",
+    "ghostWhite",
+    "gold",
+    "goldenrod",
+    "gray",
+    "grey",
+    "green",
+    "greenYellow",
+    "honeydew",
+    "hotPink",
+    "indianRed",
+    "indigo",
+    "ivory",
+    "khaki",
+    "lavender",
+    "lavenderBlush",
+    "lawnGreen",
+    "lemonChiffon",
+    "lightBlue",
+    "lightCoral",
+    "lightCyan",
+    "lightGoldenrodYellow",
+    "lightGray",
+    "lightGrey",
+    "lightGreen",
+    "lightPink",
+    "lightSalmon",
+    "lightSeaGreen",
+    "lightSkyBlue",
+    "lightSlateGray",
+    "lightSlateGrey",
+    "lightSteelBlue",
+    "lightYellow",
+    "ltBlue",
+    "ltCoral",
+    "ltCyan",
+    "ltGoldenrodYellow",
+    "ltGray",
+    "ltGrey",
+    "ltGreen",
+    "ltPink",
+    "ltSalmon",
+    "ltSeaGreen",
+    "ltSkyBlue",
+    "ltSlateGray",
+    "ltSlateGrey",
+    "ltSteelBlue",
+    "ltYellow",
+    "lime",
+    "limeGreen",
+    "linen",
+    "magenta",
+    "maroon",
+    "medAquamarine",
+    "medBlue",
+    "medOrchid",
+    "medPurple",
+    "medSeaGreen",
+    "medSlateBlue",
+    "medSpringGreen",
+    "medTurquoise",
+    "medVioletRed",
+    "mediumAquamarine",
+    "mediumBlue",
+    "mediumOrchid",
+    "mediumPurple",
+    "mediumSeaGreen",
+    "mediumSlateBlue",
+    "mediumSpringGreen",
+    "mediumTurquoise",
+    "mediumVioletRed",
+    "midnightBlue",
+    "mintCream",
+    "mistyRose",
+    "moccasin",
+    "navajoWhite",
+    "navy",
+    "oldLace",
+    "olive",
+    "oliveDrab",
+    "orange",
+    "orangeRed",
+    "orchid",
+    "paleGoldenrod",
+    "paleGreen",
+    "paleTurquoise",
+    "paleVioletRed",
+    "papayaWhip",
+    "peachPuff",
+    "peru",
+    "pink",
+    "plum",
+    "powderBlue",
+    "purple",
+    "red",
+    "rosyBrown",
+    "royalBlue",
+    "saddleBrown",
+    "salmon",
+    "sandyBrown",
+    "seaGreen",
+    "seaShell",
+    "sienna",
+    "silver",
+    "skyBlue",
+    "slateBlue",
+    "slateGray",
+    "slateGrey",
+    "snow",
+    "springGreen",
+    "steelBlue",
+    "tan",
+    "teal",
+    "thistle",
+    "tomato",
+    "turquoise",
+    "violet",
+    "wheat",
+    "white",
+    "whiteSmoke",
+    "yellow",
+    "yellowGreen",
+];
+
+/// Every system colour name a file may write (`ST_SystemColorVal`).
+pub const SYSTEM_NAMES: [&str; 30] = [
+    "scrollBar",
+    "background",
+    "activeCaption",
+    "inactiveCaption",
+    "menu",
+    "window",
+    "windowFrame",
+    "menuText",
+    "windowText",
+    "captionText",
+    "activeBorder",
+    "inactiveBorder",
+    "appWorkspace",
+    "highlight",
+    "highlightText",
+    "btnFace",
+    "btnShadow",
+    "grayText",
+    "btnText",
+    "inactiveCaptionText",
+    "btnHighlight",
+    "3dDkShadow",
+    "3dLight",
+    "infoText",
+    "infoBk",
+    "hotLight",
+    "gradientActiveCaption",
+    "gradientInactiveCaption",
+    "menuHighlight",
+    "menuBar",
+];
+
+/// Whether `name` is a preset colour name a file may write.
+pub fn is_preset_name(name: &str) -> bool {
+    PRESET_NAMES.contains(&name)
+}
+
+/// Whether `name` is a system colour name a file may write.
+pub fn is_system_name(name: &str) -> bool {
+    SYSTEM_NAMES.contains(&name)
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
 
+    #[test]
+    fn from_hex_rejects_multiple_hashes() {
+        assert_eq!(Rgba::from_hex("##FF0000"), None);
+        assert_eq!(Rgba::from_hex("####FF0000"), None);
+        assert_eq!(Rgba::from_hex("#FF0000"), Some(Rgba::rgb(255, 0, 0)));
+        assert_eq!(Rgba::from_hex("FF0000"), Some(Rgba::rgb(255, 0, 0)));
+        assert_eq!(Rgba::from_hex("#FF000080"), Some(Rgba::rgba(255, 0, 0, 128)));
+    }
+
     #[test]
     fn from_hex_rejects_signs() {
         assert_eq!(Rgba::from_hex("+12345"), None);

crates/engine/src/cmd/animation.rs

@@ -5,7 +5,9 @@ use std::sync::Arc;
 use deckcraft_model::anim::{ANIMATIONS, AnimClass, AnimStart, Animation, TextBuild, animation_info};
 use serde_json::{Value, json};
 
-use super::*;
+use super::{
+    CommandSpec, always, bad, bool_or, bool_param, cmd, has_selection, has_slide, id_param, ok, opt_usize_param, str_param, targets, usize_param,
+};
 use crate::{Result, Session};
 
 pub fn specs() -> Vec<CommandSpec> {
@@ -230,7 +232,7 @@ fn add(s: &mut Session, p: &Value) -> Result<Value> {
 }
 
 fn remove(s: &mut Session, p: &Value) -> Result<Value> {
-    let index = usize_param(p, "index");
+    let index = opt_usize_param(p, "index", "animation.remove")?;
     let ids = if index.is_none() { targets(s, p)? } else { vec![] };
     s.edit(|doc, sel| {
         let sl = Arc::make_mut(doc.slides.get_mut(sel.slide).ok_or_else(|| bad("animation.remove", "no slide"))?);
@@ -247,7 +249,7 @@ fn remove(s: &mut Session, p: &Value) -> Result<Value> {
 }
 
 fn move_anim(s: &mut Session, p: &Value) -> Result<Value> {
-    let i = usize_param(p, "index").ok_or_else(|| bad("animation.move", "missing `index`"))?;
+    let i = opt_usize_param(p, "index", "animation.move")?.ok_or_else(|| bad("animation.move", "missing `index`"))?;
     let to = usize_param(p, "to").ok_or_else(|| bad("animation.move", "missing `to`"))?;
     s.edit(|doc, sel| {
         let sl = Arc::make_mut(doc.slides.get_mut(sel.slide).ok_or_else(|| bad("animation.move", "no slide"))?);
@@ -263,7 +265,7 @@ fn move_anim(s: &mut Session, p: &Value) -> Result<Value> {
 }
 
 fn each_target(s: &mut Session, p: &Value, f: impl Fn(&mut Animation)) -> Result<Value> {
-    let index = usize_param(p, "index");
+    let index = opt_usize_param(p, "index", "animation")?;
     let ids = if index.is_none() { targets(s, p)? } else { vec![] };
     s.edit(|doc, sel| {
         let sl = Arc::make_mut(doc.slides.get_mut(sel.slide).ok_or_else(|| bad("animation", "no slide"))?);
@@ -567,4 +569,25 @@ mod tests {
         assert_eq!(triggers(&s), vec![None], "the trigger was inside the deleted group");
         assert_eq!(s.doc().unwrap().current_slide().unwrap().animations.len(), 1);
     }
+
+    #[test]
+    fn invalid_index_is_an_error_not_the_selection() {
+        let mut s = Session::with_new();
+        let r = s.execute("shape.insert", &json!({"preset": "rect", "rect": [10.0, 10.0, 100.0, 100.0]})).unwrap();
+        let id = r.get("id").unwrap().as_u64().unwrap();
+        s.execute("animation.add", &json!({"effect": "fade", "class": "entrance", "ids": [id]})).unwrap();
+        s.select(|_, sel| {
+            sel.shapes = vec![deckcraft_model::ShapeId(id as u32)];
+        })
+        .unwrap();
+        for bad_index in [json!(-1), json!(1.5), json!("x")] {
+            for cmd in ["animation.remove", "animation.timing", "animation.options"] {
+                let r = s.execute(cmd, &json!({"index": bad_index, "duration": 100}));
+                assert!(r.is_err(), "{cmd} accepted index {bad_index}: {r:?}");
+            }
+            let r = s.execute("animation.move", &json!({"index": bad_index, "to": 0}));
+            assert!(r.is_err(), "animation.move accepted index {bad_index}: {r:?}");
+            assert_eq!(s.execute("animation.get", &json!({})).unwrap().as_array().unwrap().len(), 1);
+        }
+    }
 }

crates/engine/src/cmd/arrange.rs

@@ -4,7 +4,10 @@ use deckcraft_geom::{Point, Rect, Xfrm};
 use deckcraft_model::{Shape, ShapeId, ShapeKind};
 use serde_json::{Value, json};
 
-use super::*;
+use super::{
+    CommandSpec, NO_ID_SPACE, bad, bool_or, cmd, edit_geometry, has_doc, has_selection, has_slide, has_two, id_param, ok, str_param, targets,
+    usize_param, with_param, xfrm_of,
+};
 use crate::{Result, Session};
 
 pub fn specs() -> Vec<CommandSpec> {
@@ -171,6 +174,22 @@ pub(crate) fn union_bounds(xs: &[Xfrm]) -> Option<Rect> {
     Some(it.fold(first, |a, b| a.union(b)))
 }
 
+/// How deep groups may nest: as deep as the PPTX reader reads and the renderer draws. A saved
+/// .deckcraft file stops opening at about 39 (the JSON reader's recursion limit), and walks over
+/// the shape tree stop at 64.
+pub const MAX_GROUP_DEPTH: usize = 32;
+
+/// How many groups deep `shapes` nest (0 without groups).
+fn group_depth(shapes: &[Shape]) -> usize {
+    let mut d = 0;
+    deckcraft_model::walk(shapes, &mut |sh, depth| {
+        if sh.is_group() {
+            d = d.max(depth + 1);
+        }
+    });
+    d
+}
+
 fn group(s: &mut Session, p: &Value) -> Result<Value> {
     let ids = targets(s, p)?;
     s.edit(|doc, sel| {
@@ -179,6 +198,9 @@ fn group(s: &mut Session, p: &Value) -> Result<Value> {
         if members.len() < 2 {
             return Err(bad("arrange.group", "select two or more objects on the slide"));
         }
+        if group_depth(&members) + 1 > MAX_GROUP_DEPTH {
+            return Err(bad("arrange.group", format!("groups can be nested at most {MAX_GROUP_DEPTH} deep")));
+        }
         for m in &mut members {
             if m.xfrm.is_none() {
                 m.xfrm = Some(xfrm_of(doc, sel, m));
@@ -322,9 +344,9 @@ fn distribute(s: &mut Session, p: &Value) -> Result<Value> {
     let (start, end) = if to_slide {
         if horiz { (0.0, size.width) } else { (0.0, size.height) }
     } else {
-        let f = boxes.first().map(|b| b.1).unwrap_or_default();
-        let l = boxes.last().map(|b| b.1).unwrap_or_default();
-        if horiz { (f.x0, l.x1) } else { (f.y0, l.y1) }
+        let lo = |f: fn(&Rect) -> f64| boxes.iter().map(|b| f(&b.1)).fold(f64::INFINITY, f64::min);
+        let hi = |f: fn(&Rect) -> f64| boxes.iter().map(|b| f(&b.1)).fold(f64::NEG_INFINITY, f64::max);
+        if horiz { (lo(|r| r.x0), hi(|r| r.x1)) } else { (lo(|r| r.y0), hi(|r| r.y1)) }
     };
     let n = boxes.len();
     let gap = if n > 1 { ((end - start) - total) / (n - 1) as f64 } else { 0.0 };

crates/engine/src/cmd/artistic.rs

@@ -9,7 +9,7 @@ use deckcraft_model::{MediaId, ShapeId, ShapeKind};
 use image::{GrayImage, Rgba, RgbaImage};
 use serde_json::{Value, json};
 
-use super::*;
+use super::{CommandSpec, NO_ID_SPACE, bad, cmd, has_selection, str_param, targets};
 use crate::{Result, Session};
 
 /// The effects offered: `a14` element name and label.

crates/engine/src/cmd/background.rs

@@ -8,7 +8,7 @@ use std::collections::VecDeque;
 use deckcraft_model::{ShapeId, ShapeKind};
 use serde_json::{Value, json};
 
-use super::*;
+use super::{CommandSpec, NO_ID_SPACE, bad, cmd, f64_or, has_selection, targets};
 use crate::{Result, Session};
 
 /// Larger pictures are refused rather than matted slowly (16 megapixels).
@@ -184,7 +184,12 @@ fn remove_background(s: &mut Session, p: &Value) -> Result<Value> {
 
 #[cfg(test)]
 mod tests {
+    use deckcraft_model::{ShapeId, ShapeKind};
+    use serde_json::json;
+
     use super::*;
+    use crate::Session;
+    use crate::cmd::base64_encode;
 
     /// A red disc on a white-to-grey gradient.
     fn disc() -> image::RgbaImage {

crates/engine/src/cmd/color_at_tests.rs

@@ -2,7 +2,7 @@
 
 use serde_json::{Value, json};
 
-use crate::*;
+use crate::Session;
 
 fn deck() -> Session {
     let mut s = Session::with_new();

crates/engine/src/cmd/compress.rs

@@ -8,7 +8,7 @@ use deckcraft_model::style::PictureFill;
 use deckcraft_model::{MediaId, Shape, ShapeId, ShapeKind};
 use serde_json::{Value, json};
 
-use super::*;
+use super::{CommandSpec, NO_ID_SPACE, bad, bool_or, cmd, f64_param, has_doc, targets};
 use crate::{Result, Session};
 
 pub fn specs() -> Vec<CommandSpec> {

crates/engine/src/cmd/design.rs

@@ -10,7 +10,10 @@ use deckcraft_model::theme::{builtin_color_schemes, builtin_font_schemes, builti
 use deckcraft_model::{Background, Fill, PhType, Presentation, Shape, ShapeId, defaults};
 use serde_json::{Value, json};
 
-use super::*;
+use super::{
+    CommandSpec, NO_ID_SPACE, always, bad, bool_or, bool_param, cmd, color_param, color_value, f64_param, has_doc, has_slide, ok, opt_usize_param,
+    rect_param, str_param, usize_param, with_param,
+};
 use crate::{Result, Session, Target};
 
 pub fn specs() -> Vec<CommandSpec> {
@@ -21,7 +24,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Browse for Themes…",
             ["Design", "Themes"],
             None,
-            "{path} | {name, data: base64} — apply the theme of a .thmx, .pptx or .potx file",
+            "{path} | {name, data: base64} — apply a .pptx or .potx's slide master and layouts (slides move to the matching layouts), or a .thmx's theme",
             has_doc,
             browse_theme
         ),
@@ -161,6 +164,13 @@ fn browse_theme(s: &mut Session, p: &Value) -> Result<Value> {
     if !deckcraft_pptx::sniff(&bytes) {
         return Err(bad("design.browseTheme", "not a theme or PowerPoint file"));
     }
+    // A presentation or template brings its slide master and layouts, as in PowerPoint; a .thmx
+    // (its main part is a theme, not a presentation) brings the theme alone.
+    if let Ok(src) = super::file::open_presentation("theme.pptx", &bytes)
+        && src.masters.first().is_some_and(|m| !m.layouts.is_empty())
+    {
+        return apply_master(s, &src);
+    }
     let (theme, media) = deckcraft_pptx::import_theme(&bytes).map_err(|e| bad("design.browseTheme", e.to_string()))?;
     let name = theme.name.clone();
     s.edit(|doc, sel| {
@@ -180,6 +190,58 @@ fn browse_theme(s: &mut Session, p: &Value) -> Result<Value> {
     Ok(json!({"theme": name}))
 }
 
+/// Design › Browse for Themes… with a `.pptx` / `.potx`: its first master and layouts replace the
+/// master the current slide uses (a preserved master stays beside it), stretched to this deck's
+/// slide size. Each slide on it moves to the new layout with the same name, else the same kind,
+/// keeping its content as Layout does.
+fn apply_master(s: &mut Session, src: &Presentation) -> Result<Value> {
+    let from = src.masters.first().ok_or_else(|| bad("design.browseTheme", "no master"))?;
+    let theme = from.theme.name.clone();
+    s.edit(|doc, sel| {
+        let mi = master_index(doc, sel);
+        let old = doc.masters.get(mi).cloned().ok_or_else(|| bad("design.browseTheme", "no master"))?;
+        let (mut media, mut layouts) = Default::default();
+        let mut m = super::reuse::import_master("design.browseTheme", doc, src, from, &mut media, &mut layouts)?;
+        let (sx, sy) = (doc.slide_size.width / src.slide_size.width.max(1.0), doc.slide_size.height / src.slide_size.height.max(1.0));
+        if (sx - 1.0).abs() > 1e-9 || (sy - 1.0).abs() > 1e-9 {
+            scale_shapes(&mut m.shapes, sx, sy, 1.0, 0.0, 0.0);
+            for l in &mut m.layouts {
+                scale_shapes(&mut l.shapes, sx, sy, 1.0, 0.0, 0.0);
+            }
+        }
+        let moves: Vec<(usize, deckcraft_model::LayoutId)> =
+            doc.slides.iter().enumerate().filter_map(|(i, sl)| old.layout(sl.layout).and_then(|l| matching_layout(&m, l)).map(|l| (i, l))).collect();
+        let layouts = m.layouts.len();
+        if old.preserve {
+            doc.masters.insert(mi, Arc::new(m));
+        } else if let Some(slot) = doc.masters.get_mut(mi) {
+            *slot = Arc::new(m);
+        }
+        for (i, l) in &moves {
+            super::slide::apply_layout(doc, *i, *l)?;
+        }
+        if let Target::Layout { master, .. } = sel.target {
+            sel.target = Target::Master { master };
+        }
+        sel.shapes.clear();
+        sel.text = None;
+        Ok(json!({"theme": theme, "layouts": layouts, "slides": moves.len()}))
+    })
+}
+
+/// The layout of `m` a slide on `from` moves to: same name, else same kind (not for custom
+/// layouts), else Title and Content, else the first.
+fn matching_layout(m: &deckcraft_model::Master, from: &deckcraft_model::Layout) -> Option<deckcraft_model::LayoutId> {
+    use deckcraft_model::LayoutType;
+    let ls = &m.layouts;
+    ls.iter()
+        .find(|l| !from.name.is_empty() && l.name.trim().eq_ignore_ascii_case(from.name.trim()))
+        .or_else(|| ls.iter().find(|l| from.kind != LayoutType::Custom && l.kind == from.kind))
+        .or_else(|| ls.iter().find(|l| l.kind == LayoutType::TitleAndContent))
+        .or_else(|| ls.first())
+        .map(|l| l.id)
+}
+
 /// `theme` with every `media` id field rewritten through `map` (format-scheme picture fills).
 fn remap_media_ids(theme: &deckcraft_model::theme::Theme, map: &std::collections::HashMap<u32, u32>) -> Result<deckcraft_model::theme::Theme> {
     fn rec(v: &mut Value, map: &std::collections::HashMap<u32, u32>, depth: usize) {
@@ -854,6 +916,14 @@ fn header_footer(s: &mut Session, p: &Value) -> Result<Value> {
         if let Some(v) = str_param(p, "dateText") {
             hf.date_text = v.into();
         }
+        if let Some(v) = str_param(p, "dateFormat") {
+            // Refused rather than ignored: a format that renders nothing would leave the
+            // placeholder showing its saved text for ever.
+            if !deckcraft_text::datetime::DATE_KINDS.contains(&v) {
+                return Err(bad("design.headerFooter", "dateFormat: one of datetime1…datetime13"));
+            }
+            hf.date_format = v.into();
+        }
         if let Some(v) = bool_param(p, "slideNumber") {
             hf.slide_number = v;
         }
@@ -869,6 +939,7 @@ fn header_footer(s: &mut Session, p: &Value) -> Result<Value> {
         }
         let hf = hf.clone();
         let date_given = str_param(p, "dateText").is_some();
+        let format_given = str_param(p, "dateFormat").is_some();
         let all = bool_or(p, "all", true);
         let list: Vec<usize> = if all { (0..doc.slides.len()).collect() } else { vec![sel.slide] };
         for i in list {
@@ -913,7 +984,11 @@ fn header_footer(s: &mut Session, p: &Value) -> Result<Value> {
                             },
                             PhType::Date if hf.date_text.is_empty() => TextBody {
                                 paragraphs: vec![deckcraft_model::Paragraph {
-                                    runs: vec![Run { text: today(), props: Default::default(), kind: RunKind::Field { field: "datetime1".into() } }],
+                                    runs: vec![Run {
+                                        text: date_now(&hf.date_format),
+                                        props: Default::default(),
+                                        kind: RunKind::Field { field: date_kind(&hf.date_format).into() },
+                                    }],
                                     ..Default::default()
                                 }],
                                 ..Default::default()
@@ -934,9 +1009,9 @@ fn header_footer(s: &mut Session, p: &Value) -> Result<Value> {
                             sh.text = Some(TextBody::from_text(&hf.footer_text));
                         }
                     }
-                    (Some(pos), true) if k == PhType::Date && date_given => {
+                    (Some(pos), true) if k == PhType::Date && (date_given || format_given) => {
                         if let Some(sh) = sl.shapes.get_mut(pos) {
-                            set_date(sh, &hf.date_text);
+                            set_date(sh, &hf.date_text, &hf.date_format);
                         }
                     }
                     _ => {}
@@ -948,15 +1023,33 @@ fn header_footer(s: &mut Session, p: &Value) -> Result<Value> {
     ok()
 }
 
+/// The date field type `format` names, `datetime1` when it is empty or unknown.
+fn date_kind(format: &str) -> &str {
+    if deckcraft_text::datetime::DATE_KINDS.contains(&format) { format } else { "datetime1" }
+}
+
+/// The saved text of a date field of `format`, as it shows now.
+fn date_now(format: &str) -> String {
+    let kind = date_kind(format);
+    deckcraft_text::datetime::DateTime::now_local().and_then(|now| deckcraft_text::datetime::field_text(kind, None, now)).unwrap_or_else(today)
+}
+
 /// Point a slide's date placeholder at a fixed date (its own plain text) or, for an empty
 /// `fixed`, at an automatic date field (one it already has keeps its format).
-fn set_date(sh: &mut Shape, fixed: &str) {
+fn set_date(sh: &mut Shape, fixed: &str, format: &str) {
     let runs = || sh.text.iter().flat_map(|t| &t.paragraphs).flat_map(|p| &p.runs);
-    let has_field = runs().any(|r| matches!(&r.kind, RunKind::Field { field } if deckcraft_text::datetime::is_date_field(field)));
+    let field_now = runs().find_map(|r| match &r.kind {
+        RunKind::Field { field } if deckcraft_text::datetime::is_date_field(field) => Some(field.clone()),
+        _ => None,
+    });
+    let has_field = field_now.is_some();
     let props = runs().next().map(|r| r.props.clone()).unwrap_or_default();
+    let want = date_kind(format);
     let (text, kind) = match fixed {
-        "" if has_field => return,
-        "" => (today(), RunKind::Field { field: "datetime1".into() }),
+        // Automatic: keep the field, but follow a format that has changed.
+        "" if field_now.as_deref() == Some(want) => return,
+        "" if has_field && format.is_empty() => return,
+        "" => (date_now(format), RunKind::Field { field: want.into() }),
         _ if !has_field && sh.text.as_ref().is_some_and(|t| t.text() == fixed) => return,
         _ => (fixed.to_string(), RunKind::Text),
     };
@@ -1254,17 +1347,17 @@ fn insert_layout(s: &mut Session, p: &Value) -> Result<Value> {
     })
 }
 
-fn layout_target(s: &Session, p: &Value) -> Result<(usize, usize)> {
+fn layout_target(s: &Session, p: &Value, cmd: &str) -> Result<(usize, usize)> {
     let st = s.doc()?;
     let (m, l) = match st.selection.target {
         Target::Layout { master, layout } => (master, layout),
         _ => (master_index(&st.doc, &st.selection), 0),
     };
-    Ok((usize_param(p, "master").unwrap_or(m), usize_param(p, "layout").unwrap_or(l)))
+    Ok((opt_usize_param(p, "master", cmd)?.unwrap_or(m), opt_usize_param(p, "layout", cmd)?.unwrap_or(l)))
 }
 
 fn rename_layout(s: &mut Session, p: &Value) -> Result<Value> {
-    let (mi, li) = layout_target(s, p)?;
+    let (mi, li) = layout_target(s, p, "master.renameLayout")?;
     let name = str_param(p, "name").ok_or_else(|| bad("master.renameLayout", "missing `name`"))?.to_string();
     s.edit(|doc, _| {
         let l =
@@ -1276,7 +1369,7 @@ fn rename_layout(s: &mut Session, p: &Value) -> Result<Value> {
 }
 
 fn delete_layout(s: &mut Session, p: &Value) -> Result<Value> {
-    let (mi, li) = layout_target(s, p)?;
+    let (mi, li) = layout_target(s, p, "master.deleteLayout")?;
     s.edit(|doc, sel| {
         let id = doc.masters.get(mi).and_then(|m| m.layouts.get(li)).map(|l| l.id).ok_or_else(|| bad("master.deleteLayout", "no such layout"))?;
         if doc.slides.iter().any(|x| x.layout == id) {
@@ -1529,6 +1622,25 @@ mod tests {
         }
     }
 
+    #[test]
+    fn layout_commands_reject_invalid_index() {
+        let mut s = Session::with_new();
+        s.execute("master.insertLayout", &json!({})).unwrap();
+        let count = |s: &Session| s.doc().unwrap().doc.masters.iter().map(|m| m.layouts.len()).sum::<usize>();
+        let names = |s: &Session| s.doc().unwrap().doc.masters.iter().flat_map(|m| m.layouts.iter().map(|l| l.name.clone())).collect::<Vec<_>>();
+        let n = count(&s);
+        let before = names(&s);
+        for bad in [json!(-1), json!(1.5)] {
+            assert!(s.execute("master.deleteLayout", &json!({"layout": bad})).is_err());
+            assert!(s.execute("master.deleteLayout", &json!({"master": bad})).is_err());
+            assert!(s.execute("master.renameLayout", &json!({"layout": bad, "name": "x"})).is_err());
+            assert_eq!(count(&s), n);
+            assert_eq!(names(&s), before);
+        }
+        s.execute("master.deleteLayout", &json!({})).unwrap();
+        assert_eq!(count(&s), n - 1);
+    }
+
     #[test]
     fn civil_dates() {
         assert_eq!(super::civil(0), (1970, 1, 1));
@@ -1955,8 +2067,10 @@ mod tests {
 
 #[cfg(test)]
 mod browse_theme_tests {
-    use deckcraft_model::PhType;
+    use std::sync::Arc;
+
     use deckcraft_model::text::RunKind;
+    use deckcraft_model::{Background, Fill, PhType};
     use serde_json::json;
 
     use crate::{Session, Target};
@@ -1982,6 +2096,108 @@ mod browse_theme_tests {
         assert!(s.execute("design.browseTheme", &json!({})).is_err());
     }
 
+    /// A 4:3 brand template: a logo and a background on the master, its layouts renamed (so slides
+    /// can only find them by kind) and its content layout's title moved.
+    fn brand_template() -> (String, Vec<u8>, deckcraft_model::Xfrm) {
+        let mut img = image::RgbaImage::new(2, 2);
+        img.put_pixel(0, 0, image::Rgba([200, 20, 30, 255]));
+        let mut logo = Vec::new();
+        image::DynamicImage::ImageRgba8(img).write_to(&mut std::io::Cursor::new(&mut logo), image::ImageFormat::Png).unwrap();
+        let mut t = Session::with_new();
+        t.execute("design.slideSize", &json!({"preset": "standard", "scale": "none"})).unwrap();
+        let title = t
+            .edit(|doc, _| {
+                let media = doc.add_media("logo.png", "image/png", logo.clone()).unwrap();
+                let id = deckcraft_model::ShapeId(doc.alloc_id().unwrap());
+                let m = Arc::make_mut(doc.masters.get_mut(0).unwrap());
+                m.shapes.push(deckcraft_model::Shape {
+                    id,
+                    name: "Logo".into(),
+                    kind: deckcraft_model::ShapeKind::Picture { fill: deckcraft_model::style::PictureFill { media, ..Default::default() } },
+                    xfrm: Some(deckcraft_model::Xfrm { x: 600.0, y: 20.0, w: 100.0, h: 40.0, ..Default::default() }),
+                    ..Default::default()
+                });
+                m.background =
+                    Some(Background::Fill { fill: Fill::solid(deckcraft_model::ColorRef::rgb(deckcraft_color::Rgba::rgb(0x0A, 0x2B, 0x4C))) });
+                for l in &mut m.layouts {
+                    l.name = format!("Brand {}", l.name);
+                }
+                let obj = m.layouts.iter_mut().find(|l| l.kind == deckcraft_model::LayoutType::TitleAndContent).unwrap();
+                let title = obj.shapes.iter_mut().find(|sh| sh.ph_type().is_some_and(PhType::is_title)).unwrap();
+                let x = deckcraft_model::Xfrm { x: 72.0, y: 400.0, w: 576.0, h: 80.0, ..Default::default() };
+                title.xfrm = Some(x);
+                Ok(x)
+            })
+            .unwrap();
+        (crate::cmd::base64_encode(&deckcraft_pptx::export_as(&t.doc().unwrap().doc, "potx").unwrap()), logo, title)
+    }
+
+    #[test]
+    fn a_template_brings_its_master_and_layouts_and_slides_follow() {
+        let (data, logo, title) = brand_template();
+        let mut s = Session::with_new();
+        s.execute("slide.new", &json!({"layout": "titleAndContent", "title": "Agenda", "body": "Point one"})).unwrap();
+        let before = s.doc().unwrap().doc.clone();
+        let n = undo_len(&s);
+        let r = s.execute("design.browseTheme", &json!({"name": "Brand.potx", "data": data})).unwrap();
+        assert_eq!(r["slides"], json!(2), "{r}");
+        assert_eq!(undo_len(&s), n + 1, "one undo step");
+
+        let doc = &s.doc().unwrap().doc;
+        assert!(doc.validate().is_empty(), "{:?}", doc.validate());
+        assert_eq!(doc.masters.len(), 1, "the old master is replaced");
+        let m = &doc.masters[0];
+        assert_ne!(m.id, before.masters[0].id);
+        assert!(m.layouts.iter().all(|l| l.name.starts_with("Brand ")));
+        assert!(matches!(m.background, Some(Background::Fill { fill: Fill::Solid { .. } })));
+        let pic = m.shapes.iter().find(|sh| sh.name == "Logo").expect("the master's logo comes along");
+        let deckcraft_model::ShapeKind::Picture { fill } = &pic.kind else { panic!("logo is a picture") };
+        assert_eq!(doc.media(fill.media).map(|m| m.data.as_ref().clone()), Some(logo));
+        // The 4:3 master stretches to this deck's 16:9.
+        let k = doc.slide_size.width / 720.0;
+        let px = pic.xfrm.unwrap();
+        assert!((px.x - 600.0 * k).abs() < 0.01 && (px.w - 100.0 * k).abs() < 0.01 && (px.y - 20.0).abs() < 0.01, "{px:?}");
+
+        // Each slide moved to the brand layout of its kind, and kept its text.
+        for (old, new) in before.slides.iter().zip(&doc.slides) {
+            let (_, was) = before.layout(old.layout).unwrap();
+            let (owner, now) = doc.layout(new.layout).expect("on a layout of the new master");
+            assert_eq!(owner.id, m.id);
+            assert_eq!(now.kind, was.kind);
+        }
+        let agenda = doc.slides.iter().find(|sl| sl.shapes.iter().any(|sh| sh.text.as_ref().is_some_and(|t| t.text() == "Agenda"))).unwrap();
+        assert!(agenda.shapes.iter().any(|sh| sh.text.as_ref().is_some_and(|t| t.text() == "Point one")));
+        let (_, lay) = doc.layout(agenda.layout).unwrap();
+        let lt = lay.shapes.iter().find(|sh| sh.ph_type().is_some_and(PhType::is_title)).unwrap().xfrm.unwrap();
+        assert!((lt.x - title.x * k).abs() < 0.01 && (lt.y - title.y).abs() < 0.01, "{lt:?}");
+        let st = agenda.shapes.iter().find(|sh| sh.ph_type().is_some_and(PhType::is_title)).unwrap();
+        assert!(st.xfrm.is_none(), "the slide title follows the new layout");
+
+        s.execute("edit.undo", &json!({})).unwrap();
+        let doc = &s.doc().unwrap().doc;
+        assert_eq!(doc.masters, before.masters);
+        assert_eq!(doc.slides, before.slides);
+    }
+
+    #[test]
+    fn a_preserved_master_stays_beside_the_template() {
+        let (data, _, _) = brand_template();
+        let mut s = Session::with_new();
+        s.execute("view.slideMaster", &json!({"master": 0, "layout": 1})).unwrap();
+        s.execute("master.preserve", &json!({"preserve": true})).unwrap();
+        s.execute("view.slideMaster", &json!({"master": 0})).unwrap();
+        s.execute("master.preserve", &json!({"preserve": true})).unwrap();
+        let old = s.doc().unwrap().doc.masters[0].id;
+        s.execute("view.slideMaster", &json!({"master": 0, "layout": 1})).unwrap();
+        s.execute("design.browseTheme", &json!({"name": "Brand.pptx", "data": data})).unwrap();
+        let st = s.doc().unwrap();
+        assert_eq!(st.doc.masters.len(), 2);
+        assert_eq!(st.doc.masters[1].id, old);
+        assert_eq!(st.selection.target, Target::Master { master: 0 }, "Slide Master view shows the new master");
+        let new = &st.doc.masters[0];
+        assert!(st.doc.slides.iter().all(|sl| new.layout(sl.layout).is_some()));
+    }
+
     fn undo_len(s: &crate::Session) -> usize {
         s.doc().unwrap().history.undo.len()
     }
@@ -2132,3 +2348,90 @@ mod browse_theme_tests {
         assert!((box_.w - 840.0).abs() < 0.01 && (box_.h - 104.0).abs() < 0.01);
     }
 }
+
+#[cfg(test)]
+mod header_footer_date_tests {
+    use deckcraft_model::PhType;
+    use deckcraft_model::text::RunKind;
+    use serde_json::json;
+
+    use crate::Session;
+
+    /// The date field of the Date placeholders of every slide: (saved text, field type).
+    fn dates(s: &Session) -> Vec<(String, Option<String>)> {
+        let d = &s.doc().unwrap().doc;
+        d.slides
+            .iter()
+            .flat_map(|sl| sl.shapes.iter())
+            .filter(|sh| sh.ph_type() == Some(PhType::Date))
+            .flat_map(|sh| sh.text.iter())
+            .flat_map(|t| t.paragraphs.iter())
+            .flat_map(|p| p.runs.iter())
+            .map(|r| {
+                let kind = match &r.kind {
+                    RunKind::Field { field } => Some(field.clone()),
+                    _ => None,
+                };
+                (r.text.clone(), kind)
+            })
+            .collect()
+    }
+
+    fn sample(kind: &str) -> String {
+        let now = deckcraft_text::datetime::DateTime::now_local().expect("a local date");
+        deckcraft_text::datetime::field_text(kind, None, now).expect("a sample")
+    }
+
+    /// Runs `design.headerFooter` and checks the slide's date run is an automatic `kind` field.
+    /// The clock is read before and after the command, so a second ticking over between the
+    /// command and the read cannot fail the comparison. Returns the run text.
+    fn run_automatic(s: &mut Session, params: serde_json::Value, kind: &str) -> String {
+        let before = sample(kind);
+        s.execute("design.headerFooter", &params).unwrap();
+        let after = sample(kind);
+        let got = dates(s);
+        assert_eq!(got.len(), 1, "{got:?}");
+        assert_eq!(got[0].1.as_deref(), Some(kind));
+        assert!(got[0].0 == before || got[0].0 == after, "{got:?} is neither {before:?} nor {after:?}");
+        got[0].0.clone()
+    }
+
+    /// Header & Footer's automatic date takes the format it is given. `HeaderFooter::date_format`
+    /// existed for this and was never read: the placeholder was always `datetime1`, and a
+    /// `dateFormat` parameter was accepted and silently dropped.
+    #[test]
+    fn the_automatic_date_takes_the_format_it_is_given() {
+        let mut s = Session::with_new();
+
+        // Default: the short date, as before.
+        run_automatic(&mut s, json!({"date": true, "dateText": "", "all": true}), "datetime1");
+
+        // A format: the field type changes and the saved text is that format's.
+        run_automatic(&mut s, json!({"date": true, "dateFormat": "datetime5", "all": true}), "datetime5");
+        assert_eq!(s.doc().unwrap().doc.header_footer.date_format, "datetime5");
+
+        // A time format works the same way, and these two differ, so the format is really read.
+        let time = run_automatic(&mut s, json!({"date": true, "dateFormat": "datetime11", "all": true}), "datetime11");
+        assert_ne!(time, sample("datetime5"));
+
+        // Asking again changes nothing (and does not rewrite the run).
+        let again = run_automatic(&mut s, json!({"date": true, "dateFormat": "datetime11", "all": true}), "datetime11");
+        assert_eq!(again, time);
+
+        // A fixed date still wins: plain text, no field.
+        s.execute("design.headerFooter", &json!({"date": true, "dateText": "4 July 1776", "all": true})).unwrap();
+        assert_eq!(dates(&s), vec![("4 July 1776".to_string(), None)]);
+
+        // Back to automatic: the remembered format comes back, not datetime1.
+        run_automatic(&mut s, json!({"date": true, "dateText": "", "dateFormat": "datetime11", "all": true}), "datetime11");
+
+        // An unknown format is refused rather than ignored, and changes nothing.
+        for bad in ["datetime0", "datetime14", "nonsense", ""] {
+            assert!(s.execute("design.headerFooter", &json!({"date": true, "dateFormat": bad})).is_err(), "{bad}");
+        }
+        assert_eq!(s.doc().unwrap().doc.header_footer.date_format, "datetime11");
+        let got = dates(&s);
+        assert_eq!(got.len(), 1, "{got:?}");
+        assert_eq!(got[0].1.as_deref(), Some("datetime11"));
+    }
+}

crates/engine/src/cmd/edit.rs

@@ -7,7 +7,10 @@ use deckcraft_model::text::TextBody;
 use deckcraft_model::{MediaId, Shape, ShapeId, Slide, SlideId};
 use serde_json::{Value, json};
 
-use super::*;
+use super::{
+    CommandSpec, NO_ID_SPACE, bad, base64_encode, bool_or, can_redo, can_undo, cmd, has_doc, has_selection, has_slide, id_param, ids_param, ok,
+    richclip, str_param, targets, xfrm_of,
+};
 use crate::{HistoryEntry, Result, Session};
 
 pub fn specs() -> Vec<CommandSpec> {
@@ -44,16 +47,19 @@ pub fn specs() -> Vec<CommandSpec> {
 }
 
 fn restore(s: &mut Session, redo: bool) -> Result<Value> {
+    let vertex_kind = s.tool.vertex_kind.clone();
     let st = s.doc_mut()?;
     let (from, to) = if redo { (&mut st.history.redo, &mut st.history.undo) } else { (&mut st.history.undo, &mut st.history.redo) };
     let Some(e) = from.pop() else { return ok() };
-    to.push(HistoryEntry { label: e.label.clone(), doc: st.doc.clone(), selection: st.selection.clone() });
+    to.push(HistoryEntry { label: e.label.clone(), doc: st.doc.clone(), selection: st.selection.clone(), vertex_kind });
     st.doc = e.doc;
     st.selection = e.selection;
     st.interaction = None;
     // A later shape can get an undone copy's id: Duplicate starts over with the usual offset.
     st.last_duplicate = None;
     st.revision += 1;
+    // The point type Edit Points remembered with the restored document: handle drags follow it.
+    s.tool.vertex_kind = e.vertex_kind;
     Ok(json!({"label": e.label}))
 }
 
@@ -69,30 +75,6 @@ fn slides_scope(s: &Session, p: &Value) -> bool {
         || s.active().is_some_and(|d| d.selection.shapes.is_empty() && d.selection.text.is_none() && !d.selection.slides.is_empty())
 }
 
-pub(crate) fn media_of_shapes(shapes: &[Shape], out: &mut Vec<MediaId>) {
-    deckcraft_model::walk(shapes, &mut |s, _| {
-        match &s.kind {
-            deckcraft_model::ShapeKind::Picture { fill } => out.push(fill.media),
-            deckcraft_model::ShapeKind::Media(m) => {
-                out.push(m.media);
-                if let Some(p) = m.poster {
-                    out.push(p);
-                }
-            }
-            deckcraft_model::ShapeKind::Model3d { media, poster } => {
-                out.push(*media);
-                if let Some(p) = poster {
-                    out.push(*p);
-                }
-            }
-            _ => {}
-        }
-        if let Some(deckcraft_model::Fill::Picture(pf)) = &s.fill {
-            out.push(pf.media);
-        }
-    });
-}
-
 fn copy_inner(s: &mut Session, p: &Value) -> Result<String> {
     let st = s.doc()?;
     // Text selection.
@@ -113,16 +95,18 @@ fn copy_inner(s: &mut Session, p: &Value) -> Result<String> {
         let slides: Vec<Slide> = ids.iter().filter_map(|id| st.doc.slide(*id).cloned()).collect();
         let mut mids = vec![];
         for sl in &slides {
-            media_of_shapes(&sl.shapes, &mut mids);
-            if let Some(deckcraft_model::Background::Fill { fill: deckcraft_model::Fill::Picture(pf) }) = &sl.background {
-                mids.push(pf.media);
-            }
+            mids.extend(crate::media_refs::slide_media(sl));
         }
         let media = st.doc.media.iter().filter(|m| mids.contains(&m.id)).cloned().collect();
         let plain = slides.iter().map(|x| x.title()).collect::<Vec<_>>().join("\n");
         s.clipboard = crate::Clipboard { slides, media, plain: plain.clone(), ..Default::default() };
         return Ok(plain);
     }
+    // Selected table cells copy as their text: a tab between cells and a paragraph per row.
+    if let Some(plain) = super::table::selected_cells_text(st).filter(|_| p.get("id").is_none() && p.get("ids").is_none()) {
+        s.clipboard = crate::Clipboard { text: Some(TextBody::from_text(&plain)), plain: plain.clone(), ..Default::default() };
+        return Ok(plain);
+    }
     let shapes: Vec<Shape> = st
         .selection
         .shapes
@@ -136,8 +120,7 @@ fn copy_inner(s: &mut Session, p: &Value) -> Result<String> {
             })
         })
         .collect();
-    let mut mids = vec![];
-    media_of_shapes(&shapes, &mut mids);
+    let mids = crate::media_refs::shapes_media(&shapes);
     let media = st.doc.media.iter().filter(|m| mids.contains(&m.id)).cloned().collect();
     let plain = shapes.iter().filter_map(|x| x.text.as_ref().map(|t| t.text())).collect::<Vec<_>>().join("\n");
     let source_theme = st.current_slide().and_then(|sl| st.doc.master_for(sl)).map(|(m, _)| (m.scheme(), m.theme.fonts.clone()));
@@ -250,32 +233,13 @@ fn walk_mut(shapes: &mut [Shape], f: &mut dyn FnMut(&mut Shape)) {
     rec(shapes, f, 0);
 }
 
-/// Rewrite the media ids shapes use (`map`: clipboard id to destination id).
-fn remap_media(shapes: &mut [Shape], map: &HashMap<MediaId, MediaId>) {
-    if map.is_empty() {
-        return;
-    }
-    let m = |id: &mut MediaId| {
+/// Rewrite a media id the clipboard used (`map`: clipboard id to destination id).
+fn remap_media(map: &HashMap<MediaId, MediaId>) -> impl FnMut(&mut MediaId) + '_ {
+    move |id: &mut MediaId| {
         if let Some(n) = map.get(id) {
             *id = *n;
         }
-    };
-    walk_mut(shapes, &mut |s| {
-        match &mut s.kind {
-            deckcraft_model::ShapeKind::Picture { fill } => m(&mut fill.media),
-            deckcraft_model::ShapeKind::Media(c) => {
-                m(&mut c.media);
-                if let Some(p) = c.poster.as_mut() {
-                    m(p);
-                }
-            }
-            deckcraft_model::ShapeKind::Opaque { preview: Some(p), .. } => m(p),
-            _ => {}
-        }
-        if let Some(deckcraft_model::Fill::Picture(pf)) = &mut s.fill {
-            m(&mut pf.media);
-        }
-    });
+    }
 }
 
 /// Add the clipboard's media to `doc` and return the ids that changed: an id already used in
@@ -284,7 +248,11 @@ fn bring_media(cmd: &str, doc: &mut deckcraft_model::Presentation, media: &[deck
     let mut map = HashMap::new();
     for m in media {
         match doc.media(m.id) {
-            None => doc.media.push(m.clone()),
+            None => {
+                // Keeps the foreign id, so later ids must start past it.
+                doc.media.push(m.clone());
+                doc.next_id = doc.next_id.max(m.id.0);
+            }
             Some(x) if x.data == m.data => {}
             Some(_) => {
                 let id = doc.add_media(&m.name, &m.content_type, m.data.as_ref().clone()).ok_or_else(|| bad(cmd, NO_ID_SPACE))?;
@@ -328,12 +296,7 @@ fn paste(s: &mut Session, p: &Value) -> Result<Value> {
                 sl.id = SlideId(doc.alloc_id().ok_or_else(|| bad("edit.paste", NO_ID_SPACE))?);
                 let map = reid("edit.paste", doc, &mut sl.shapes)?;
                 remap_animations(&mut sl.animations, &map);
-                remap_media(&mut sl.shapes, &media);
-                if let Some(deckcraft_model::Background::Fill { fill: deckcraft_model::Fill::Picture(pf) }) = &mut sl.background
-                    && let Some(n) = media.get(&pf.media)
-                {
-                    pf.media = *n;
-                }
+                crate::media_refs::visit_mut::slide(&mut sl, &mut remap_media(&media));
                 if doc.layout(sl.layout).is_none() {
                     sl.layout = doc.masters.first().and_then(|m| m.layouts.first()).map(|l| l.id).unwrap_or_default();
                 }
@@ -357,8 +320,19 @@ fn paste(s: &mut Session, p: &Value) -> Result<Value> {
             let media = bring_media("edit.paste", doc, &clip.media)?;
             let mut shapes = clip.shapes.clone();
             reid("edit.paste", doc, &mut shapes)?;
-            remap_media(&mut shapes, &media);
+            crate::media_refs::visit_mut::shapes(&mut shapes, &mut remap_media(&media));
+            let mut taken = super::current_names(doc, sel);
             for sh in &mut shapes {
+                // Only a name already on the slide is changed (two shapes with one name are what the
+                // issue is about); otherwise it stays, as Morph pairs shapes across slides by name.
+                if taken.contains(&sh.name)
+                    && let Some((base, n)) = sh.name.rsplit_once(' ')
+                    && !n.is_empty()
+                    && n.bytes().all(|b| b.is_ascii_digit())
+                {
+                    sh.name = super::insert::first_free_name(base, &taken);
+                }
+                taken.insert(sh.name.clone());
                 if let Some(x) = sh.xfrm.as_mut() {
                     x.x += off;
                     x.y += off;
@@ -504,7 +478,8 @@ fn paste_picture(s: &mut Session) -> Result<Value> {
     }
     let st = s.doc()?;
     let mut doc = (*st.doc).clone();
-    bring_media("edit.pasteSpecial", &mut doc, &clip.media)?;
+    let media = bring_media("edit.pasteSpecial", &mut doc, &clip.media)?;
+    crate::media_refs::visit_mut::shapes(&mut clip.shapes, &mut remap_media(&media));
     let mut slide = st.current_slide().cloned().ok_or_else(|| bad("edit.pasteSpecial", "no slide"))?;
     let xs: Vec<deckcraft_geom::Xfrm> = clip.shapes.iter().filter_map(|x| x.xfrm).collect();
     let b = super::arrange::union_bounds(&xs).ok_or_else(|| bad("edit.pasteSpecial", "nothing to draw"))?;
@@ -587,6 +562,11 @@ fn delete(s: &mut Session, p: &Value) -> Result<Value> {
     if slides_scope(s, p) && ids_param(p, "ids").is_none() {
         return s.execute("slide.delete", &json!({}));
     }
+    // With table cells selected, Delete clears their text and keeps the table, as in PowerPoint.
+    let sel = &s.doc()?.selection;
+    if ids_param(p, "ids").is_none() && p.get("id").is_none() && sel.cells.is_some_and(|c| sel.shapes == [c.0]) {
+        return super::table::clear_selected_cells(s);
+    }
     let ids = targets(s, p)?;
     if ids.is_empty() {
         return ok();

crates/engine/src/cmd/file.rs

@@ -7,7 +7,7 @@ use deckcraft_media::MediaInfo;
 use deckcraft_model::{MediaId, MediaItem, Presentation, Shape, ShapeKind, defaults};
 use serde_json::{Value, json};
 
-use super::*;
+use super::{CommandSpec, always, bad, base64_decode, base64_encode, bool_or, cmd, f64_or, has_doc, ok, str_param, usize_param};
 use crate::{DocState, EngineError, Result, Session};
 
 pub fn specs() -> Vec<CommandSpec> {
@@ -37,7 +37,7 @@ pub fn specs() -> Vec<CommandSpec> {
         cmd!(noundo "file.saveAs", "Save As…", ["File"], Some("Cmd+Shift+S"), "{path, format?}", has_doc, save_as),
         cmd!(noundo "file.saveTemplate", "Save as Template…", ["File"], None, "{path}", has_doc, save_as),
         cmd!(query "file.saveBytes", "Save to Data", [], None, "{format?: deckcraft|pptx} → {data: base64}", has_doc, save_bytes_cmd),
-        cmd!(noundo "file.export", "Export…", ["File"], None, "{path, format?: png|jpeg|pptx|deckcraft|outline|pdf|gif (else by path), slide?: index, all?: bool, scale?: px per pt, layout?: slides|notes|handouts (pdf), perPage?: 1|2|3|4|6|9, paper?: letter|a4|legal|a3 (pdf), orientation?: portrait|landscape (pdf), dpi?, slides?: [index]|range (\"1-3,5\"), includeHidden?, textLayer?, frame?, transparentBackground?: bool (png: leave the slide background out), width?: px 16-3840|small|medium|large|extraLarge (gif), secondsPerSlide?: 0.1-600 (gif; 5), loop?: bool (gif; true: forever)} → {path, bytes} or {files} (png, jpeg); gif adds frames, width, height, secondsPerSlide", has_doc, export),
+        cmd!(noundo "file.export", "Export…", ["File"], None, "{path, format?: png|jpeg|pptx|deckcraft|outline|rtf|pdf|gif (else by path), slide?: index, all?: bool, scale?: px per pt, layout?: slides|notes|handouts (pdf), perPage?: 1|2|3|4|6|9, paper?: letter|a4|legal|a3 (pdf), orientation?: portrait|landscape (pdf), dpi?, slides?: [index]|range (\"1-3,5\"), includeHidden?, textLayer?, frame?, transparentBackground?: bool (png: leave the slide background out), width?: px 16-3840|small|medium|large|extraLarge (gif), secondsPerSlide?: 0.1-600 (gif; 5), loop?: bool (gif; true: forever)} → {path, bytes} or {files} (png, jpeg); gif adds frames, width, height, secondsPerSlide", has_doc, export),
         cmd!(
             query "file.info",
             "Info",
@@ -167,8 +167,10 @@ fn open_other(name: &str, bytes: &[u8]) -> Result<(Presentation, Vec<String>)> {
         return Err(EngineError::Other(format!("{name} is password-protected. DeckCraft can't open password-protected presentations yet.")));
     }
     let lower = name.to_ascii_lowercase();
-    if lower.ends_with(".txt") || lower.ends_with(".md") {
+    let rtf = deckcraft_format::rtf::sniff_rtf(bytes);
+    if rtf || lower.ends_with(".txt") || lower.ends_with(".md") {
         let text = String::from_utf8_lossy(bytes);
+        let text = if rtf { std::borrow::Cow::Owned(deckcraft_format::rtf::rtf_to_outline(&text)) } else { text };
         let mut p = defaults::blank_presentation(defaults::WIDE, Default::default(), false);
         if lower.ends_with(".md") {
             deckcraft_format::markdown_to_slides(&mut p, &text);
@@ -219,6 +221,12 @@ fn probe_clips(p: &mut Presentation) {
     }
 }
 
+/// An outline file's text: RTF is read into the tab-indented outline, anything else as UTF-8.
+pub fn outline_text(bytes: &[u8]) -> String {
+    let text = String::from_utf8_lossy(bytes);
+    if deckcraft_format::rtf::sniff_rtf(bytes) { deckcraft_format::rtf::rtf_to_outline(&text) } else { text.into_owned() }
+}
+
 pub fn add_opened(s: &mut Session, name: &str, path: Option<String>, p: Presentation) -> usize {
     let title = std::path::Path::new(name).file_stem().map(|n| n.to_string_lossy().to_string()).unwrap_or_else(|| name.to_string());
     crate::fonts::install_embedded_fonts(&p);
@@ -334,6 +342,7 @@ pub fn save_bytes(doc: &Presentation, format: &str) -> Result<Vec<u8>> {
     match format {
         f @ ("pptx" | "potx" | "ppsx") => deckcraft_pptx::export_as(doc, f).map_err(|e| EngineError::Other(e.to_string())),
         "outline" | "txt" => Ok(deckcraft_format::slides_to_outline(doc).into_bytes()),
+        "rtf" => Ok(deckcraft_format::rtf::slides_to_rtf(doc).into_bytes()),
         "pdf" => deckcraft_pdf::export(doc, &Default::default()).map_err(|e| EngineError::Other(e.to_string())),
         "gif" => gif_bytes(doc, &Value::Null),
         _ => deckcraft_format::save(doc).map_err(|e| EngineError::Other(e.to_string())),
@@ -409,7 +418,7 @@ pub fn pdf_bytes(doc: &Presentation, p: &Value) -> Result<Vec<u8>> {
 }
 
 /// The output extensions [`format_for_path`] maps to a writer of that format.
-pub const WRITABLE_EXTENSIONS: &[&str] = &["deckcraft", "pptx", "potx", "ppsx", "pdf", "png", "jpg", "jpeg", "gif", "txt", "md"];
+pub const WRITABLE_EXTENSIONS: &[&str] = &["deckcraft", "pptx", "potx", "ppsx", "pdf", "png", "jpg", "jpeg", "gif", "txt", "md", "rtf"];
 
 /// The format a file named `path` is written in, or `None` when its extension names no format
 /// DeckCraft writes (`.odp`, `.svg`, no extension …): [`format_for_path`] would save
@@ -442,6 +451,8 @@ pub fn format_for_path(path: &str) -> &'static str {
         "gif"
     } else if l.ends_with(".txt") || l.ends_with(".md") {
         "outline"
+    } else if l.ends_with(".rtf") {
+        "rtf"
     } else {
         "deckcraft"
     }
@@ -622,7 +633,7 @@ fn export(s: &mut Session, p: &Value) -> Result<Value> {
                 "secondsPerSlide": f64::from(out.delay_cs) / 100.0,
             }))
         }
-        "pptx" | "potx" | "ppsx" | "deckcraft" | "outline" | "txt" => {
+        "pptx" | "potx" | "ppsx" | "deckcraft" | "outline" | "txt" | "rtf" => {
             let bytes = save_bytes(&st.doc, &format)?;
             write_file(&path, &bytes)?;
             Ok(json!({"path": path, "bytes": bytes.len()}))

crates/engine/src/cmd/find.rs

@@ -6,7 +6,7 @@ use deckcraft_model::text::RunKind;
 use deckcraft_model::{Paragraph, Shape, ShapeKind, Slide, TextBody};
 use serde_json::{Value, json};
 
-use super::*;
+use super::{CommandSpec, bad, bool_or, cmd, has_doc, str_param};
 use crate::{Result, Session};
 
 pub fn specs() -> Vec<CommandSpec> {

crates/engine/src/cmd/format.rs

@@ -4,12 +4,17 @@
 use deckcraft_model::edit as ed;
 use deckcraft_model::resolve;
 use deckcraft_model::text::{Align, Anchor, AutoFit, Bullet, Caps, ParaProps, RunProps, Spacing, Strike, TabStop, TextDir};
-use deckcraft_model::{ColorRef, ColorTransform, Effects, Fill, Line, SchemeSlot, Shape};
+use deckcraft_model::{ColorRef, ColorTransform, Effects, Fill, Line, SchemeSlot, Shape, ShapeKind};
 use serde_json::{Value, json};
+use std::sync::Arc;
 
 use super::text::{format_body, format_para, format_run};
-use super::*;
+use super::{
+    CommandSpec, always, bad, base64_decode, bool_or, bool_param, cmd, color_param, edit_shapes, f64_or, f64_param, has_doc, has_text,
+    has_text_or_shapes, ids_param, ok, str_param,
+};
 use crate::{Result, Session};
+use deckcraft_model::ShapeId;
 
 pub fn specs() -> Vec<CommandSpec> {
     vec![
@@ -60,6 +65,15 @@ pub fn specs() -> Vec<CommandSpec> {
             has_text_or_shapes,
             language
         ),
+        cmd!(
+            "format.languageAll",
+            "Language for All Text",
+            ["Review", "Language"],
+            None,
+            "{lang?, noProof?: bool} (proofing language of every text in the presentation: slides, tables, notes, masters and layouts, and the default for new text; one undo step)",
+            has_doc,
+            language_all
+        ),
         cmd!("format.highlight", "Text Highlight Color", ["Home", "Font"], None, "{color? (absent = none)}", has_text_or_shapes, highlight),
         cmd!(
             "format.case",
@@ -198,7 +212,15 @@ pub fn specs() -> Vec<CommandSpec> {
             has_text_or_shapes,
             direction
         ),
-        cmd!("format.columns", "Columns", ["Home", "Paragraph"], None, "{count, spacing?: pt}", has_text_or_shapes, columns),
+        cmd!(
+            "format.columns",
+            "Columns",
+            ["Home", "Paragraph"],
+            None,
+            "{count?: 1-16, spacing?: pt between columns}; a key left out keeps the shape's value, and with neither the Columns dialog opens",
+            has_text_or_shapes,
+            columns
+        ),
         cmd!("format.autofit", "Autofit", ["Format Shape", "Text Box"], None, "{mode: none|shrink|resize}", has_text_or_shapes, autofit),
         cmd!("format.wrap", "Wrap Text in Shape", ["Format Shape", "Text Box"], None, "{on: bool}", has_text_or_shapes, wrap),
         cmd!(
@@ -340,6 +362,27 @@ fn shrink(s: &mut Session, _p: &Value) -> Result<Value> {
 }
 fn color(s: &mut Session, p: &Value) -> Result<Value> {
     let c = color_param(p, "color").ok_or_else(|| bad("format.color", "missing or invalid `color`"))?;
+    // A selected chart has no runs: Font Color colours its text (title, axes, legend, labels),
+    // which used to answer and change nothing.
+    let st = s.doc()?;
+    if st.selection.text.is_none() {
+        let charts: Vec<ShapeId> =
+            st.selection.shapes.iter().copied().filter(|id| matches!(st.shape(*id).map(|sh| &sh.kind), Some(ShapeKind::Chart(_)))).collect();
+        let only_charts = charts.len() == st.selection.shapes.len();
+        if !charts.is_empty() {
+            let tc = c.clone();
+            edit_shapes(s, &json!({"ids": charts}), "format.color", |sh| {
+                if let ShapeKind::Chart(ch) = &mut sh.kind {
+                    ch.text_color = Some(tc.clone());
+                    ch.raw = None;
+                }
+                Ok(())
+            })?;
+            if only_charts {
+                return ok();
+            }
+        }
+    }
     format_run(s, &move |r| r.fill = Some(Fill::solid(c.clone())))
 }
 /// `a:alpha` for `transparency` (0–1) on `c`, replacing any alpha it had; fully opaque drops it.
@@ -377,16 +420,17 @@ fn text_transparency(s: &mut Session, p: &Value) -> Result<Value> {
         r.fill = Some(f);
     })
 }
-fn language(s: &mut Session, p: &Value) -> Result<Value> {
+/// The `lang` and `noProof` params of the language commands, checked: a run-props setter.
+fn language_edit(id: &str, p: &Value) -> Result<impl Fn(&mut RunProps) + Send + Sync + 'static> {
     let lang = str_param(p, "lang").map(str::to_string);
     let no_proof = bool_param(p, "noProof");
     if lang.is_none() && no_proof.is_none() {
-        return Err(bad("format.language", "give `lang` or `noProof`"));
+        return Err(bad(id, "give `lang` or `noProof`"));
     }
     if lang.as_deref().is_some_and(|l| l.is_empty() || l.len() > 35 || !l.chars().all(|c| c.is_ascii_alphanumeric() || c == '-')) {
-        return Err(bad("format.language", "`lang` is a language tag such as en-US"));
+        return Err(bad(id, "`lang` is a language tag such as en-US"));
     }
-    format_run(s, &move |r| {
+    Ok(move |r: &mut RunProps| {
         if let Some(l) = &lang {
             r.lang = Some(l.clone());
         }
@@ -395,6 +439,61 @@ fn language(s: &mut Session, p: &Value) -> Result<Value> {
         }
     })
 }
+/// Review › Language on the selected text (or the selected shapes' text).
+fn language(s: &mut Session, p: &Value) -> Result<Value> {
+    let f = language_edit("format.language", p)?;
+    format_run(s, &f)
+}
+/// Every run in the deck, and the text styles new text inherits from, in one language.
+fn language_all(s: &mut Session, p: &Value) -> Result<Value> {
+    let f = language_edit("format.languageAll", p)?;
+    /// Runs, end marks and the body's own list style levels (never creating one).
+    fn body(t: &mut deckcraft_model::text::TextBody, f: &dyn Fn(&mut RunProps)) {
+        ed::format_all(t, f);
+        t.list_style.levels.iter_mut().flatten().for_each(|lv| f(&mut lv.run));
+    }
+    /// Every text body in `list`: shapes, table cells and groups (nested at most 64 deep).
+    fn shapes(list: &mut [Shape], f: &dyn Fn(&mut RunProps), depth: usize) {
+        if depth > 64 {
+            return;
+        }
+        for sh in list {
+            if let Some(t) = &mut sh.text {
+                body(t, f);
+            }
+            match &mut sh.kind {
+                deckcraft_model::ShapeKind::Table(t) => t.rows.iter_mut().flat_map(|r| &mut r.cells).for_each(|c| body(&mut c.text, f)),
+                deckcraft_model::ShapeKind::Group { children, .. } => shapes(children, f, depth + 1),
+                _ => {}
+            }
+        }
+    }
+    /// A master or presentation text style's levels: what new text inherits.
+    fn styles(l: &mut deckcraft_model::text::ListStyle, f: &dyn Fn(&mut RunProps)) {
+        // Level 1 always, so a deck without a default text style gets one.
+        if l.level(0).is_none() {
+            l.set(0, Default::default());
+        }
+        l.levels.iter_mut().flatten().for_each(|lv| f(&mut lv.run));
+    }
+    s.edit(|doc, _| {
+        for sl in &mut doc.slides {
+            let sl = Arc::make_mut(sl);
+            shapes(&mut sl.shapes, &f, 0);
+            body(&mut sl.notes, &f);
+        }
+        let extra = [doc.notes_master.as_mut(), doc.handout_master.as_mut()];
+        for m in doc.masters.iter_mut().chain(extra.into_iter().flatten()) {
+            let m = Arc::make_mut(m);
+            shapes(&mut m.shapes, &f, 0);
+            m.layouts.iter_mut().for_each(|l| shapes(&mut l.shapes, &f, 0));
+            [&mut m.title_style, &mut m.body_style, &mut m.other_style].into_iter().for_each(|l| styles(l, &f));
+        }
+        styles(&mut doc.default_text_style, &f);
+        Ok(())
+    })?;
+    ok()
+}
 fn highlight(s: &mut Session, p: &Value) -> Result<Value> {
     let c = color_param(p, "color");
     format_run(s, &move |r| r.highlight = c.clone())
@@ -692,7 +791,8 @@ fn case(s: &mut Session, p: &Value) -> Result<Value> {
         }
         let m = if mode == "cycle" { ed::next_case(&ed::text_range(&body, a, b)).to_string() } else { mode.clone() };
         super::text::edit_text(s, move |body, t| {
-            for pi in a.0..=b.0 {
+            let last = body.paragraphs.len().saturating_sub(1);
+            for pi in a.0..=b.0.min(last) {
                 let Some(para) = body.paragraphs.get_mut(pi) else { continue };
                 let n = para.char_len();
                 let from = if pi == a.0 { a.1 } else { 0 };
@@ -1089,12 +1189,45 @@ fn direction(s: &mut Session, p: &Value) -> Result<Value> {
     };
     format_body(s, &move |b| b.vert = Some(d))
 }
+/// The edited or first selected shape's columns as drawn: the count and the spacing in points.
+fn current_columns(s: &Session) -> (u32, f64) {
+    let Ok(st) = s.doc() else { return (1, 0.0) };
+    let id = match &st.selection.text {
+        Some(t) if !t.notes => Some(t.shape),
+        _ => st.selection.shapes.first().copied(),
+    };
+    let Some(sh) = id.and_then(|id| st.shape(id)) else { return (1, 0.0) };
+    let body = match super::text::ctx_for(&st.doc, &st.selection) {
+        Some(c) => resolve::body(&c, sh),
+        None => sh.text.as_ref().map(|b| b.body.clone()).unwrap_or_default(),
+    };
+    (body.columns.unwrap_or(1).clamp(1, 16), body.col_spacing.unwrap_or(0.0).max(0.0))
+}
 fn columns(s: &mut Session, p: &Value) -> Result<Value> {
-    let n = p.get("count").and_then(Value::as_u64).unwrap_or(1).clamp(1, 16) as u32;
-    let sp = f64_or(p, "spacing", 0.0).max(0.0);
+    const CMD: &str = "format.columns";
+    let count = match p.get("count") {
+        None => None,
+        Some(v) => {
+            let n = v
+                .as_f64()
+                .filter(|n| n.fract() == 0.0 && (1.0..=16.0).contains(n))
+                .ok_or_else(|| bad(CMD, "`count` must be a whole number from 1 to 16"))?;
+            Some(n as u32)
+        }
+    };
+    let spacing = finite_key(p, CMD, "spacing")?.map(clamp_pt);
+    if count.is_none() && spacing.is_none() {
+        let (count, spacing) = current_columns(s);
+        s.ui_requests.push(crate::UiRequest::Dialog { id: "columns".into(), params: json!({"count": count, "spacing": spacing}) });
+        return ok();
+    }
     format_body(s, &move |b| {
-        b.columns = Some(n);
-        b.col_spacing = Some(sp);
+        if let Some(n) = count {
+            b.columns = Some(n);
+        }
+        if let Some(sp) = spacing {
+            b.col_spacing = Some(sp);
+        }
     })
 }
 fn autofit(s: &mut Session, p: &Value) -> Result<Value> {
@@ -1593,6 +1726,51 @@ mod tests {
         assert!(para(&s).indent.is_none());
     }
 
+    fn body(s: &Session) -> deckcraft_model::text::BodyProps {
+        s.doc().unwrap().selected_shapes().first().and_then(|sh| sh.text.as_ref()).map(|t| t.body.clone()).unwrap_or_default()
+    }
+
+    #[test]
+    fn columns_set_the_number_and_spacing_and_a_left_out_key_keeps_its_value() {
+        let mut s = shape();
+        let n = s.doc().unwrap().history.undo.len();
+        s.execute("format.columns", &json!({"count": 4, "spacing": 36.0})).unwrap();
+        assert_eq!((body(&s).columns, body(&s).col_spacing), (Some(4), Some(36.0)));
+        assert_eq!(s.doc().unwrap().history.undo.len(), n + 1, "one undo step");
+        s.execute("format.columns", &json!({"count": 2})).unwrap();
+        assert_eq!((body(&s).columns, body(&s).col_spacing), (Some(2), Some(36.0)), "the spacing stays");
+        s.execute("format.columns", &json!({"spacing": 9.0})).unwrap();
+        assert_eq!((body(&s).columns, body(&s).col_spacing), (Some(2), Some(9.0)), "the number stays");
+    }
+
+    #[test]
+    fn columns_with_no_fields_open_the_dialog_with_the_shapes_values() {
+        let mut s = shape();
+        s.execute("format.columns", &json!({"count": 3, "spacing": 27.0})).unwrap();
+        let rev = s.doc().unwrap().revision;
+        let n = s.doc().unwrap().history.undo.len();
+        s.ui_requests.clear();
+        s.execute("format.columns", &json!({})).unwrap();
+        assert_eq!(s.doc().unwrap().revision, rev);
+        assert_eq!(s.doc().unwrap().history.undo.len(), n);
+        let Some(UiRequest::Dialog { id, params }) = s.ui_requests.last() else { panic!("dialog request") };
+        assert_eq!(id, "columns");
+        assert_eq!(params["count"], 3);
+        assert_eq!(params["spacing"], 27.0);
+    }
+
+    #[test]
+    fn columns_reject_a_bad_number_or_spacing_without_editing() {
+        let mut s = shape();
+        let n = s.doc().unwrap().history.undo.len();
+        for p in [json!({"count": 0}), json!({"count": 17}), json!({"count": 2.5}), json!({"count": "two"}), json!({"spacing": "wide"})] {
+            let err = s.execute("format.columns", &p).unwrap_err().to_string();
+            assert!(err.contains("format.columns"), "{p}: {err}");
+        }
+        assert_eq!(s.doc().unwrap().history.undo.len(), n);
+        assert_eq!(body(&s).columns, None);
+    }
+
     #[test]
     fn tabs_dialog_sets_stops_in_one_undo_and_opens_with_no_fields() {
         let mut s = shape();

crates/engine/src/cmd/ideas.rs

@@ -4,10 +4,11 @@
 //! slide. Everything is computed here, offline.
 
 use deckcraft_geom::Xfrm;
+use deckcraft_model::resolve::{self, Ctx};
 use deckcraft_model::{Fill, Presentation, Rgba, Shape, ShapeKind};
 use serde_json::{Value, json};
 
-use super::*;
+use super::{CommandSpec, bad, cmd, has_slide, str_param, usize_param, xfrm_of};
 use crate::{Result, Selection, Session};
 
 pub fn specs() -> Vec<CommandSpec> {
@@ -57,9 +58,44 @@ fn roles(shapes: &[Shape]) -> Roles {
     r
 }
 
-/// The ideas for slide `index` (none when it has nothing to arrange).
+/// Whether `s` paints a fill or an outline once inherited and style-referenced values are
+/// resolved, as the renderer does (`fill: None` alone means inherited, not invisible).
+fn shows(ctx: Option<&Ctx>, s: &Shape) -> bool {
+    let visible = |f: &Option<Fill>| f.as_ref().is_some_and(|f| !f.is_none());
+    match ctx {
+        Some(ctx) => visible(&resolve::fill(ctx, s).0) || visible(&resolve::line(ctx, s).0.fill),
+        None => visible(&s.fill) || visible(&s.line.as_ref().and_then(|l| l.fill.clone())),
+    }
+}
+
+/// Whether an idea may move this shape: a picture, a placeholder or a plain text box. Diagram
+/// boxes, connectors, groups, tables, charts and media are laid out by their own geometry, which
+/// the ideas do not know, so a slide holding one gets no ideas.
+fn arrangeable(ctx: Option<&Ctx>, s: &Shape) -> bool {
+    match s.kind {
+        ShapeKind::Picture { .. } => true,
+        ShapeKind::Shape => {
+            let is_title = s.ph.as_ref().is_some_and(|p| p.kind.is_title());
+            let has_text = s.text.as_ref().is_some_and(|t| !t.text().trim().is_empty());
+            // Only titles and shapes with text are moved (see `roles`): an empty one that shows
+            // (filled or outlined) would stay where it is, over the rearranged slide.
+            (s.ph.is_some() || s.text_box) && (is_title || has_text || !shows(ctx, s))
+        }
+        _ => false,
+    }
+}
+
+/// The ideas for slide `index` (none when it has nothing to arrange, or other content in the way).
 pub fn ideas_for(doc: &Presentation, index: usize) -> Vec<Idea> {
     let Some(slide) = doc.slides.get(index) else { return vec![] };
+    let ctx = Ctx::for_slide(doc, slide);
+    if slide.shapes.iter().any(|s| !s.hidden && !arrangeable(ctx.as_ref(), s)) {
+        return vec![];
+    }
+    // The ideas move one picture; a second would stay put, over the rearranged text.
+    if slide.shapes.iter().filter(|s| !s.hidden && matches!(s.kind, ShapeKind::Picture { .. })).count() > 1 {
+        return vec![];
+    }
     let r = roles(&slide.shapes);
     if r.picture.is_some() {
         PICTURE_IDEAS.to_vec()
@@ -249,6 +285,7 @@ mod tests {
         };
         let body = Shape {
             id: ShapeId(501),
+            text_box: true,
             xfrm: Some(Xfrm::new(50.0, 140.0, 860.0, 350.0)),
             text: Some(deckcraft_model::text::TextBody::from_text("one\ntwo")),
             ..Default::default()
@@ -414,6 +451,91 @@ mod tests {
         assert_eq!(shape(&s, 500).fill, Some(band_fill()));
     }
 
+    #[test]
+    fn slides_with_diagrams_or_other_graphics_get_no_ideas() {
+        // A filled autoshape with text (a diagram box) is not text to restack.
+        let mut s = deck(false);
+        let slide = Arc::make_mut(&mut Arc::make_mut(&mut s.doc_mut().unwrap().doc).slides[0]);
+        slide.shapes.push(Shape {
+            id: ShapeId(510),
+            xfrm: Some(Xfrm::new(300.0, 200.0, 200.0, 80.0)),
+            fill: Some(Fill::solid(deckcraft_model::ColorRef::rgb(Rgba::rgba(200, 80, 20, 255)))),
+            text: Some(deckcraft_model::text::TextBody::from_text("Solar wind")),
+            ..Default::default()
+        });
+        assert!(ideas_for(&s.doc().unwrap().doc, 0).is_empty());
+        assert!(s.execute("design.applyIdea", &json!({"id": "titleColumn"})).is_err());
+        // A connector too, and a hidden one does not count.
+        let mut s = deck(false);
+        let slide = Arc::make_mut(&mut Arc::make_mut(&mut s.doc_mut().unwrap().doc).slides[0]);
+        slide.shapes.push(Shape {
+            id: ShapeId(511),
+            kind: ShapeKind::Connector { start: None, end: None },
+            xfrm: Some(Xfrm::new(300.0, 200.0, 100.0, 0.0)),
+            ..Default::default()
+        });
+        assert!(ideas_for(&s.doc().unwrap().doc, 0).is_empty());
+        Arc::make_mut(&mut Arc::make_mut(&mut s.doc_mut().unwrap().doc).slides[0]).shapes[2].hidden = true;
+        assert_eq!(ideas_for(&s.doc().unwrap().doc, 0).len(), 3);
+    }
+
+    #[test]
+    fn two_visible_pictures_get_no_ideas_but_a_hidden_second_one_does_not_count() {
+        let mut s = deck(true);
+        let slide = Arc::make_mut(&mut Arc::make_mut(&mut s.doc_mut().unwrap().doc).slides[0]);
+        slide.shapes.push(Shape {
+            id: ShapeId(503),
+            kind: ShapeKind::Picture { fill: PictureFill::default() },
+            xfrm: Some(Xfrm::new(600.0, 300.0, 200.0, 100.0)),
+            ..Default::default()
+        });
+        assert!(ideas_for(&s.doc().unwrap().doc, 0).is_empty());
+        assert!(s.execute("design.applyIdea", &json!({"id": "pictureLeft"})).is_err());
+        Arc::make_mut(&mut Arc::make_mut(&mut s.doc_mut().unwrap().doc).slides[0]).shapes[3].hidden = true;
+        assert_eq!(ideas_for(&s.doc().unwrap().doc, 0).len(), 4);
+    }
+
+    #[test]
+    fn an_empty_text_box_blocks_ideas_only_when_it_shows() {
+        let mut s = deck(false);
+        let slide = Arc::make_mut(&mut Arc::make_mut(&mut s.doc_mut().unwrap().doc).slides[0]);
+        slide.shapes.push(Shape { id: ShapeId(512), text_box: true, xfrm: Some(Xfrm::new(10.0, 10.0, 100.0, 40.0)), ..Default::default() });
+        assert_eq!(ideas_for(&s.doc().unwrap().doc, 0).len(), 3, "invisible and empty: nothing in the way");
+        let slide = Arc::make_mut(&mut Arc::make_mut(&mut s.doc_mut().unwrap().doc).slides[0]);
+        slide.shapes[2].fill = Some(Fill::solid(deckcraft_model::ColorRef::rgb(Rgba::rgba(200, 80, 20, 255))));
+        assert!(ideas_for(&s.doc().unwrap().doc, 0).is_empty(), "a filled empty box would stay on top");
+    }
+
+    #[test]
+    fn an_empty_box_with_an_explicit_no_fill_does_not_block_ideas() {
+        let mut s = deck(false);
+        let slide = Arc::make_mut(&mut Arc::make_mut(&mut s.doc_mut().unwrap().doc).slides[0]);
+        slide.shapes.push(Shape {
+            id: ShapeId(512),
+            text_box: true,
+            xfrm: Some(Xfrm::new(10.0, 10.0, 100.0, 40.0)),
+            fill: Some(Fill::None),
+            ..Default::default()
+        });
+        assert_eq!(ideas_for(&s.doc().unwrap().doc, 0).len(), 3, "an explicit no fill shows nothing");
+    }
+
+    #[test]
+    fn an_empty_box_filled_through_its_style_blocks_ideas() {
+        let mut s = deck(false);
+        let slide = Arc::make_mut(&mut Arc::make_mut(&mut s.doc_mut().unwrap().doc).slides[0]);
+        let mut style = deckcraft_model::style::ShapeStyle::accent(deckcraft_model::SchemeSlot::Accent1);
+        style.line_ref.0 = 0;
+        slide.shapes.push(Shape {
+            id: ShapeId(512),
+            text_box: true,
+            xfrm: Some(Xfrm::new(10.0, 10.0, 100.0, 40.0)),
+            style: Some(style),
+            ..Default::default()
+        });
+        assert!(ideas_for(&s.doc().unwrap().doc, 0).is_empty(), "the theme fill shows, so the box would stay on top");
+    }
+
     #[test]
     fn cover_crop_matches_the_box_aspect() {
         let c = cover_crop(2.0, 1.0);

crates/engine/src/cmd/insert.rs

@@ -8,7 +8,10 @@ use deckcraft_model::text::{AutoFit, RunKind, TextBody};
 use deckcraft_model::{Chart, ColorRef, Fill, Geom, Line, MediaClip, Shape, ShapeId, ShapeKind, ShapeStyle, Table};
 use serde_json::{Value, json};
 
-use super::*;
+use super::{
+    CommandSpec, NO_ID_SPACE, always, bad, base64_decode, base64_encode, bool_or, bool_param, cmd, color_value, edit_shapes, has_doc, has_selection,
+    has_slide, has_text_or_shapes, ok, rect_param, str_param, usize_param, xfrm_of,
+};
 use crate::{EngineError, Result, Session};
 
 pub fn specs() -> Vec<CommandSpec> {
@@ -118,7 +121,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Chart Elements",
             ["Chart Design", "Chart Layouts"],
             None,
-            "{title?: string|null, legend?: b|t|l|r|null, dataLabels?: bool, gridlines?: bool, palette?, binCount?: n|null, binSize?: n|null, subtotals?: [point index], quartiles?: exclusive|inclusive, upDownBars?: bool, id?}",
+            "{title?: string|null, legend?: b|t|l|r|null, dataLabels?: bool, gridlines?: bool, palette?, binCount?: n|null, binSize?: n|null, subtotals?: [point index], quartiles?: exclusive|inclusive, upDownBars?: bool, textColor?: #RRGGBB|accent1..6|tx1…|null (title, axes, legend and labels; null for PowerPoint's default: the theme's text colour at 65 % plus 35 %, 595959 on a light theme), id?}",
             has_selection,
             chart_options
         ),
@@ -149,27 +152,38 @@ fn default_rect(s: &Session, w: f64, h: f64) -> Xfrm {
     Xfrm::new((size.width - w) / 2.0, (size.height - h) / 2.0, w, h)
 }
 
+/// The word an automatic shape name starts with ("Rectangle" in "Rectangle 3").
+pub(crate) fn auto_name_base(shape: &Shape) -> String {
+    match &shape.kind {
+        ShapeKind::Picture { .. } => "Picture".to_string(),
+        ShapeKind::Table(_) => "Table".to_string(),
+        ShapeKind::Chart(_) => "Chart".to_string(),
+        ShapeKind::Media(m) if m.video => "Video".to_string(),
+        ShapeKind::Media(_) => "Audio".to_string(),
+        ShapeKind::Model3d { .. } => "3D Model".to_string(),
+        _ if shape.text_box => "TextBox".to_string(),
+        _ => shape
+            .geom
+            .preset_name()
+            .and_then(deckcraft_geom::preset::info)
+            .map(|i| i.label.split(':').next().unwrap_or(i.label).trim().to_string())
+            .unwrap_or_else(|| "Shape".into()),
+    }
+}
+
+/// "{base} n" with the first `n` from the shape count + 1 that no shape on the slide already uses,
+/// so a gap left by a deleted shape never makes a second shape with the same name.
+pub(crate) fn first_free_name(base: &str, taken: &std::collections::HashSet<String>) -> String {
+    (taken.len() + 1..).map(|n| format!("{base} {n}")).find(|c| !taken.contains(c)).unwrap_or_default()
+}
+
 pub(crate) fn add_shape(s: &mut Session, cmd: &str, mut shape: Shape, select: bool) -> Result<ShapeId> {
     s.edit(|doc, sel| {
         shape.id = ShapeId(doc.alloc_id().ok_or_else(|| bad(cmd, NO_ID_SPACE))?);
         if shape.name.is_empty() {
-            let base = match &shape.kind {
-                ShapeKind::Picture { .. } => "Picture".to_string(),
-                ShapeKind::Table(_) => "Table".to_string(),
-                ShapeKind::Chart(_) => "Chart".to_string(),
-                ShapeKind::Media(m) if m.video => "Video".to_string(),
-                ShapeKind::Media(_) => "Audio".to_string(),
-                ShapeKind::Model3d { .. } => "3D Model".to_string(),
-                _ if shape.text_box => "TextBox".to_string(),
-                _ => shape
-                    .geom
-                    .preset_name()
-                    .and_then(deckcraft_geom::preset::info)
-                    .map(|i| i.label.split(':').next().unwrap_or(i.label).trim().to_string())
-                    .unwrap_or_else(|| "Shape".into()),
-            };
-            let n = super::current_shapes(doc, sel).map(|v| v.len()).unwrap_or(0) + 1;
-            shape.name = format!("{base} {n}");
+            let base = auto_name_base(&shape);
+            let taken = super::current_names(doc, sel);
+            shape.name = first_free_name(&base, &taken);
         }
         let id = shape.id;
         let list = crate::shapes_mut(doc, sel).ok_or_else(|| bad("insert", "no slide"))?;
@@ -577,7 +591,7 @@ fn commit_album(s: &mut Session, items: Vec<AlbumItem>, opts: AlbumOpts, replace
 }
 
 fn album_norm(s: &str) -> String {
-    s.chars().filter(|c| c.is_ascii_alphanumeric()).collect::<String>().to_ascii_lowercase()
+    s.chars().filter(char::is_ascii_alphanumeric).collect::<String>().to_ascii_lowercase()
 }
 
 fn album_layout(p: &Value) -> Result<AlbumLayout> {
@@ -770,7 +784,7 @@ fn image_px(bytes: &[u8]) -> (f64, f64) {
 }
 
 fn file_stem(name: &str) -> String {
-    let base = std::path::Path::new(name).file_name().and_then(|n| n.to_str()).unwrap_or(name);
+    let base = std::path::Path::new(name).file_name().and_then(std::ffi::OsStr::to_str).unwrap_or(name);
     let stem = match base.rsplit_once('.') {
         Some((s, ext)) if !s.is_empty() && !ext.is_empty() => s,
         _ => base,
@@ -1278,14 +1292,25 @@ fn media(s: &mut Session, p: &Value, video: bool) -> Result<Value> {
         }
         Err(_) => (0, 0, 0, false),
     };
-    let warning = (!playable).then(|| match &info {
-        Ok(i) => {
-            let codecs: Vec<&str> = i.audio.iter().map(|a| a.codec.as_str()).chain(i.video.iter().map(|v| v.codec.as_str())).collect();
-            format!("{name} was inserted, but it can't be played ({} isn't supported yet)", codecs.join(" / "))
-        }
-        Err(e) => format!("{name} was inserted, but it can't be played ({e})"),
-    });
     let decodable_video = info.as_ref().is_ok_and(|i| i.video.as_ref().is_some_and(|v| v.decodable));
+    let warning = if !playable {
+        Some(match &info {
+            Ok(i) => {
+                let codecs: Vec<&str> = i.audio.iter().map(|a| a.codec.as_str()).chain(i.video.iter().map(|v| v.codec.as_str())).collect();
+                format!("{name} was inserted, but it can't be played ({} isn't supported yet)", codecs.join(" / "))
+            }
+            Err(e) => format!("{name} was inserted, but it can't be played ({e})"),
+        })
+    } else if video && !decodable_video {
+        // A video codec without a decoder (VP8, say): the clip's audio still plays, but no frame
+        // can ever show — say so instead of leaving an unexplained black box (#1237).
+        info.as_ref()
+            .ok()
+            .and_then(|i| i.video.as_ref())
+            .map(|v| format!("{name} was inserted, but its video can't be played ({} isn't supported yet); only the audio plays", v.codec))
+    } else {
+        None
+    };
     let poster_png = if video && decodable_video { super::media::poster_png(&bytes, 0) } else { None };
     let size = s.doc()?.doc.slide_size;
     let rect = rect_param(p, "rect").unwrap_or_else(|| {
@@ -1804,7 +1829,19 @@ fn chart_options(s: &mut Session, p: &Value) -> Result<Value> {
     // Waterfall total points.
     let subtotals: Option<Vec<usize>> =
         p.get("subtotals").and_then(Value::as_array).map(|a| a.iter().filter_map(Value::as_u64).map(|i| i as usize).collect());
+    // Colour of the chart's text (title, axes, legend, data labels); null goes back to PowerPoint's
+    // default (tx1 at lumMod 65 % / lumOff 35 %).
+    let text_color = match p.get("textColor") {
+        None => None,
+        Some(Value::Null) => Some(None),
+        Some(v) => {
+            Some(Some(color_value(v).ok_or_else(|| bad("chart.options", "`textColor` is a colour: #RRGGBB, accent1…accent6, tx1…, or null"))?))
+        }
+    };
     with_chart(s, p, "chart.options", |c| {
+        if let Some(t) = &text_color {
+            c.text_color = t.clone();
+        }
         apply_bin_options(c, bin_count, bin_size);
         apply_subtotals_and_bars(c, p, subtotals.as_deref());
         if bin_count.is_some() || bin_size.is_some() || subtotals.is_some() {
@@ -1818,6 +1855,10 @@ fn chart_options(s: &mut Session, p: &Value) -> Result<Value> {
         }
         if let Some(v) = bool_param(p, "dataLabels") {
             c.data_labels = v;
+            // A series' own setting would otherwise keep overriding the chart-wide switch.
+            for series in &mut c.series {
+                series.data_labels = None;
+            }
         }
         if let Some(v) = bool_param(p, "gridlines") {
             c.gridlines = v;

crates/engine/src/cmd/inspect.rs

@@ -4,7 +4,7 @@ use deckcraft_model::resolve::{self, Ctx};
 use deckcraft_model::{Shape, ShapeKind};
 use serde_json::{Value, json};
 
-use super::*;
+use super::{CommandSpec, always, bad, cmd, has_doc, id_param, str_param, usize_param, xfrm_of};
 use crate::{Result, Session};
 
 pub fn specs() -> Vec<CommandSpec> {

crates/engine/src/cmd/media.rs

@@ -5,7 +5,7 @@
 use deckcraft_model::{MediaClip, ShapeId, ShapeKind};
 use serde_json::{Value, json};
 
-use super::*;
+use super::{CommandSpec, NO_ID_SPACE, bad, bool_param, cmd, edit_shapes, has_doc, targets};
 use crate::{EngineError, MediaStatus, Result, Session, UiRequest};
 
 pub fn specs() -> Vec<CommandSpec> {
@@ -179,7 +179,11 @@ fn gif_play(s: &mut Session, p: &Value) -> Result<Value> {
 
 #[cfg(test)]
 mod tests {
-    use super::*;
+    use deckcraft_model::ShapeId;
+    use serde_json::json;
+
+    use crate::cmd::base64_encode;
+    use crate::{MediaStatus, Session, UiRequest};
 
     fn wav() -> Vec<u8> {
         let rate = 8000u32;
@@ -286,4 +290,16 @@ mod tests {
         assert_eq!(r["playable"], false);
         assert!(r["warning"].as_str().is_some_and(|w| w.contains("can't be played")), "{r}");
     }
+
+    #[test]
+    fn a_vp8_webm_is_playable_and_warns_that_only_the_audio_plays() {
+        let mut s = Session::with_new();
+        let _ = s.execute("slide.new", &json!({"layout": "blank"}));
+        let clip = include_bytes!("../../../media/tests/fixtures/clip-vp8.webm");
+        let r = s.execute("insert.video", &json!({"name": "clip.webm", "data": base64_encode(clip)})).expect("insert");
+        assert_eq!(r["playable"], true, "the Vorbis track plays: {r}");
+        let w = r["warning"].as_str().expect("the VP8 track can't be shown");
+        assert!(w.contains("VP8") && w.contains("only the audio plays"), "{w}");
+        assert!(matches!(s.ui_requests.last(), Some(UiRequest::Message { .. })), "the warning reaches the status bar");
+    }
 }

crates/engine/src/cmd/merge.rs

@@ -9,7 +9,7 @@ use i_overlay::core::overlay_rule::OverlayRule;
 use i_overlay::float::single::SingleFloatOverlay;
 use serde_json::{Value, json};
 
-use super::*;
+use super::{CommandSpec, NO_ID_SPACE, bad, cmd, has_two, str_param, targets, xfrm_of};
 use crate::{Result, Session};
 
 /// Closed polygons (slide points) describing a filled area (non-zero winding).
@@ -255,7 +255,12 @@ fn merge(s: &mut Session, p: &Value) -> Result<Value> {
 
 #[cfg(test)]
 mod tests {
-    use super::*;
+    use deckcraft_model::{ShapeId, ShapeKind};
+    use serde_json::json;
+
+    use super::{Area, area_of, area_size, letters_of, merge_areas};
+    use crate::Session;
+    use crate::cmd::base64_encode;
 
     fn square(x: f64, y: f64, s: f64) -> Area {
         vec![vec![[x, y], [x + s, y], [x + s, y + s], [x, y + s]]]

crates/engine/src/cmd/mod.rs

@@ -355,6 +355,11 @@ pub(crate) fn with_param(p: &Value, key: &str, v: Value) -> Value {
 
 /// Targets: `ids` / `id` params, else the selection.
 pub(crate) fn targets(s: &Session, p: &Value) -> Result<Vec<ShapeId>> {
+    if let Some(a) = p.get("ids").and_then(Value::as_array)
+        && let Some(v) = a.iter().find(|v| v.as_u64().and_then(|v| u32::try_from(v).ok()).is_none())
+    {
+        return Err(bad("shape", format!("`ids` has an invalid shape id: {v}")));
+    }
     if let Some(ids) = ids_param(p, "ids")
         && !ids.is_empty()
     {
@@ -371,6 +376,8 @@ pub(crate) fn ok() -> Result<Value> {
 }
 
 /// Parse a colour param: `"#RRGGBB"`, `"accent1"`…, or `{"scheme":"accent2","lumMod":75000}`.
+/// A preset or system colour keeps its base: `{"preset":"red"}`,
+/// `{"system":"windowText","last":"#000000"}`.
 pub(crate) fn color_param(p: &Value, key: &str) -> Option<deckcraft_model::ColorRef> {
     let v = p.get(key)?;
     color_value(v)
@@ -391,6 +398,17 @@ pub(crate) fn color_value(v: &Value) -> Option<deckcraft_model::ColorRef> {
         Value::Object(o) => {
             let mut c = if let Some(s) = o.get("scheme").and_then(Value::as_str) {
                 ColorRef::scheme(deckcraft_color::SchemeSlot::from_xml(s)?)
+            } else if let Some(name) = o.get("preset").and_then(Value::as_str) {
+                if !deckcraft_color::is_preset_name(name) {
+                    return None;
+                }
+                ColorRef { base: deckcraft_model::ColorBase::Preset { name: name.to_string() }, mods: vec![] }
+            } else if let Some(name) = o.get("system").and_then(Value::as_str) {
+                if !deckcraft_color::is_system_name(name) {
+                    return None;
+                }
+                let last = deckcraft_color::Rgba::from_hex(o.get("last").and_then(Value::as_str)?)?;
+                ColorRef { base: deckcraft_model::ColorBase::System { name: name.to_string(), last }, mods: vec![] }
             } else {
                 ColorRef::rgb(deckcraft_color::Rgba::from_hex(o.get("rgb").and_then(Value::as_str)?)?)
             };
@@ -497,6 +515,10 @@ pub(crate) fn current_shapes<'a>(doc: &'a deckcraft_model::Presentation, sel: &c
     }
 }
 
+pub(crate) fn current_names(doc: &deckcraft_model::Presentation, sel: &crate::Selection) -> std::collections::HashSet<String> {
+    current_shapes(doc, sel).map(|v| v.iter().map(|s| s.name.clone()).collect()).unwrap_or_default()
+}
+
 /// The command palette runs a command with `{}`. True when the params doc names a value that
 /// call would have to supply (`path`, `rows`, `path? | data`), so the palette must not offer it.
 /// A name ending in `?` is optional. Text after `→` is the result, not an input.
@@ -639,4 +661,22 @@ mod tests {
         assert!(!needs_arguments(save.params));
         assert!(needs_arguments(audio.params));
     }
+
+    #[test]
+    fn preset_and_system_colors_keep_their_base() {
+        use deckcraft_color::{ColorTransform, Rgba};
+        use deckcraft_model::{ColorBase, ColorRef};
+        use serde_json::json;
+        let preset = color_value(&json!({"preset": "red", "lumMod": 50_000}));
+        assert_eq!(preset, Some(ColorRef { base: ColorBase::Preset { name: "red".into() }, mods: vec![ColorTransform::LumMod(50_000)] }));
+        let system = color_value(&json!({"system": "windowText", "last": "#123456"}));
+        assert_eq!(system, Some(ColorRef { base: ColorBase::System { name: "windowText".into(), last: Rgba::rgb(0x12, 0x34, 0x56) }, mods: vec![] }));
+        assert_eq!(color_value(&json!({"system": "windowText"})), None, "a system color needs its last value");
+        assert_eq!(color_value(&json!({"preset": "notAColor"})), None);
+        assert_eq!(color_value(&json!({"system": "notAColor", "last": "#000000"})), None);
+        for name in ["aliceBlue", "darkBlue", "ltSlateGrey"] {
+            assert!(color_value(&json!({"preset": name})).is_some(), "{name}");
+        }
+        assert!(color_value(&json!({"system": "3dDkShadow", "last": "#000000"})).is_some());
+    }
 }

crates/engine/src/cmd/picture_style.rs

@@ -6,7 +6,7 @@ use deckcraft_model::style::{Effects, Reflection, Shadow};
 use deckcraft_model::{ColorRef, Geom, Line, Shape};
 use serde_json::{Value, json};
 
-use super::*;
+use super::{CommandSpec, always, bad, cmd, edit_shapes, has_selection, str_param};
 use crate::{Result, Session};
 
 pub fn specs() -> Vec<CommandSpec> {

crates/engine/src/cmd/points.rs

@@ -10,7 +10,7 @@ use deckcraft_geom::{PathEl, Point, Xfrm};
 use deckcraft_model::{CustomPath, Geom, Shape, ShapeId, ShapeKind};
 use serde_json::{Value, json};
 
-use super::*;
+use super::{CommandSpec, bad, cmd, f64_param, has_selection, id_param, ok, str_param, xfrm_of};
 use crate::{Result, Session};
 
 pub fn specs() -> Vec<CommandSpec> {
@@ -24,7 +24,7 @@ pub fn specs() -> Vec<CommandSpec> {
             has_selection,
             edit_points
         ),
-        cmd!(query "shape.points", "Points", [], None, "{id?} → {id, paths: [[[x, y] slide pt]], types: [[smooth|straight|corner]]} vertices of a freeform", has_selection, points),
+        cmd!(query "shape.points", "Points", [], None, "{id?} → {id, paths: [[[x, y] slide pt]], types: [[smooth|straight|corner]], segments: [[straight|curved|null]]} vertices of a freeform and the segment ending at each", has_selection, points),
         cmd!("shape.movePoint", "Move Point", [], None, "{path?: 0, index, x, y: slide pt, id?}", has_selection, move_point),
         cmd!(
             "shape.addPoint",
@@ -54,6 +54,42 @@ pub fn specs() -> Vec<CommandSpec> {
             move_handle
         ),
         cmd!("shape.deletePoint", "Delete Point", [], None, "{path?: 0, index, id?}", has_selection, delete_point),
+        cmd!(
+            "shape.deleteSegment",
+            "Delete Segment",
+            [],
+            None,
+            "{path?: 0, segment: index of the vertex ending it, id?}: removes a segment of a closed outline, which opens there; it starts at the segment's end and ends at its start",
+            has_selection,
+            delete_segment
+        ),
+        cmd!(
+            "shape.segmentType",
+            "Segment Type",
+            [],
+            None,
+            "{path?: 0, segment: index of the vertex ending it, type: straight|curved, id?} — straight drops the segment's handles; curved gives it handles at its thirds",
+            has_selection,
+            segment_type
+        ),
+        cmd!(
+            "shape.openPath",
+            "Open Path",
+            [],
+            None,
+            "{path?: 0, index, id?} — break a closed outline at a point, which becomes its two ends",
+            has_selection,
+            open_path
+        ),
+        cmd!(
+            "shape.closePath",
+            "Close Path",
+            [],
+            None,
+            "{path?: 0, index: any point of the open outline, id?} — join its ends with a straight segment (one point when they meet)",
+            has_selection,
+            close_path
+        ),
     ]
 }
 
@@ -281,6 +317,92 @@ fn remove_vertex(segs: &mut Vec<Seg>, si: usize) -> bool {
     true
 }
 
+/// The sub-path holding segment `si`: from its move up to the next move (or the end).
+fn subpath(segs: &[Seg], si: usize) -> (usize, usize) {
+    let from = segs.get(..=si).and_then(|s| s.iter().rposition(|x| matches!(x, Seg::M(_)))).unwrap_or(0);
+    let to = (si + 1..segs.len()).find(|j| matches!(segs.get(*j), Some(Seg::M(_)))).unwrap_or(segs.len());
+    (from, to)
+}
+
+/// The segment that ends at the vertex ending segment `si`: the closing edge for a closed
+/// sub-path's start, none for an open one's.
+fn ending_segment(segs: &[Seg], si: usize) -> Option<usize> {
+    if matches!(segs.get(si), Some(Seg::M(_))) {
+        (si + 1..segs.len()).take_while(|j| !matches!(segs.get(*j), Some(Seg::M(_)))).find(|j| closes_onto_start(segs, *j))
+    } else {
+        Some(si)
+    }
+}
+
+/// Whether segment `j` is a straight line or a curve.
+fn segment_kind(segs: &[Seg], j: usize) -> Option<&'static str> {
+    match segs.get(j)? {
+        Seg::L(_) => Some("straight"),
+        Seg::C(..) | Seg::Q(..) => Some("curved"),
+        Seg::M(_) | Seg::Z => None,
+    }
+}
+
+/// Makes segment `j` a straight line (dropping its handles) or a curve with handles at its
+/// thirds, so it keeps its shape until a handle is dragged.
+fn set_segment(segs: &mut [Seg], j: usize, curved: bool) {
+    if curved {
+        to_cubic(segs, j);
+    } else if let Some(s) = segs.get_mut(j)
+        && let Seg::C(_, _, p) | Seg::Q(_, p) = *s
+    {
+        *s = Seg::L(p);
+    }
+}
+
+/// Opens the closed sub-path through the vertex ending segment `si` there: it now starts and ends
+/// on that vertex, as two points. Returns false for an open sub-path.
+fn open_at(segs: &mut Vec<Seg>, si: usize) -> bool {
+    let (from, to) = subpath(segs, si);
+    let Some(z) = to.checked_sub(1).filter(|z| *z > si && matches!(segs.get(*z), Some(Seg::Z))) else { return false };
+    let Some(v) = segs.get(si).and_then(Seg::end) else { return false };
+    let (Some(after), Some(before)) = (segs.get(si + 1..z), segs.get(from + 1..=si)) else { return false };
+    let mut out = vec![Seg::M(v)];
+    out.extend_from_slice(after);
+    out.extend_from_slice(before);
+    segs.splice(from..to, out);
+    true
+}
+
+/// Deletes the segment ending at the vertex ending segment `si` from its closed sub-path, which
+/// opens there: it now starts at the segment's end and ends at its start. Returns false for an
+/// open sub-path.
+fn delete_segment_at(segs: &mut Vec<Seg>, si: usize) -> bool {
+    let (from, _) = subpath(segs, si);
+    if !open_at(segs, si) {
+        return false;
+    }
+    // The deleted segment now ends the sub-path.
+    let (_, to) = subpath(segs, from);
+    if to > from + 1 {
+        segs.remove(to - 1);
+    }
+    true
+}
+
+/// Closes the open sub-path through the vertex ending segment `si`: a straight segment joins its
+/// ends, or they become one point when they meet. Returns false for a closed sub-path.
+fn close_at(segs: &mut Vec<Seg>, si: usize) -> bool {
+    let (from, to) = subpath(segs, si);
+    let last = to.saturating_sub(1);
+    if last <= from || matches!(segs.get(last), Some(Seg::Z)) {
+        return false;
+    }
+    let (Some(Seg::M(start)), Some(end)) = (segs.get(from).copied(), segs.get(last).and_then(Seg::end)) else { return false };
+    let mut add = Vec::new();
+    if (start - end).hypot() >= 1e-6 {
+        add.push(Seg::L(start));
+    }
+    add.push(Seg::Z);
+    segs.splice(to..to, add);
+    true
+}
+
 /// Custom paths of a preset shape, in shape-local points.
 fn to_custom(sh: &Shape, w: f64, h: f64) -> Vec<CustomPath> {
     let geo = deckcraft_render::shape_geometry(sh, w, h);
@@ -402,6 +524,7 @@ pub(crate) fn prepare(s: &mut Session, id: ShapeId) -> Result<()> {
 fn edit_points(s: &mut Session, p: &Value) -> Result<Value> {
     let on = p.get("on").and_then(Value::as_bool).unwrap_or(s.tool.edit_points.is_none());
     s.tool.edit_vertex = None;
+    s.tool.edit_segment = None;
     if !on {
         s.tool.edit_points = None;
         return Ok(json!({"editing": Value::Null}));
@@ -436,17 +559,16 @@ fn points(s: &mut Session, p: &Value) -> Result<Value> {
     let sh = st.shape(id).ok_or_else(|| bad("shape.points", "no such shape"))?;
     let paths: Vec<Vec<[f64; 2]>> =
         slide_vertices(&st.doc, &st.selection, sh).into_iter().map(|v| v.into_iter().map(|q| [q.x, q.y]).collect()).collect();
-    let types: Vec<Vec<&str>> = match &sh.geom {
-        Geom::Custom { paths } => paths
-            .iter()
-            .map(|cp| {
-                let segs = parse(&cp.d);
-                vertices(&segs).iter().map(|si| point_kind(&segs, *si)).collect()
-            })
-            .collect(),
-        Geom::Preset { .. } => vec![],
-    };
-    Ok(json!({"id": id.0, "paths": paths, "types": types}))
+    let (mut types, mut kinds): (Vec<Vec<&str>>, Vec<Vec<Option<&str>>>) = (vec![], vec![]);
+    if let Geom::Custom { paths } = &sh.geom {
+        for cp in paths {
+            let segs = parse(&cp.d);
+            let vs = vertices(&segs);
+            types.push(vs.iter().map(|si| point_kind(&segs, *si)).collect());
+            kinds.push(vs.iter().map(|si| ending_segment(&segs, *si).and_then(|j| segment_kind(&segs, j))).collect());
+        }
+    }
+    Ok(json!({"id": id.0, "paths": paths, "types": types, "segments": kinds}))
 }
 
 /// Runs `f` on the segments of path `path` of `id` (in shape-local points), then refits the box.
@@ -502,26 +624,26 @@ fn add_point(s: &mut Session, p: &Value) -> Result<Value> {
     let path = p.get("path").and_then(Value::as_u64).unwrap_or(0) as usize;
     let seg = index_param(p, "segment", "shape.addPoint")?;
     let t = f64_param(p, "t").filter(|t| t.is_finite()).unwrap_or(0.5).clamp(0.01, 0.99);
-    edit_path(s, id, path, "shape.addPoint", move |segs, vs, _| {
+    let r = edit_path(s, id, path, "shape.addPoint", move |segs, vs, _| {
         let si = *vs.get(seg).ok_or_else(|| bad("shape.addPoint", "no such segment"))?;
         // The closing edge of a closed outline ends at the start: split it, not the start.
-        let si = if matches!(segs.get(si), Some(Seg::M(_))) {
-            (si + 1..segs.len()).find(|j| closes_onto_start(segs, *j)).ok_or_else(|| bad("shape.addPoint", "the first point ends no segment"))?
-        } else {
-            si
-        };
+        let si = ending_segment(segs, si).ok_or_else(|| bad("shape.addPoint", "the first point ends no segment"))?;
         if split(segs, si, t) { Ok(true) } else { Err(bad("shape.addPoint", "no segment ends at that point")) }
-    })
+    })?;
+    forget_kinds(s, path);
+    Ok(r)
 }
 
 fn delete_point(s: &mut Session, p: &Value) -> Result<Value> {
     let id = target(s, p, "shape.deletePoint")?;
     let path = p.get("path").and_then(Value::as_u64).unwrap_or(0) as usize;
     let index = index_param(p, "index", "shape.deletePoint")?;
-    edit_path(s, id, path, "shape.deletePoint", move |segs, vs, _| {
+    let r = edit_path(s, id, path, "shape.deletePoint", move |segs, vs, _| {
         let si = *vs.get(index).ok_or_else(|| bad("shape.deletePoint", "no such point"))?;
         if remove_vertex(segs, si) { Ok(true) } else { Err(bad("shape.deletePoint", "an outline keeps at least two points")) }
-    })
+    })?;
+    forget_kinds(s, path);
+    Ok(r)
 }
 
 /// The vertex of `sh` near slide point `p`: (path, index).
@@ -568,15 +690,35 @@ pub fn segment_at(doc: &deckcraft_model::Presentation, sel: &crate::Selection, s
                 vs.iter().position(|v| *v == si)
             };
             let Some(ev) = end_vertex else { continue };
+            let mut near: Option<(f64, f64)> = None;
             for k in 1..32 {
                 let t = k as f64 / 32.0;
                 if let Some(q) = at(t) {
                     let d = (q - local).hypot();
-                    if d <= tol && best.is_none_or(|b| d < b.0) {
-                        best = Some((d, pi, ev, t));
+                    if d <= tol && near.is_none_or(|n| d < n.0) {
+                        near = Some((d, t));
                     }
                 }
             }
+            let Some((mut d, mut t)) = near else { continue };
+            // Narrow `t` down to the nearest place on the segment, where Add Point puts the point.
+            let mut step = 1.0 / 32.0;
+            for _ in 0..4 {
+                step /= 8.0;
+                let c = t;
+                for k in -8..=8 {
+                    let u = (c + f64::from(k) * step).clamp(0.0, 1.0);
+                    if let Some(q) = at(u) {
+                        let e = (q - local).hypot();
+                        if e < d {
+                            (d, t) = (e, u);
+                        }
+                    }
+                }
+            }
+            if best.is_none_or(|b| d < b.0) {
+                best = Some((d, pi, ev, t));
+            }
         }
     }
     best.map(|(_, pi, ev, t)| (pi, ev, t))
@@ -740,7 +882,7 @@ fn point_type(s: &mut Session, p: &Value) -> Result<Value> {
         _ => return Err(bad("shape.pointType", "`type` is smooth, straight or corner")),
     };
     // A straight point's handles can be as long as each other; remember the choice for drags.
-    s.tool.vertex_kind = Some((path, index, kind.clone()));
+    s.tool.vertex_kind = Some((id, path, index, kind.clone()));
     edit_path(s, id, path, "shape.pointType", move |segs, vs, _| {
         let si = *vs.get(index).ok_or_else(|| bad("shape.pointType", "no such point"))?;
         set_type(segs, si, &kind);
@@ -784,3 +926,98 @@ pub fn kind_of(sh: &Shape, path: usize, index: usize) -> Option<&'static str> {
 pub(crate) fn move_handle_raw(s: &mut Session, p: &Value) -> Result<Value> {
     move_handle(s, p)
 }
+
+fn segment_type(s: &mut Session, p: &Value) -> Result<Value> {
+    let id = target(s, p, "shape.segmentType")?;
+    let path = p.get("path").and_then(Value::as_u64).unwrap_or(0) as usize;
+    let seg = index_param(p, "segment", "shape.segmentType")?;
+    let curved = match str_param(p, "type") {
+        Some("straight") => false,
+        Some("curved") => true,
+        _ => return Err(bad("shape.segmentType", "`type` is straight or curved")),
+    };
+    // Already that type: nothing to change, so no undo step.
+    let want = if curved { "curved" } else { "straight" };
+    if s.doc()?.shape(id).is_some_and(|sh| segment_kind_of(sh, path, seg) == Some(want)) {
+        return ok();
+    }
+    edit_path(s, id, path, "shape.segmentType", move |segs, vs, _| {
+        let si = *vs.get(seg).ok_or_else(|| bad("shape.segmentType", "no such segment"))?;
+        let j = ending_segment(segs, si).ok_or_else(|| bad("shape.segmentType", "the first point of an open outline ends no segment"))?;
+        set_segment(segs, j, curved);
+        Ok(true)
+    })
+}
+
+fn open_path(s: &mut Session, p: &Value) -> Result<Value> {
+    let id = target(s, p, "shape.openPath")?;
+    let path = p.get("path").and_then(Value::as_u64).unwrap_or(0) as usize;
+    let index = index_param(p, "index", "shape.openPath")?;
+    let r = edit_path(s, id, path, "shape.openPath", move |segs, vs, _| {
+        let si = *vs.get(index).ok_or_else(|| bad("shape.openPath", "no such point"))?;
+        if open_at(segs, si) { Ok(true) } else { Err(bad("shape.openPath", "the outline is open already")) }
+    })?;
+    forget_kinds(s, path);
+    Ok(r)
+}
+
+fn close_path(s: &mut Session, p: &Value) -> Result<Value> {
+    let id = target(s, p, "shape.closePath")?;
+    let path = p.get("path").and_then(Value::as_u64).unwrap_or(0) as usize;
+    let index = index_param(p, "index", "shape.closePath")?;
+    let r = edit_path(s, id, path, "shape.closePath", move |segs, vs, _| {
+        let si = *vs.get(index).ok_or_else(|| bad("shape.closePath", "no such point"))?;
+        if close_at(segs, si) { Ok(true) } else { Err(bad("shape.closePath", "the outline is closed already")) }
+    })?;
+    forget_kinds(s, path);
+    Ok(r)
+}
+
+fn delete_segment(s: &mut Session, p: &Value) -> Result<Value> {
+    let id = target(s, p, "shape.deleteSegment")?;
+    let path = p.get("path").and_then(Value::as_u64).unwrap_or(0) as usize;
+    let seg = index_param(p, "segment", "shape.deleteSegment")?;
+    let r = edit_path(s, id, path, "shape.deleteSegment", move |segs, vs, _| {
+        let si = *vs.get(seg).ok_or_else(|| bad("shape.deleteSegment", "no such segment"))?;
+        if ending_segment(segs, si).is_none() {
+            return Err(bad("shape.deleteSegment", "the first point of an open outline ends no segment"));
+        }
+        if delete_segment_at(segs, si) { Ok(true) } else { Err(bad("shape.deleteSegment", "only a segment of a closed outline can be deleted")) }
+    })?;
+    forget_kinds(s, path);
+    Ok(r)
+}
+
+/// The point where the segment ending at vertex `index` of path `path` of `sh` starts.
+pub fn segment_start_of(sh: &Shape, path: usize, index: usize) -> Option<usize> {
+    let Geom::Custom { paths } = &sh.geom else { return None };
+    let segs = parse(&paths.get(path)?.d);
+    let vs = vertices(&segs);
+    let j = ending_segment(&segs, *vs.get(index)?)?;
+    vs.iter().position(|v| Some(*v) == j.checked_sub(1))
+}
+
+/// Adding, deleting, opening or closing renumbers the points of `path`: a point type remembered
+/// for one of them would follow the wrong point.
+fn forget_kinds(s: &mut Session, path: usize) {
+    if s.tool.vertex_kind.as_ref().is_some_and(|k| k.1 == path) {
+        s.tool.vertex_kind = None;
+    }
+}
+
+/// Whether the segment ending at vertex `index` of path `path` of `sh` is straight or curved.
+pub fn segment_kind_of(sh: &Shape, path: usize, index: usize) -> Option<&'static str> {
+    let Geom::Custom { paths } = &sh.geom else { return None };
+    let segs = parse(&paths.get(path)?.d);
+    let si = *vertices(&segs).get(index)?;
+    segment_kind(&segs, ending_segment(&segs, si)?)
+}
+
+/// Whether the outline through vertex `index` of path `path` of `sh` is closed.
+pub fn closed_at(sh: &Shape, path: usize, index: usize) -> Option<bool> {
+    let Geom::Custom { paths } = &sh.geom else { return None };
+    let segs = parse(&paths.get(path)?.d);
+    let si = *vertices(&segs).get(index)?;
+    let (_, to) = subpath(&segs, si);
+    Some(matches!(segs.get(to.checked_sub(1)?), Some(Seg::Z)))
+}

crates/engine/src/cmd/recolor.rs

@@ -6,7 +6,7 @@ use deckcraft_model::style::{PictureAdjust, PictureMode};
 use deckcraft_model::{ColorRef, Shape, ShapeId, ShapeKind};
 use serde_json::{Value, json};
 
-use super::*;
+use super::{CommandSpec, always, bad, bool_or, cmd, current_shapes, edit_shapes, has_selection, str_param, targets, text, xfrm_of};
 use crate::{Result, Session};
 
 pub fn specs() -> Vec<CommandSpec> {

crates/engine/src/cmd/reuse.rs

@@ -10,22 +10,41 @@ use std::collections::HashMap;
 use std::sync::Arc;
 
 use deckcraft_model::text::{Action, Hyperlink, RunProps, TextBody};
-use deckcraft_model::{LayoutId, MasterId, MediaId, Presentation, ShapeId, ShapeKind, Slide, SlideId};
+use deckcraft_model::{LayoutId, Master, MasterId, MediaId, Presentation, ShapeId, ShapeKind, Slide, SlideId};
 use serde_json::{Value, json};
 
-use super::*;
+use super::{CommandSpec, NO_ID_SPACE, bad, bool_or, cmd, has_doc, usize_param};
 use crate::{Result, Session, media_refs};
 
 pub fn specs() -> Vec<CommandSpec> {
-    vec![cmd!(
-        "slide.reuse",
-        "Reuse Slides…",
-        ["Home", "Slides", "New Slide"],
-        None,
-        "{path? | data: base64, name?, slides?: [index] (0-based, default all), keepFormatting?: bool (default false: use the destination theme), at?: index (default after the current slide)}",
-        has_doc,
-        reuse
-    )]
+    vec![
+        cmd!(
+            query "slide.reuseList",
+            "List Slides to Reuse",
+            [],
+            None,
+            "{path | data: base64, name?} → {name, slides: [{index, title, hidden}]}: the slides of another presentation, for choosing which ones `slide.reuse` brings in",
+            has_doc,
+            reuse_list
+        ),
+        cmd!(
+            "slide.reuse",
+            "Reuse Slides…",
+            ["Home", "Slides", "New Slide"],
+            None,
+            "{path? | data: base64, name?, slides?: [index] (0-based, default all), keepFormatting?: bool (default false: use the destination theme), at?: index (default after the current slide)}",
+            has_doc,
+            reuse
+        ),
+    ]
+}
+
+fn reuse_list(_s: &mut Session, p: &Value) -> Result<Value> {
+    let (name, bytes) = super::insert::media_bytes(p, "slide.reuseList")?;
+    let src = super::file::open_presentation(&name, &bytes)?;
+    let slides: Vec<Value> =
+        src.slides.iter().enumerate().map(|(index, sl)| json!({"index": index, "title": sl.title(), "hidden": sl.hidden})).collect();
+    Ok(json!({"name": name, "slides": slides}))
 }
 
 /// Point every media id under `x` at its copy in the destination (`map`: source → destination).
@@ -114,9 +133,9 @@ fn relink_shapes(shapes: &mut [deckcraft_model::Shape], map: &HashMap<SlideId, S
 }
 
 /// Fresh shape ids for `shapes`, and the old → new map.
-fn renumber(doc: &mut Presentation, shapes: &mut [deckcraft_model::Shape]) -> Result<HashMap<ShapeId, ShapeId>> {
+fn renumber(cmd: &str, doc: &mut Presentation, shapes: &mut [deckcraft_model::Shape]) -> Result<HashMap<ShapeId, ShapeId>> {
     let old = shape_ids(shapes);
-    super::edit::reid("slide.reuse", doc, shapes)?;
+    super::edit::reid(cmd, doc, shapes)?;
     let map: HashMap<ShapeId, ShapeId> = old.into_iter().zip(shape_ids(shapes)).collect();
     remap_connectors(shapes, &map, 0);
     Ok(map)
@@ -171,19 +190,7 @@ fn reuse(s: &mut Session, p: &Value) -> Result<Value> {
                     continue;
                 }
                 masters_done.push(m.id);
-                let mut used = vec![];
-                media_refs::visit::master(m, &mut |id: &MediaId| used.push(*id));
-                copy_media(doc, &src, &used, &mut media_map)?;
-                let mut m = m.clone();
-                media_refs::visit_mut::master(&mut m, &mut remap(&media_map));
-                m.id = MasterId(doc.alloc_id().ok_or_else(|| bad("slide.reuse", NO_ID_SPACE))?);
-                renumber(doc, &mut m.shapes)?;
-                for l in &mut m.layouts {
-                    let new = LayoutId(doc.alloc_id().ok_or_else(|| bad("slide.reuse", NO_ID_SPACE))?);
-                    layout_map.insert(l.id, new);
-                    l.id = new;
-                    renumber(doc, &mut l.shapes)?;
-                }
+                let m = import_master("slide.reuse", doc, &src, m, &mut media_map, &mut layout_map)?;
                 doc.masters.push(Arc::new(m));
             }
         }
@@ -192,11 +199,11 @@ fn reuse(s: &mut Session, p: &Value) -> Result<Value> {
         let mut slide_map: HashMap<SlideId, SlideId> = HashMap::new();
         for &i in &picked {
             let Some(from) = src.slides.get(i) else { continue };
-            copy_media(doc, &src, &media_refs::slide_media(from), &mut media_map)?;
+            copy_media("slide.reuse", doc, &src, &media_refs::slide_media(from), &mut media_map)?;
             let mut sl: Slide = from.as_ref().clone();
             media_refs::visit_mut::slide(&mut sl, &mut remap(&media_map));
             sl.id = SlideId(doc.alloc_id().ok_or_else(|| bad("slide.reuse", NO_ID_SPACE))?);
-            let map = renumber(doc, &mut sl.shapes)?;
+            let map = renumber("slide.reuse", doc, &mut sl.shapes)?;
             for a in &mut sl.animations {
                 a.shape = map.get(&a.shape).copied().unwrap_or(a.shape);
                 a.trigger = a.trigger.map(|t| map.get(&t).copied().unwrap_or(t));
@@ -227,9 +234,35 @@ fn reuse(s: &mut Session, p: &Value) -> Result<Value> {
     })
 }
 
+/// A copy of `src`'s master `m` ready to join `doc`: its media copied in, fresh master, layout and
+/// shape ids. `layouts` gains each source layout id → its copy's.
+pub(crate) fn import_master(
+    cmd: &str,
+    doc: &mut Presentation,
+    src: &Presentation,
+    m: &Master,
+    media_map: &mut HashMap<MediaId, MediaId>,
+    layouts: &mut HashMap<LayoutId, LayoutId>,
+) -> Result<Master> {
+    let mut used = vec![];
+    media_refs::visit::master(m, &mut |id: &MediaId| used.push(*id));
+    copy_media(cmd, doc, src, &used, media_map)?;
+    let mut m = m.clone();
+    media_refs::visit_mut::master(&mut m, &mut remap(media_map));
+    m.id = MasterId(doc.alloc_id().ok_or_else(|| bad(cmd, NO_ID_SPACE))?);
+    renumber(cmd, doc, &mut m.shapes)?;
+    for l in &mut m.layouts {
+        let new = LayoutId(doc.alloc_id().ok_or_else(|| bad(cmd, NO_ID_SPACE))?);
+        layouts.insert(l.id, new);
+        l.id = new;
+        renumber(cmd, doc, &mut l.shapes)?;
+    }
+    Ok(m)
+}
+
 /// Copy the source media `used` into `doc` under fresh ids, once each (identical bytes already in
 /// `doc` are shared; a linked item keeps its link).
-fn copy_media(doc: &mut Presentation, src: &Presentation, used: &[MediaId], map: &mut HashMap<MediaId, MediaId>) -> Result<()> {
+fn copy_media(cmd: &str, doc: &mut Presentation, src: &Presentation, used: &[MediaId], map: &mut HashMap<MediaId, MediaId>) -> Result<()> {
     for &id in used {
         if map.contains_key(&id) {
             continue;
@@ -237,12 +270,12 @@ fn copy_media(doc: &mut Presentation, src: &Presentation, used: &[MediaId], map:
         let Some(m) = src.media(id) else { continue };
         let new = if m.link.is_some() {
             let mut item = m.clone();
-            item.id = MediaId(doc.alloc_id().ok_or_else(|| bad("slide.reuse", NO_ID_SPACE))?);
+            item.id = MediaId(doc.alloc_id().ok_or_else(|| bad(cmd, NO_ID_SPACE))?);
             let new = item.id;
             doc.media.push(item);
             new
         } else {
-            doc.add_media(&m.name, &m.content_type, m.data.as_ref().clone()).ok_or_else(|| bad("slide.reuse", NO_ID_SPACE))?
+            doc.add_media(&m.name, &m.content_type, m.data.as_ref().clone()).ok_or_else(|| bad(cmd, NO_ID_SPACE))?
         };
         map.insert(id, new);
     }
@@ -397,4 +430,34 @@ mod tests {
         assert_eq!(click(first.shapes.get(2)), Some(Action::Slide { slide: left_behind }), "a slide not reused keeps its link");
         assert_eq!(click(copy(1).shapes.first()), to(0), "a link back to an earlier copy follows too");
     }
+
+    /// The list that lets a dialog offer the slides of the other file; picking from it brings in
+    /// exactly those.
+    #[test]
+    fn reuse_list_names_the_slides_and_the_picked_ones_come_in() {
+        let mut src = Session::with_new();
+        for t in ["Alpha", "Beta", "Gamma"] {
+            src.execute("slide.new", &json!({"layout": "titleAndContent", "title": t})).expect("new");
+        }
+        let last_slide = src.doc().expect("doc").doc.slides.len() - 1;
+        src.execute("slide.hide", &json!({"index": last_slide})).expect("hide");
+        let bytes = crate::cmd::file::save_bytes(&src.doc().expect("doc").doc, "deckcraft").expect("save");
+        let data = super::super::base64_encode(&bytes);
+
+        let mut s = Session::with_new();
+        let listed = s.execute("slide.reuseList", &json!({"data": data, "name": "src.deckcraft"})).expect("list");
+        let slides = listed["slides"].as_array().expect("slides");
+        let title = |i: usize| slides.iter().find(|x| x["index"] == i).and_then(|x| x["title"].as_str()).unwrap_or_default().to_string();
+        assert!(slides.len() >= 3);
+        let (a, b, g) = (title(slides.len() - 3), title(slides.len() - 2), title(slides.len() - 1));
+        assert_eq!((a.as_str(), b.as_str(), g.as_str()), ("Alpha", "Beta", "Gamma"));
+        assert_eq!(slides.last().map(|x| x["hidden"].clone()), Some(json!(true)));
+        assert_eq!(s.doc().expect("doc").doc.slides.len(), 1, "listing changes nothing");
+
+        let last = slides.len() - 1;
+        s.execute("slide.reuse", &json!({"data": data, "name": "src.deckcraft", "slides": [last - 2, last]})).expect("reuse");
+        let titles: Vec<String> = s.doc().expect("doc").doc.slides.iter().map(|x| x.title()).collect();
+        assert!(titles.iter().any(|t| t == "Alpha") && titles.iter().any(|t| t == "Gamma"));
+        assert!(!titles.iter().any(|t| t == "Beta"), "a slide that was not picked stays out");
+    }
 }

crates/engine/src/cmd/review.rs

@@ -5,7 +5,9 @@ use std::sync::Arc;
 use deckcraft_model::Comment;
 use serde_json::{Value, json};
 
-use super::*;
+use super::{
+    CommandSpec, always, bad, base64_decode, bool_or, bool_param, cmd, f64_or, has_doc, has_slide, has_text, id_param, ok, str_param, usize_param,
+};
 use crate::{Result, Session, Target, UiRequest};
 
 pub fn specs() -> Vec<CommandSpec> {
@@ -59,6 +61,15 @@ pub fn specs() -> Vec<CommandSpec> {
         cmd!(noundo "review.compare", "Compare", ["Review", "Compare"], None, "{path} | {name, data: base64} — compare with a revised copy → {name, changes}", has_doc, compare),
         cmd!(query "review.revisions", "Revisions", [], None, "{} → {name, changes: [{kind: inserted|deleted|changed, slide, revised, details}]}", has_doc, revisions),
         cmd!("review.accept", "Accept Revision", ["Review", "Compare"], None, "{index} | {all: true}", comparing, accept),
+        cmd!(
+            noundo "review.reject",
+            "Reject Revision",
+            ["Review", "Compare"],
+            None,
+            "{index} | {all: true} → {rejected} (drop revisions without applying them: the open deck stays as it is; not an undo step)",
+            comparing,
+            reject
+        ),
         cmd!(noundo "review.endCompare", "End Review", ["Review", "Compare"], None, "{}", comparing, end_compare),
         cmd!(noundo "show.fromStart", "Play from Start", ["Slide Show", "Start Slide Show"], Some("Cmd+Shift+Enter"), "{}", has_slide, |s, _| start(s, 0)),
         cmd!(noundo "show.fromCurrent", "Play from Current Slide", ["Slide Show", "Start Slide Show"], Some("Cmd+Enter"), "{}", has_slide, |s, _| {
@@ -421,7 +432,7 @@ fn spelling_change(s: &mut Session, p: &Value) -> Result<Value> {
     // One exact occurrence (a squiggled word): paragraph `para`, from character `start`.
     if let (Some(id), Some(para), Some(start)) = (shape, usize_param(p, "para"), usize_param(p, "start")) {
         let id = deckcraft_model::ShapeId(u32::try_from(id).map_err(|_| bad("review.spellingChange", "bad `shape`"))?);
-        let end = start + word.chars().count();
+        let end = start.checked_add(word.chars().count()).ok_or_else(|| bad("review.spellingChange", "bad `start`"))?;
         let cell = usize_param(p, "row").zip(usize_param(p, "col"));
         let slide = {
             let st = s.doc()?;
@@ -655,7 +666,7 @@ fn revised_bytes(p: &Value) -> Result<(String, Vec<u8>)> {
 fn revisions_json(st: &crate::DocState) -> Result<Value> {
     let c = st.compare.as_ref().ok_or_else(|| bad("review.revisions", "not comparing"))?;
     let name = std::path::Path::new(&c.name).file_name().map(|n| n.to_string_lossy().to_string()).unwrap_or_else(|| c.name.clone());
-    Ok(json!({"name": name, "changes": crate::compare::diff(&st.doc, &c.revised, c.by_position), "byPosition": c.by_position}))
+    Ok(json!({"name": name, "changes": crate::compare::pending(&st.doc, c), "byPosition": c.by_position}))
 }
 
 fn compare(s: &mut Session, p: &Value) -> Result<Value> {
@@ -663,7 +674,7 @@ fn compare(s: &mut Session, p: &Value) -> Result<Value> {
     let revised = super::file::open_presentation(&name, &bytes)?;
     let st = s.doc_mut()?;
     let by_position = crate::compare::unrelated(&st.doc, &revised);
-    st.compare = Some(crate::compare::Compare { name, revised: Arc::new(revised), by_position });
+    st.compare = Some(crate::compare::Compare { name, revised: Arc::new(revised), by_position, rejected: Default::default() });
     s.ui_requests.push(UiRequest::Pane { id: "revisions".into() });
     revisions_json(s.doc()?)
 }
@@ -673,7 +684,8 @@ fn revisions(s: &mut Session, _: &Value) -> Result<Value> {
 }
 
 fn accept(s: &mut Session, p: &Value) -> Result<Value> {
-    let (rev, by_pos) = s.doc()?.compare.as_ref().map(|c| (c.revised.clone(), c.by_position)).ok_or_else(|| bad("review.accept", "not comparing"))?;
+    let cmp = s.doc()?.compare.clone().ok_or_else(|| bad("review.accept", "not comparing"))?;
+    let rev = cmp.revised.clone();
     let all = bool_param(p, "all").unwrap_or(false);
     let index = usize_param(p, "index");
     if !all && index.is_none() {
@@ -684,7 +696,7 @@ fn accept(s: &mut Session, p: &Value) -> Result<Value> {
         // Each accept shifts indices, so the list is recomputed; bounded by the slide counts.
         let limit = doc.slides.len().saturating_add(rev.slides.len()).saturating_add(1);
         for _ in 0..limit {
-            let changes = crate::compare::diff(doc, &rev, by_pos);
+            let changes = crate::compare::pending(doc, &cmp);
             let c = if all {
                 changes.into_iter().find(|c| !(c.kind == crate::compare::ChangeKind::Deleted && doc.slides.len() <= 1))
             } else {
@@ -707,6 +719,24 @@ fn accept(s: &mut Session, p: &Value) -> Result<Value> {
     })
 }
 
+fn reject(s: &mut Session, p: &Value) -> Result<Value> {
+    let all = bool_param(p, "all").unwrap_or(false);
+    let index = usize_param(p, "index");
+    if !all && index.is_none() {
+        return Err(bad("review.reject", "give `index` or `all`"));
+    }
+    let st = s.doc_mut()?;
+    let doc = st.doc.clone();
+    let c = st.compare.as_mut().ok_or_else(|| bad("review.reject", "not comparing"))?;
+    let pending = crate::compare::pending(&doc, c);
+    let picked: Vec<_> = if all { pending } else { pending.into_iter().nth(index.unwrap_or(0)).into_iter().collect() };
+    if picked.is_empty() {
+        return Err(bad("review.reject", "no such revision"));
+    }
+    c.rejected.extend(picked.iter().map(|ch| crate::compare::ChangeKey::of(&doc, ch)));
+    Ok(json!({"rejected": picked.len()}))
+}
+
 fn end_compare(s: &mut Session, _: &Value) -> Result<Value> {
     s.doc_mut()?.compare = None;
     ok()
@@ -815,3 +845,18 @@ mod tests {
         assert!(s.active().unwrap().doc.slides[0].comments.is_empty());
     }
 }
+
+#[cfg(test)]
+mod spelling_change_range_tests {
+    use crate::{EngineError, Session};
+    use serde_json::json;
+
+    #[test]
+    fn spelling_change_huge_start_is_bad_params() {
+        let mut s = Session::with_new();
+        let r = s.execute("insert.textBox", &json!({"text": "Hello"})).unwrap();
+        let id = r["id"].clone();
+        let err = s.execute("review.spellingChange", &json!({"shape": id, "para": 0, "start": u64::MAX, "word": "Hello", "to": "x"})).unwrap_err();
+        assert!(matches!(err, EngineError::BadParams { .. }), "{err:?}");
+    }
+}

crates/engine/src/cmd/richclip.rs

@@ -107,14 +107,16 @@ pub fn html_to_body(html: &str) -> Option<TextBody> {
             }
             if closing {
                 let kind = tag_kind(&name);
-                if !kind.is_empty()
-                    && let Some(pos) = stack.iter().rposition(|e| e.0 == kind)
-                {
-                    let (_, db, di, du) = stack[pos];
-                    bold -= db;
-                    italic -= di;
-                    underline -= du;
-                    stack.truncate(pos);
+                if !kind.is_empty() {
+                    let search_start = stack.len().saturating_sub(64);
+                    if let Some(offset) = stack[search_start..].iter().rposition(|e| e.0 == kind) {
+                        let pos = search_start + offset;
+                        let (_, db, di, du) = stack[pos];
+                        bold -= db;
+                        italic -= di;
+                        underline -= du;
+                        stack.truncate(pos);
+                    }
                 }
                 if is_block(&name) {
                     new_para(&mut paragraphs);
@@ -130,7 +132,7 @@ pub fn html_to_body(html: &str) -> Option<TextBody> {
                 bold += db;
                 italic += di;
                 underline += du;
-                if !token.ends_with('/') {
+                if !token.ends_with('/') && stack.len() < 128 {
                     stack.push((tag_kind(&name), db, di, du));
                 } else {
                     bold -= db;
@@ -229,7 +231,11 @@ fn weight_bold(style: &str) -> Option<bool> {
 
 fn attr<'a>(tag: &'a str, key: &str) -> Option<&'a str> {
     let lower = tag.to_ascii_lowercase();
-    let at = lower.find(key)?;
+    let at = lower.match_indices(key).find_map(|(at, _)| {
+        let named = lower[..at].ends_with(|c: char| c.is_ascii_whitespace());
+        let eq = tag.get(at + key.len()..)?.trim_start().starts_with('=');
+        (named && eq).then_some(at)
+    })?;
     let after = tag.get(at + key.len()..)?.trim_start();
     let after = after.strip_prefix('=')?.trim_start();
     let quote = after.chars().next()?;
@@ -302,9 +308,14 @@ fn decode_text(raw: &str) -> String {
     while let Some(at) = rest.find('&') {
         out.push_str(&collapse_space(&rest[..at]));
         rest = &rest[at..];
-        let Some(end) = rest.find(';') else {
-            out.push_str(&collapse_space(rest));
-            break;
+        let mut search_window = rest.len().min(32);
+        while !rest.is_char_boundary(search_window) {
+            search_window -= 1;
+        }
+        let Some(end) = rest[..search_window].find(';') else {
+            out.push('&');
+            rest = &rest[1..];
+            continue;
         };
         let entity = &rest[1..end];
         let decoded = match entity {
@@ -333,8 +344,13 @@ fn decode_text(raw: &str) -> String {
 
 fn numeric_char(digits: &str) -> Option<char> {
     let hex = digits.strip_prefix('x').or_else(|| digits.strip_prefix('X'));
-    let n = if let Some(hex) = hex { u32::from_str_radix(hex, 16).ok()? } else { digits.parse().ok()? };
-    char::from_u32(n).filter(|c| !c.is_control() || *c == '\n')
+    // `parse` and `from_str_radix` accept a leading '+', which is not a valid reference.
+    let (body, radix) = hex.map_or((digits, 10), |h| (h, 16));
+    if body.is_empty() || !body.chars().all(|c| c.is_digit(radix)) {
+        return None;
+    }
+    let n = u32::from_str_radix(body, radix).ok()?;
+    char::from_u32(n).filter(|c| !c.is_control() || matches!(*c, '\n' | '\t'))
 }
 
 /// Do the HTML's words and the paste's plain text say the same thing?
@@ -352,6 +368,27 @@ fn fold(s: &str) -> String {
 mod tests {
     use super::*;
 
+    #[test]
+    fn multibyte_after_ampersand_is_kept() {
+        let text = "é".repeat(20);
+        assert_eq!(decode_text(&format!("R&D {text}")), format!("R&D {text}"));
+        let cjk = "漢".repeat(20);
+        assert_eq!(decode_text(&format!("&{cjk}")), format!("&{cjk}"));
+    }
+
+    #[test]
+    fn signed_numeric_entities_are_kept_as_typed() {
+        assert_eq!(decode_text("a&#+65;b"), "a&#+65;b");
+        assert_eq!(decode_text("a&#x+41;b"), "a&#x+41;b");
+        assert_eq!(decode_text("a&#65;b&#x41;"), "aAbA");
+    }
+
+    #[test]
+    fn numeric_tab_entity_decodes_to_tab() {
+        assert_eq!(decode_text("a&#9;b"), "a\tb");
+        assert_eq!(decode_text("a&#x9;b"), "a\tb");
+    }
+
     #[test]
     fn google_docs_normal_weight_wrapper_is_not_bold() {
         let html = "<meta charset=\"utf-8\"><b style=\"font-weight:normal;\" id=\"docs-internal-guid-1\"><span style=\"font-weight:400\">plain words</span></b>";
@@ -366,6 +403,20 @@ mod tests {
         assert_eq!(heavy.paragraphs[0].runs[0].props.bold, Some(true));
     }
 
+    #[test]
+    fn style_attribute_is_found_after_attributes_containing_style() {
+        for tag in [
+            "<span class=\"style1\" style=\"font-weight:bold\">x</span>",
+            "<span data-style=\"x\" style=\"font-weight:bold\">x</span>",
+            "<span class=\"mystyle\" style=\"font-weight:bold\">x</span>",
+        ] {
+            let body = html_to_body(tag).unwrap();
+            assert_eq!(body.paragraphs[0].runs[0].props.bold, Some(true), "{tag}");
+        }
+        let none = html_to_body("<span class=\"style\">x</span>").unwrap();
+        assert_eq!(none.paragraphs[0].runs[0].props.bold, None);
+    }
+
     #[test]
     fn bold_italic_and_underline_round_trip() {
         let mut body = TextBody::from_text("Hi there");
@@ -391,6 +442,10 @@ mod tests {
         assert_eq!(text("<p>R&D costs; up</p>"), "R&D costs; up");
         assert_eq!(text("<p>AT&T; Q&A</p>"), "AT&T; Q&A");
         assert_eq!(text("<p>A &amp; B &#38; C &#x26; D</p>"), "A & B & C & D");
+
+        // Verify many bare ampersands do not cause quadratic scan freeze
+        let hostile = format!("<p>{}</p>", "&".repeat(2000));
+        assert_eq!(text(&hostile), "&".repeat(2000));
     }
 
     #[test]

crates/engine/src/cmd/selection.rs

@@ -5,7 +5,7 @@
 use deckcraft_model::{Shape, ShapeId};
 use serde_json::{Value, json};
 
-use super::*;
+use super::{CommandSpec, bad, bool_or, cmd, has_slide, id_param, ids_param, ok};
 use crate::{Result, Session};
 
 pub fn specs() -> Vec<CommandSpec> {

crates/engine/src/cmd/selection_tests.rs

@@ -2,8 +2,8 @@
 
 use serde_json::{Value, json};
 
+use crate::Session;
 use crate::tools::{Mods, PointerEvent, PointerKind};
-use crate::*;
 
 /// A blank slide with A, B, C (back to front) and G = group [D, H = group [E, F]] in front.
 fn deck() -> (Session, Vec<u32>) {

crates/engine/src/cmd/shape.rs

@@ -8,7 +8,10 @@ use deckcraft_model::style::{Dash, Glow, Gradient, GradientShape, GradientStop,
 use deckcraft_model::{ColorRef, Effects, Fill, Geom, Line, ShapeStyle};
 use serde_json::{Value, json};
 
-use super::*;
+use super::{
+    CommandSpec, NO_ID_SPACE, bad, bool_or, bool_param, cmd, color_param, color_value, edit_geometry, edit_shapes, f64_param, has_selection,
+    has_slide, id_param, ok, str_param, targets, usize_param, with_param, xfrm_of,
+};
 use crate::{Result, Session};
 
 pub fn specs() -> Vec<CommandSpec> {
@@ -1519,6 +1522,8 @@ fn ink_to_shape(s: &mut Session, _p: &Value) -> Result<Value> {
 mod tests {
     #![allow(clippy::unwrap_used)]
 
+    use deckcraft_model::ShapeId;
+
     use super::*;
     use serde_json::json;
 
@@ -1646,7 +1651,7 @@ mod tests {
         let mut s = Session::with_new();
         s.execute("shape.insert", &json!({"preset": "ellipse", "rect": [10.0, 10.0, 30.0, 30.0]})).unwrap();
         let st = s.active_mut().unwrap();
-        st.interaction = Some(crate::Interaction { label: "Move".into(), doc: st.doc.clone(), selection: st.selection.clone() });
+        st.interaction = Some(crate::Interaction { label: "Move".into(), doc: st.doc.clone(), selection: st.selection.clone(), vertex_kind: None });
         s.execute("shape.rotate", &json!({"gesture": "end", "ids": []})).unwrap();
         assert_eq!(s.active().unwrap().interaction.as_ref().unwrap().label, "Move");
     }

crates/engine/src/cmd/slide.rs

@@ -6,7 +6,7 @@ use deckcraft_model::text::TextBody;
 use deckcraft_model::{LayoutId, LayoutType, Presentation, Section, SlideId, defaults};
 use serde_json::{Value, json};
 
-use super::*;
+use super::{CommandSpec, NO_ID_SPACE, bad, bool_or, bool_param, cmd, has_doc, has_slide, ok, opt_usize_param, str_param, usize_param};
 use crate::{Result, Session, Target};
 
 pub fn specs() -> Vec<CommandSpec> {
@@ -28,6 +28,7 @@ pub fn specs() -> Vec<CommandSpec> {
         cmd!(noundo "slide.previous", "Previous Slide", [], Some("PageUp"), "{}", has_slide, prev),
         cmd!(noundo "slide.first", "First Slide", [], Some("Home"), "{}", has_slide, first),
         cmd!(noundo "slide.last", "Last Slide", [], Some("End"), "{}", has_slide, last),
+        cmd!(noundo "slide.selectRange", "Select Slide Range", [], None, "{to: index, from?: index (default the current slide), add?: bool (keep the slides already selected)}", has_slide, select_range),
         cmd!(noundo "slide.selectSlides", "Select Slides", [], None, "{ids?: [slide id], indices?: [index], add?: bool}", has_slide, select_slides),
         cmd!("slide.hide", "Hide Slide", ["Slide Show", "Set Up"], None, "{index?, hidden?: bool}", has_slide, hide),
         cmd!("slide.layout", "Layout", ["Home", "Slides"], None, "{layout: name or kind, index?}", has_slide, set_layout),
@@ -303,6 +304,7 @@ fn go_to(s: &mut Session, i: usize) -> Result<Value> {
         sel.shapes.clear();
         sel.text = None;
         sel.cells = None;
+        sel.range_anchor = None;
         sel.target = Target::Slides;
     })?;
     Ok(json!({"index": s.doc()?.selection.slide}))
@@ -368,12 +370,53 @@ fn select_slides(s: &mut Session, p: &Value) -> Result<Value> {
         }
         sel.shapes.clear();
         sel.text = None;
+        sel.range_anchor = None;
+    })?;
+    Ok(json!({"selected": s.doc()?.selection.slides}))
+}
+
+/// Shift-click in the slide list: select every slide from `from` to `to`. Without `from` the range
+/// starts at the anchor of the previous Shift-click (so a second Shift-click extends from the same
+/// slide, as in PowerPoint), else at the current slide.
+/// With `add` the slides already selected stay selected (Ctrl+Shift-click).
+fn select_range(s: &mut Session, p: &Value) -> Result<Value> {
+    let to = usize_param(p, "to").ok_or_else(|| bad("slide.selectRange", "missing `to`"))?;
+    let given = opt_usize_param(p, "from", "slide.selectRange")?;
+    let add = bool_or(p, "add", false);
+    let (from, count) = {
+        let st = s.doc()?;
+        let sel = &st.selection;
+        let current = st.doc.slides.get(sel.slide).map(|x| x.id);
+        let anchor = sel.range_anchor.filter(|(_, end)| Some(*end) == current).and_then(|(a, _)| st.doc.slide_index(a));
+        (given.or(anchor).unwrap_or(sel.slide), st.doc.slides.len())
+    };
+    if to >= count || from >= count {
+        return Err(bad("slide.selectRange", "no such slide"));
+    }
+    let (a, b) = (from.min(to), from.max(to));
+    s.select(|doc, sel| {
+        let range: Vec<SlideId> = doc.slides.iter().skip(a).take(b - a + 1).map(|x| x.id).collect();
+        if add {
+            for id in range {
+                if !sel.slides.contains(&id) {
+                    sel.slides.push(id);
+                }
+            }
+        } else {
+            sel.slides = range;
+        }
+        sel.slide = to;
+        sel.range_anchor = doc.slides.get(from).zip(doc.slides.get(to)).map(|(a, b)| (a.id, b.id));
+        sel.shapes.clear();
+        sel.text = None;
+        sel.cells = None;
+        sel.target = Target::Slides;
     })?;
     Ok(json!({"selected": s.doc()?.selection.slides}))
 }
 
 fn hide(s: &mut Session, p: &Value) -> Result<Value> {
-    let targets: Vec<usize> = match usize_param(p, "index") {
+    let targets: Vec<usize> = match opt_usize_param(p, "index", "slide.hide")? {
         Some(i) => vec![i],
         None => {
             let st = s.doc()?;
@@ -442,7 +485,7 @@ pub fn apply_layout(doc: &mut Presentation, index: usize, layout: LayoutId) -> R
 
 fn set_layout(s: &mut Session, p: &Value) -> Result<Value> {
     let key = p.get("layout").cloned().ok_or_else(|| bad("slide.layout", "missing `layout`"))?;
-    let targets: Vec<usize> = match usize_param(p, "index") {
+    let targets: Vec<usize> = match opt_usize_param(p, "index", "slide.layout")? {
         Some(i) => vec![i],
         None => {
             let st = s.doc()?;
@@ -697,4 +740,106 @@ mod tests {
         let want = [(0, "Level one"), (1, "Level two"), (2, "Level three"), (0, "Level one again")];
         assert_eq!(got, want.iter().map(|(l, t)| (*l, t.to_string())).collect::<Vec<_>>());
     }
+
+    fn deck_of(n: usize) -> Session {
+        let mut s = Session::with_new();
+        while s.doc().expect("doc").doc.slides.len() < n {
+            s.execute("slide.new", &json!({})).expect("new slide");
+        }
+        s
+    }
+
+    fn selected_indices(s: &Session) -> Vec<usize> {
+        let st = s.doc().expect("doc");
+        let mut v: Vec<usize> = st.selection.slides.iter().filter_map(|id| st.doc.slide_index(*id)).collect();
+        v.sort_unstable();
+        v
+    }
+
+    #[test]
+    fn select_range_covers_every_slide_between() {
+        let mut s = deck_of(6);
+        s.execute("slide.go", &json!({"index": 1})).expect("go");
+        s.execute("slide.selectRange", &json!({"to": 4})).expect("range");
+        assert_eq!(selected_indices(&s), vec![1, 2, 3, 4]);
+        assert_eq!(s.doc().expect("doc").selection.slide, 4);
+        // Backwards works too, and replaces the earlier selection.
+        s.execute("slide.selectRange", &json!({"from": 5, "to": 3})).expect("range");
+        assert_eq!(selected_indices(&s), vec![3, 4, 5]);
+    }
+
+    #[test]
+    fn select_range_add_keeps_the_existing_selection() {
+        let mut s = deck_of(8);
+        s.execute("slide.selectSlides", &json!({"indices": [0, 1]})).expect("select");
+        s.execute("slide.go", &json!({"index": 4})).expect("go");
+        s.execute("slide.selectSlides", &json!({"indices": [4]})).expect("select");
+        s.execute("slide.selectRange", &json!({"to": 6, "add": true})).expect("range");
+        assert_eq!(selected_indices(&s), vec![4, 5, 6]);
+        s.execute("slide.selectSlides", &json!({"indices": [0]})).expect("select");
+        s.execute("slide.selectRange", &json!({"from": 3, "to": 5, "add": true})).expect("range");
+        assert_eq!(selected_indices(&s), vec![0, 3, 4, 5]);
+    }
+
+    #[test]
+    fn select_range_rejects_out_of_range_slides() {
+        let mut s = deck_of(3);
+        assert!(s.execute("slide.selectRange", &json!({"to": 3})).is_err());
+        assert!(s.execute("slide.selectRange", &json!({"from": 9, "to": 1})).is_err());
+        assert!(s.execute("slide.selectRange", &json!({})).is_err());
+    }
+
+    #[test]
+    fn select_range_rejects_an_invalid_from_instead_of_using_the_current_slide() {
+        let mut s = deck_of(4);
+        s.execute("slide.go", &json!({"index": 2})).expect("go");
+        assert!(s.execute("slide.selectRange", &json!({"from": -1, "to": 3})).is_err());
+        assert!(s.execute("slide.selectRange", &json!({"from": "x", "to": 3})).is_err());
+        assert_eq!(selected_indices(&s), vec![2]);
+    }
+
+    #[test]
+    fn a_second_range_extends_from_the_original_anchor() {
+        let mut s = deck_of(8);
+        s.execute("slide.go", &json!({"index": 2})).expect("go");
+        s.execute("slide.selectRange", &json!({"to": 5})).expect("range");
+        assert_eq!(selected_indices(&s), vec![2, 3, 4, 5]);
+        // Shift-click further on: still anchored at 2, not at 5.
+        s.execute("slide.selectRange", &json!({"to": 7})).expect("range");
+        assert_eq!(selected_indices(&s), vec![2, 3, 4, 5, 6, 7]);
+        // Shift-click back across the anchor.
+        s.execute("slide.selectRange", &json!({"to": 0})).expect("range");
+        assert_eq!(selected_indices(&s), vec![0, 1, 2]);
+        // A plain click on another slide starts a new anchor.
+        s.execute("slide.go", &json!({"index": 4})).expect("go");
+        s.execute("slide.selectRange", &json!({"to": 6})).expect("range");
+        assert_eq!(selected_indices(&s), vec![4, 5, 6]);
+    }
+
+    #[test]
+    fn moving_a_slide_drops_the_range_anchor() {
+        let mut s = deck_of(6);
+        s.execute("slide.go", &json!({"index": 0})).expect("go");
+        s.execute("slide.selectRange", &json!({"to": 2})).expect("range");
+        // Slide 0 moves to index 2 and stays current; index 0 now holds another slide, so the
+        // next Shift-click starts at the moved slide instead of at index 0.
+        s.execute("slide.move", &json!({"from": 0, "to": 2})).expect("move");
+        assert_eq!(s.doc().expect("doc").selection.slide, 2);
+        s.execute("slide.selectRange", &json!({"to": 4})).expect("range");
+        assert_eq!(selected_indices(&s), vec![2, 3, 4]);
+    }
+
+    #[test]
+    fn select_range_clears_a_table_cell_selection_and_returns_to_the_slides() {
+        let mut s = deck_of(3);
+        s.select(|_, sel| {
+            sel.cells = Some((deckcraft_model::ShapeId(1), (0, 0), (1, 1)));
+            sel.target = crate::Target::Master { master: 0 };
+        })
+        .expect("cells");
+        s.execute("slide.selectRange", &json!({"to": 2})).expect("range");
+        let sel = &s.doc().expect("doc").selection;
+        assert!(sel.cells.is_none());
+        assert_eq!(sel.target, crate::Target::Slides);
+    }
 }

crates/engine/src/cmd/smartart.rs

@@ -14,7 +14,7 @@ use deckcraft_model::{
 };
 use serde_json::{Value, json};
 
-use super::*;
+use super::{CommandSpec, NO_ID_SPACE, bad, bool_or, cmd, current_shapes, has_selection, shape_of, str_param, targets, xfrm_of};
 use crate::{EngineError, Result, Session};
 
 /// Deepest outline level the Text Pane allows.

crates/engine/src/cmd/table.rs

@@ -4,28 +4,49 @@ use deckcraft_geom::{Affine, Point, Rect};
 use deckcraft_model::{Shape, ShapeKind, Table};
 use serde_json::{Value, json};
 
-use super::*;
+use super::{
+    CommandSpec, bad, bool_or, bool_param, cmd, color_param, edit_shapes, f64_param, has_selection, has_slide, id_param, ok, opt_usize_param,
+    str_param, table_drawn_heights, xfrm_of,
+};
 use crate::{DocState, Result, Session};
 
 pub fn specs() -> Vec<CommandSpec> {
     vec![
         cmd!("table.insertRowAbove", "Insert Above", ["Table Layout", "Rows & Columns"], None, "{row?, id?}", has_selection, |s, p| rows_cols(
-            s, p, "rowAbove"
+            s,
+            p,
+            "rowAbove",
+            "table.insertRowAbove"
         )),
         cmd!("table.insertRowBelow", "Insert Below", ["Table Layout", "Rows & Columns"], None, "{row?, id?}", has_selection, |s, p| rows_cols(
-            s, p, "rowBelow"
+            s,
+            p,
+            "rowBelow",
+            "table.insertRowBelow"
         )),
         cmd!("table.insertColumnLeft", "Insert Left", ["Table Layout", "Rows & Columns"], None, "{col?, id?}", has_selection, |s, p| rows_cols(
-            s, p, "colLeft"
+            s,
+            p,
+            "colLeft",
+            "table.insertColumnLeft"
         )),
         cmd!("table.insertColumnRight", "Insert Right", ["Table Layout", "Rows & Columns"], None, "{col?, id?}", has_selection, |s, p| rows_cols(
-            s, p, "colRight"
+            s,
+            p,
+            "colRight",
+            "table.insertColumnRight"
         )),
         cmd!("table.deleteRow", "Delete Rows", ["Table Layout", "Rows & Columns"], None, "{row?, id?}", has_selection, |s, p| rows_cols(
-            s, p, "delRow"
+            s,
+            p,
+            "delRow",
+            "table.deleteRow"
         )),
         cmd!("table.deleteColumn", "Delete Columns", ["Table Layout", "Rows & Columns"], None, "{col?, id?}", has_selection, |s, p| rows_cols(
-            s, p, "delCol"
+            s,
+            p,
+            "delCol",
+            "table.deleteColumn"
         )),
         cmd!("table.merge", "Merge Cells", ["Table Layout", "Merge"], None, "{from: [r, c], to: [r, c], id?}", has_selection, merge),
         cmd!(
@@ -225,16 +246,26 @@ impl TableFrame {
     }
 }
 
-fn cell_param(p: &Value, key: &str) -> Option<(usize, usize)> {
-    let a = p.get(key)?.as_array()?;
-    Some((a.first()?.as_u64()? as usize, a.get(1)?.as_u64()? as usize))
+/// A `[r, c]` cell param: `Ok(None)` when absent (callers may fall back to the selection), `Err` when
+/// present but not a valid cell, so a bad cell never acts on the selection.
+fn cell_param(p: &Value, key: &str, cmd: &str) -> Result<Option<(usize, usize)>> {
+    let v = match p.get(key) {
+        None | Some(Value::Null) => return Ok(None),
+        Some(v) => v,
+    };
+    let idx = |i: usize| v.as_array().and_then(|a| a.get(i)).and_then(Value::as_u64).and_then(|x| usize::try_from(x).ok());
+    match (idx(0), idx(1)) {
+        (Some(r), Some(c)) => Ok(Some((r, c))),
+        _ => Err(bad(cmd, format!("`{key}` is not a valid cell: {v}"))),
+    }
 }
 
 /// The table's row/col to act on: params, the edited cell, or the selected cells.
-fn at(s: &Session, p: &Value) -> (usize, usize) {
+/// A present but invalid `row`/`col` is an error; only an absent one falls back.
+fn at(s: &Session, p: &Value, cmd: &str) -> Result<(usize, usize)> {
     let st = s.active();
     let cell = st.and_then(|d| d.selection.text.as_ref().and_then(|t| t.cell)).or_else(|| st.and_then(|d| d.selection.cells.map(|c| c.1)));
-    (usize_param(p, "row").or(cell.map(|c| c.0)).unwrap_or(0), usize_param(p, "col").or(cell.map(|c| c.1)).unwrap_or(0))
+    Ok((opt_usize_param(p, "row", cmd)?.or(cell.map(|c| c.0)).unwrap_or(0), opt_usize_param(p, "col", cmd)?.or(cell.map(|c| c.1)).unwrap_or(0)))
 }
 
 fn with_table(s: &mut Session, p: &Value, cmd: &str, f: impl Fn(&mut Table) -> Result<()>) -> Result<Value> {
@@ -282,10 +313,10 @@ fn with_table(s: &mut Session, p: &Value, cmd: &str, f: impl Fn(&mut Table) -> R
     Ok(r)
 }
 
-fn rows_cols(s: &mut Session, p: &Value, op: &str) -> Result<Value> {
-    let (r, c) = at(s, p);
+fn rows_cols(s: &mut Session, p: &Value, op: &str, name: &'static str) -> Result<Value> {
+    let (r, c) = at(s, p, name)?;
     let op = op.to_string();
-    with_table(s, p, "table", move |t| {
+    with_table(s, p, name, move |t| {
         match op.as_str() {
             "rowAbove" => t.insert_row(r),
             "rowBelow" => t.insert_row(r.saturating_add(1)),
@@ -293,12 +324,12 @@ fn rows_cols(s: &mut Session, p: &Value, op: &str) -> Result<Value> {
             "colRight" => t.insert_col(c.saturating_add(1)),
             "delRow" => {
                 if !t.delete_row(r) {
-                    return Err(bad("table.deleteRow", "can't delete the last row"));
+                    return Err(bad(name, "can't delete the last row"));
                 }
             }
             _ => {
                 if !t.delete_col(c) {
-                    return Err(bad("table.deleteColumn", "can't delete the last column"));
+                    return Err(bad(name, "can't delete the last column"));
                 }
             }
         }
@@ -308,8 +339,8 @@ fn rows_cols(s: &mut Session, p: &Value, op: &str) -> Result<Value> {
 
 fn merge(s: &mut Session, p: &Value) -> Result<Value> {
     let sel = s.doc()?.selection.cells;
-    let from = cell_param(p, "from").or(sel.map(|c| c.1)).ok_or_else(|| bad("table.merge", "missing `from`"))?;
-    let to = cell_param(p, "to").or(sel.map(|c| c.2)).ok_or_else(|| bad("table.merge", "missing `to`"))?;
+    let from = cell_param(p, "from", "table.merge")?.or(sel.map(|c| c.1)).ok_or_else(|| bad("table.merge", "missing `from`"))?;
+    let to = cell_param(p, "to", "table.merge")?.or(sel.map(|c| c.2)).ok_or_else(|| bad("table.merge", "missing `to`"))?;
     with_table(
         s,
         p,
@@ -319,7 +350,10 @@ fn merge(s: &mut Session, p: &Value) -> Result<Value> {
 }
 
 fn split(s: &mut Session, p: &Value) -> Result<Value> {
-    let cell = cell_param(p, "cell").unwrap_or_else(|| at(s, p));
+    let cell = match cell_param(p, "cell", "table.split")? {
+        Some(c) => c,
+        None => at(s, p, "table.split")?,
+    };
     with_table(s, p, "table.split", move |t| if t.split(cell.0, cell.1) { Ok(()) } else { Err(bad("table.split", "that cell isn't merged")) })
 }
 
@@ -363,10 +397,12 @@ fn target_cells(s: &Session, p: &Value) -> Result<impl Fn(&Table) -> Vec<(usize,
         .and_then(Value::as_array)
         .map(|a| a.iter().take(100_000).filter_map(|c| Some((c.get(0)?.as_u64()? as usize, c.get(1)?.as_u64()? as usize))).collect());
     let st = s.doc()?;
-    let sel = st.selection.cells.map(|(_, a, b)| (a, b)).or_else(|| st.selection.text.as_ref().and_then(|t| t.cell).map(|c| (c, c)));
+    // A selected range grows over the merged cells it touches; with only a caret, the caret's cell is used.
+    let sel = st.selection.cells.map(|(_, a, b)| (a, b, true)).or_else(|| st.selection.text.as_ref().and_then(|t| t.cell).map(|c| (c, c, false)));
     Ok(move |t: &Table| match (&cells, sel) {
         (Some(c), _) => c.clone(),
-        (None, Some((a, b))) => {
+        (None, Some((a, b, range))) => {
+            let (a, b) = if range { cell_block(t, a, b) } else { (a, b) };
             // The selection can name cells outside the table; only walk the ones that exist.
             let (r1, c1) = (a.0.max(b.0).min(t.n_rows().saturating_sub(1)), a.1.max(b.1).min(t.n_cols().saturating_sub(1)));
             (a.0.min(b.0)..=r1).flat_map(|r| (a.1.min(b.1)..=c1).map(move |c| (r, c))).collect()
@@ -531,7 +567,7 @@ fn distribute(s: &mut Session, p: &Value, rows: bool) -> Result<Value> {
 }
 
 fn column_width(s: &mut Session, p: &Value) -> Result<Value> {
-    let (_, c) = at(s, p);
+    let (_, c) = at(s, p, "table.columnWidth")?;
     let w = f64_param(p, "width").ok_or_else(|| bad("table.columnWidth", "missing `width`"))?.clamp(4.0, 4000.0);
     let keep_total = bool_or(p, "keepTotal", false);
     with_table(s, p, "table.columnWidth", move |t| {
@@ -560,7 +596,7 @@ fn column_width(s: &mut Session, p: &Value) -> Result<Value> {
 }
 
 fn row_height(s: &mut Session, p: &Value) -> Result<Value> {
-    let (r, _) = at(s, p);
+    let (r, _) = at(s, p, "table.rowHeight")?;
     let h = f64_param(p, "height").ok_or_else(|| bad("table.rowHeight", "missing `height`"))?.clamp(4.0, 4000.0);
     with_table(s, p, "table.rowHeight", move |t| {
         if let Some(x) = t.rows.get_mut(r) {
@@ -575,8 +611,8 @@ fn select_cells(s: &mut Session, p: &Value) -> Result<Value> {
         Some(i) => i,
         None => s.doc()?.selection.shapes.first().copied().ok_or_else(|| bad("table.selectCells", "select a table"))?,
     };
-    let from = cell_param(p, "from").unwrap_or((0, 0));
-    let to = cell_param(p, "to").unwrap_or(from);
+    let from = cell_param(p, "from", "table.selectCells")?.unwrap_or((0, 0));
+    let to = cell_param(p, "to", "table.selectCells")?.unwrap_or(from);
     s.select(|_, sel| {
         sel.cells = Some((id, from, to));
         sel.shapes = vec![id];
@@ -585,6 +621,110 @@ fn select_cells(s: &mut Session, p: &Value) -> Result<Value> {
     ok()
 }
 
+/// The cell range from `a` to `b` in `t`, grown until every merged cell it touches lies inside
+/// it, as (the corner on `a`'s side, the corner on `b`'s side). Cells past the table's edge are
+/// clamped to it.
+pub fn cell_block(t: &Table, a: (usize, usize), b: (usize, usize)) -> ((usize, usize), (usize, usize)) {
+    let (nr, nc) = (t.n_rows().max(1), t.n_cols().max(1));
+    let (a, b) = ((a.0.min(nr - 1), a.1.min(nc - 1)), (b.0.min(nr - 1), b.1.min(nc - 1)));
+    let (mut r0, mut r1, mut c0, mut c1) = (a.0.min(b.0), a.0.max(b.0), a.1.min(b.1), a.1.max(b.1));
+    // Each pass takes in the merged cells that overlap the block; stop when one adds nothing.
+    for _ in 0..nr + nc {
+        let mut grown = false;
+        for (r, row) in t.rows.iter().enumerate() {
+            for (c, cell) in row.cells.iter().enumerate() {
+                if cell.is_covered() {
+                    continue;
+                }
+                // Spans come from the file; the additions saturate so that they cannot overflow on 32-bit targets.
+                let end = |at: usize, span: u32, n: usize| at.saturating_add((span.max(1) - 1) as usize).min(n - 1);
+                let (er, ec) = (end(r, cell.row_span, nr), end(c, cell.grid_span, nc));
+                let overlaps = r <= r1 && er >= r0 && c <= c1 && ec >= c0;
+                if overlaps && (r < r0 || er > r1 || c < c0 || ec > c1) {
+                    (r0, r1, c0, c1) = (r0.min(r), r1.max(er), c0.min(c), c1.max(ec));
+                    grown = true;
+                }
+            }
+        }
+        if !grown {
+            break;
+        }
+    }
+    let pick = |lo: usize, hi: usize, first: bool| if first { lo } else { hi };
+    let from = (pick(r0, r1, a.0 <= b.0), pick(c0, c1, a.1 <= b.1));
+    let to = (pick(r0, r1, a.0 > b.0), pick(c0, c1, a.1 > b.1));
+    (from, to)
+}
+
+/// The selected cell range of table `id` (`t`), grown over merged cells, as its top-left and
+/// bottom-right cells. `None` when no range of that table is selected.
+pub fn selected_range(
+    cells: Option<(deckcraft_model::ShapeId, (usize, usize), (usize, usize))>,
+    id: deckcraft_model::ShapeId,
+    t: &Table,
+) -> Option<((usize, usize), (usize, usize))> {
+    let (_, a, b) = cells.filter(|c| c.0 == id)?;
+    let (x, y) = cell_block(t, a, b);
+    Some(((x.0.min(y.0), x.1.min(y.1)), (x.0.max(y.0), x.1.max(y.1))))
+}
+
+/// Whether cell (`r`, `c`) lies in `range` (from [`selected_range`]); without a range every cell does.
+pub fn in_range(range: Option<((usize, usize), (usize, usize))>, r: usize, c: usize) -> bool {
+    range.is_none_or(|((r0, c0), (r1, c1))| (r0..=r1).contains(&r) && (c0..=c1).contains(&c))
+}
+
+/// Shift+arrow with a cell range selected: the cell the range was extended to moves by (`dr`,
+/// `dc`), on past a merged cell until the range changes. The cell it started from stays. Returns
+/// false when no cell range of the selected table is selected.
+pub(crate) fn extend_selected_cells(s: &mut Session, dr: isize, dc: isize) -> Result<bool> {
+    let st = s.doc()?;
+    let Some((id, from, to)) = st.selection.cells.filter(|c| st.selection.shapes == [c.0]) else { return Ok(false) };
+    let Some(ShapeKind::Table(t)) = st.shape(id).map(|sh| &sh.kind) else { return Ok(false) };
+    let (nr, nc) = (t.n_rows(), t.n_cols());
+    let old = cell_block(t, from, to);
+    let mut end = to;
+    while cell_block(t, from, end) == old {
+        let r = end.0.checked_add_signed(dr).filter(|r| *r < nr);
+        let c = end.1.checked_add_signed(dc).filter(|c| *c < nc);
+        let (Some(r), Some(c)) = (r, c) else { break };
+        end = (r, c);
+    }
+    s.select(|_, sel| sel.cells = Some((id, from, end)))?;
+    Ok(true)
+}
+
+/// The text of the selected range of cells, for Copy and Cut: a tab between the cells of a row
+/// and a line per row (a merged cell once, where it starts). `None` without a cell range of the
+/// selected table.
+pub(crate) fn selected_cells_text(st: &DocState) -> Option<String> {
+    let id = st.selection.cells.filter(|c| st.selection.shapes == [c.0])?.0;
+    let ShapeKind::Table(t) = &st.shape(id)?.kind else { return None };
+    let ((r0, c0), (r1, c1)) = selected_range(st.selection.cells, id, t)?;
+    let rows = (r0..=r1).map(|r| {
+        let cells = (c0..=c1).filter_map(|c| t.cell(r, c).filter(|x| !x.is_covered()).map(|x| x.text.text()));
+        cells.collect::<Vec<_>>().join("\t")
+    });
+    Some(rows.collect::<Vec<_>>().join("\n"))
+}
+
+/// Delete with a cell range selected: the text in those cells goes and the cells stay, each
+/// keeping its first paragraph's formatting.
+pub(crate) fn clear_selected_cells(s: &mut Session) -> Result<Value> {
+    let Some((id, ..)) = s.doc()?.selection.cells else { return ok() };
+    let cells = s.doc()?.selection.cells;
+    with_table(s, &json!({"id": id}), "edit.delete", move |t| {
+        let range = selected_range(cells, id, t);
+        for (r, row) in t.rows.iter_mut().enumerate() {
+            for (c, cell) in row.cells.iter_mut().enumerate() {
+                if in_range(range, r, c) {
+                    deckcraft_model::edit::delete(&mut cell.text, (0, 0), (usize::MAX, usize::MAX));
+                }
+            }
+        }
+        Ok(())
+    })
+}
+
 fn point_param(p: &Value, key: &str) -> Option<(f64, f64)> {
     let a = p.get(key)?;
     let (x, y) = (a.get(0)?.as_f64()?, a.get(1)?.as_f64()?);

crates/engine/src/cmd/text.rs

@@ -9,9 +9,14 @@ use deckcraft_model::text::{Align, AutoFit, Hyperlink, Paragraph, Run, RunKind,
 use deckcraft_model::{Presentation, Shape, ShapeId, ShapeKind};
 use serde_json::{Value, json};
 
-use super::*;
-use crate::{DocState, Result, Selection, Session, Target, TextSel};
+use super::{
+    CommandSpec, NO_TEXT_POINT, SELECT_TEXT_OR_SHAPE, always, bad, bool_or, cmd, edit_shapes, has_doc, has_slide, has_text, id_param, ok, shape_of,
+    str_param, xfrm_of,
+};
+use crate::{DocState, HistoryEntry, Result, Selection, Session, Target, TextSel, push_undo};
 
+/// Catalogue text-editing, selection, autocorrect, font, IME, and surrounding-deletion commands
+/// with their parameter docs and enabled predicates.
 pub fn specs() -> Vec<CommandSpec> {
     vec![
         cmd!(query "font.used", "Fonts in Presentation", [], None, "{} → [family] (theme fonts resolved)", has_doc, fonts_used),
@@ -31,7 +36,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "AutoCorrect Options",
             ["Tools"],
             None,
-            "{on?, twoInitials?, sentenceCaps?, days?, capsLock?, fractions?, ordinals?: bool, add?: [from, to], remove?: from} → the options and the replacement list",
+            "{on?, twoInitials?, sentenceCaps?, days?, capsLock?, fractions?, ordinals?, lists?: bool, add?: [from, to], remove?: from} → the options and the replacement list",
             always,
             autocorrect_options
         ),
@@ -66,6 +71,30 @@ pub fn specs() -> Vec<CommandSpec> {
             has_text,
             delete
         ),
+        // An input method asks for text around the caret to be removed (macOS press-and-hold,
+        // dictation, Wayland text-input). Internal: the keyboard and control protocol keep the
+        // existing text.delete spelling. `bytes` says the counts are UTF-8 bytes (winit's
+        // `Ime::DeleteSurrounding`), otherwise characters, both in the logical text
+        // `ime_surrounding` publishes: a paragraph mark or soft line break is one `\n` byte, so a
+        // range may cross paragraphs. The selection and pre-edit are kept; byte ranges round
+        // inward to whole scalars. A deletion while composing stays in the composition's single
+        // undo step.
+        //
+        // `undoable: false` is deliberate even though a non-composing deletion is undoable: the
+        // handler pushes its own history entry from a snapshot taken before the composition is
+        // replaced, so the generic post-run undo hook must not add a duplicate. `journal` stays
+        // off for the same reason an input-method edit is not a replayable document command.
+        CommandSpec {
+            id: "text.deleteSurrounding",
+            label: "Delete Surrounding Text",
+            menu: &[],
+            shortcut: None,
+            params: "{before, after, bytes?: bool}",
+            enabled: has_text,
+            run: delete_surrounding,
+            journal: false,
+            undoable: false,
+        },
         cmd!(noundo "text.move", "Move Insertion Point", [], None, "{to: left|right|up|down|wordLeft|wordRight|lineStart|lineEnd|paraStart|paraEnd|paraUp|paraDown|start|end, extend?: bool} — left/right are on screen: in a right-to-left paragraph left goes forward", has_text, move_caret),
         cmd!(noundo "text.select", "Select Text", [], None, "{anchor: [p, c], caret: [p, c]}", has_text, select),
         cmd!(noundo "text.selectAll", "Select All Text", [], None, "{}", has_text, select_all),
@@ -111,6 +140,240 @@ fn body_mut<'a>(doc: &'a mut Presentation, sel: &Selection, t: &TextSel) -> Opti
     Some(sh.text.get_or_insert_with(TextBody::default))
 }
 
+/// Maximum number of UTF-8 bytes in an outgoing IME surrounding-text query.
+///
+/// This matches `egui::output::MAX_IME_SURROUNDING_TEXT_BYTES`; keeping the bound here lets the
+/// engine answer without copying a whole body or document.
+pub const IME_SURROUNDING_MAX_BYTES: usize = 4000;
+
+/// Bounded committed text around an IME selection, in logical (not visual) order and with UTF-8
+/// byte offsets. The current input-method composition (pre-edit) is removed from both the text
+/// and the offsets.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct ImeSurrounding {
+    pub text: String,
+    pub cursor: usize,
+    pub anchor: usize,
+}
+
+/// How a soft line break reads in the IME view: a newline, like a paragraph break.
+///
+/// The model stores it as `\u{b}` ([`RunKind::Break`]); publishing that control character would
+/// give the platform a text its own `ime_text` filter never produces, so its idea of the lines
+/// and our offsets would disagree. Both are one byte, so offsets do not otherwise change.
+fn ime_char(ch: char) -> char {
+    if ch == '\u{b}' { '\n' } else { ch }
+}
+
+/// Committed characters of one paragraph (the pre-edit skipped), as `(char index, character)`.
+fn committed_chars(p: &Paragraph, comp: Option<(usize, usize)>) -> impl Iterator<Item = (usize, char)> + '_ {
+    p.runs
+        .iter()
+        .flat_map(|run| run.content().chars())
+        .enumerate()
+        .filter_map(move |(i, ch)| (!comp.is_some_and(|(s, e)| i >= s && i < e)).then_some((i, ime_char(ch))))
+}
+
+/// The same characters, newest first, without walking the paragraph from its start.
+fn committed_chars_rev(p: &Paragraph, comp: Option<(usize, usize)>) -> impl Iterator<Item = (usize, char)> + '_ {
+    let mut starts = Vec::with_capacity(p.runs.len());
+    let mut at = 0usize;
+    for r in &p.runs {
+        let n = r.char_len();
+        starts.push((at, n));
+        at += n;
+    }
+    p.runs.iter().zip(starts).rev().flat_map(move |(r, (start, n))| {
+        let content = r.content();
+        content.chars().rev().enumerate().filter_map(move |(k, ch)| {
+            let i = start + n - 1 - k;
+            (!comp.is_some_and(|(s, e)| i >= s && i < e)).then_some((i, ime_char(ch)))
+        })
+    })
+}
+
+/// The composition's `(paragraph, start, end)` character range, when it is inside the body.
+fn composition_range(body: &TextBody, c: Option<&crate::Composition>) -> Option<(usize, usize, usize)> {
+    let c = c?;
+    let para = body.paragraphs.get(c.start.0)?;
+    let start = c.start.1.min(para.char_len());
+    let end = start.saturating_add(c.len).min(para.char_len());
+    (start < end).then_some((c.start.0, start, end))
+}
+
+/// Return the composition character range only when its paragraph index equals `pi`.
+fn comp_in(comp: Option<(usize, usize, usize)>, pi: usize) -> Option<(usize, usize)> {
+    comp.filter(|(p, _, _)| *p == pi).map(|(_, s, e)| (s, e))
+}
+
+/// Clip a model position to the body. An empty body only has position `(0, 0)`.
+fn model_pos(body: &TextBody, pos: (usize, usize)) -> Option<(usize, usize)> {
+    if body.paragraphs.is_empty() {
+        return (pos == (0, 0)).then_some((0, 0));
+    }
+    body.paragraphs.get(pos.0).map(|p| (pos.0, pos.1.min(p.char_len())))
+}
+
+/// Walk forward from `from` over at most `limit` committed characters (or UTF-8 bytes of whole
+/// characters), stopping at the end of the body. Returns the position reached and the characters
+/// and bytes consumed.
+///
+/// The returned window is bounded by `limit`, but locating `from` inside a paragraph still walks
+/// that paragraph's runs from their start: runs do not cache character lengths, and a position is
+/// a character index. A megabyte paragraph therefore costs time proportional to the caret's
+/// character offset, even though the copied surrounding text stays within `limit`.
+fn walk_forward(
+    body: &TextBody,
+    comp: Option<(usize, usize, usize)>,
+    from: (usize, usize),
+    limit: usize,
+    bytes: bool,
+) -> ((usize, usize), usize, usize) {
+    let (mut pi, mut at) = from;
+    let (mut chars, mut used) = (0usize, 0usize);
+    // `limit` comes from a (possibly hostile) request: every count is checked, never added
+    // blindly, so an enormous limit cannot overflow.
+    let fits = |used: usize, chars: usize, n: usize| if bytes { used.saturating_add(n) <= limit } else { chars < limit };
+    while let Some(para) = body.paragraphs.get(pi) {
+        for (i, ch) in committed_chars(para, comp_in(comp, pi)) {
+            if i < at {
+                continue;
+            }
+            let n = ch.len_utf8();
+            if !fits(used, chars, n) {
+                return ((pi, i), chars, used);
+            }
+            used += n;
+            chars += 1;
+            at = i + 1;
+        }
+        if pi + 1 >= body.paragraphs.len() {
+            break;
+        }
+        // The paragraph separator between this paragraph and the next.
+        if !fits(used, chars, 1) {
+            return ((pi, at), chars, used);
+        }
+        used += 1;
+        chars += 1;
+        pi += 1;
+        at = 0;
+    }
+    ((pi, at), chars, used)
+}
+
+/// Walk backward from `from` over at most `limit` committed characters (or UTF-8 bytes of whole
+/// characters). Returns the position reached and the characters and bytes consumed.
+fn walk_backward(
+    body: &TextBody,
+    comp: Option<(usize, usize, usize)>,
+    from: (usize, usize),
+    limit: usize,
+    bytes: bool,
+) -> ((usize, usize), usize, usize) {
+    let (mut pi, mut at) = from;
+    let (mut chars, mut used) = (0usize, 0usize);
+    let fits = |used: usize, chars: usize, n: usize| if bytes { used.saturating_add(n) <= limit } else { chars < limit };
+    loop {
+        let Some(para) = body.paragraphs.get(pi) else { return ((pi, at), chars, used) };
+        let mut boundary = at.min(para.char_len());
+        for (i, ch) in committed_chars_rev(para, comp_in(comp, pi)) {
+            if i >= boundary {
+                continue;
+            }
+            let n = ch.len_utf8();
+            if !fits(used, chars, n) {
+                return ((pi, boundary), chars, used);
+            }
+            used += n;
+            chars += 1;
+            boundary = i;
+        }
+        // This paragraph is consumed down to its start.
+        if pi == 0 {
+            return ((0, 0), chars, used);
+        }
+        if !fits(used, chars, 1) {
+            return ((pi, 0), chars, used);
+        }
+        used += 1;
+        chars += 1;
+        pi -= 1;
+        at = usize::MAX; // all of the previous paragraph is before us
+    }
+}
+
+/// The committed logical text between two model positions (excluding `end`). `None` when it is
+/// longer than `cap` bytes: every caller only needs a bounded answer.
+fn logical_between(body: &TextBody, comp: Option<(usize, usize, usize)>, start: (usize, usize), end: (usize, usize), cap: usize) -> Option<String> {
+    let (a, b) = if start <= end { (start, end) } else { (end, start) };
+    let mut out = String::new();
+    for pi in a.0..=b.0 {
+        let Some(para) = body.paragraphs.get(pi) else { return Some(out) };
+        let from = if pi == a.0 { a.1 } else { 0 };
+        let to = if pi == b.0 { b.1 } else { usize::MAX };
+        for (i, ch) in committed_chars(para, comp_in(comp, pi)) {
+            if i < from || i >= to {
+                continue;
+            }
+            out.push(ch);
+            if out.len() > cap {
+                return None;
+            }
+        }
+        if pi < b.0 {
+            out.push('\n');
+            if out.len() > cap {
+                return None;
+            }
+        }
+    }
+    Some(out)
+}
+
+/// Committed surrounding text for the text being edited.
+///
+/// Returns `None` when the body or selection is invalid, or when the selection alone is wider
+/// than [`IME_SURROUNDING_MAX_BYTES`]. An empty body is `Some` with empty text, which is distinct
+/// from an unavailable context. `cursor > anchor` is preserved for a reversed selection.
+///
+/// Only a bounded window is measured and copied: the query walks at most the budget out from the
+/// selection on each side and does not copy the rest of the body. Finding the selection's
+/// character offsets inside one paragraph still scans that paragraph's prefix, so the time is not
+/// bounded independently of the paragraph length.
+pub fn ime_surrounding(st: &DocState, t: &TextSel) -> Option<ImeSurrounding> {
+    let body = body_of(st, t)?;
+    let comp = composition_range(body, st.composition.as_ref());
+    let caret = model_pos(body, t.caret)?;
+    let anchor = model_pos(body, t.anchor)?;
+    let (start, end) = if caret <= anchor { (caret, anchor) } else { (anchor, caret) };
+    let selected = logical_between(body, comp, start, end, IME_SURROUNDING_MAX_BYTES)?;
+    let selection_len = selected.len();
+    let budget = IME_SURROUNDING_MAX_BYTES.saturating_sub(selection_len);
+    let (_, _, before_available) = walk_backward(body, comp, start, budget, true);
+    let (_, _, after_available) = walk_forward(body, comp, end, budget, true);
+    let mut before = (budget / 2).min(before_available);
+    let mut after = (budget - before).min(after_available);
+    before = (budget - after).min(before_available);
+    after = (budget - before).min(after_available);
+    let (window_start, _, _) = walk_backward(body, comp, start, before, true);
+    let (window_end, _, _) = walk_forward(body, comp, end, after, true);
+    let before_text = logical_between(body, comp, window_start, start, budget)?;
+    let after_text = logical_between(body, comp, end, window_end, budget)?;
+    let before_len = before_text.len();
+    let mut text = before_text;
+    text.push_str(&selected);
+    text.push_str(&after_text);
+    // The budget arithmetic above already bounds this; refuse rather than publish more.
+    if text.len() > IME_SURROUNDING_MAX_BYTES {
+        return None;
+    }
+    // The caret and anchor are the selection's own endpoints, so their offsets inside the
+    // window are the window's start plus either end of the selected text.
+    let (cursor, anchor) = if caret >= anchor { (before_len + selection_len, before_len) } else { (before_len, before_len + selection_len) };
+    Some(ImeSurrounding { text, cursor, anchor })
+}
+
 /// Edit the active text body and selection; refits auto-sizing text boxes afterwards.
 pub(crate) fn edit_text<T>(s: &mut Session, f: impl FnOnce(&mut TextBody, &mut TextSel) -> T) -> Result<T> {
     let t0 = s.doc()?.selection.text.clone().ok_or_else(|| bad("text", NO_TEXT_POINT))?;
@@ -339,6 +602,7 @@ fn edit(s: &mut Session, p: &Value) -> Result<Value> {
         s.select(|_, sel| {
             sel.text = Some(TextSel { notes: true, anchor: end, caret: end, ..Default::default() });
             sel.shapes.clear();
+            sel.cells = None;
         })?;
         return ok();
     }
@@ -369,6 +633,7 @@ fn edit(s: &mut Session, p: &Value) -> Result<Value> {
     s.select(|_, sel| {
         sel.shapes = vec![id];
         sel.text = Some(TextSel { shape: id, anchor: at, caret: at, cell, notes: false, line_end: None });
+        sel.cells = None;
     })?;
     Ok(json!({"id": id, "at": [at.0, at.1]}))
 }
@@ -417,7 +682,8 @@ pub(crate) fn insert_text(s: &mut Session, text: &str, props: Option<RunProps>)
         let c = ed::insert(body, at, &text, props);
         t.anchor = c;
         t.caret = c;
-        for pi in at.0..=c.0 {
+        let last = body.paragraphs.len().saturating_sub(1);
+        for pi in at.0..=c.0.min(last) {
             if let Some(para) = body.paragraphs.get_mut(pi) {
                 promote_rtl_if_needed(para, &inherited);
             }
@@ -425,6 +691,8 @@ pub(crate) fn insert_text(s: &mut Session, text: &str, props: Option<RunProps>)
         c
     })?;
     autocorrect(s, text.chars().count() == 1)?;
+    // AutoCorrect can move the caret: a replaced word, or a list lead it removed.
+    let pos = s.doc()?.selection.text.as_ref().map_or(pos, |t| t.caret);
     Ok(json!({"caret": [pos.0, pos.1]}))
 }
 
@@ -631,6 +899,13 @@ fn autocorrect(s: &mut Session, typing: bool) -> Result<()> {
     if end == 0 || !line.get(end - 1).is_some_and(|c| c.is_whitespace() || ".,;:!?".contains(*c)) {
         return Ok(());
     }
+    if typing && s.prefs.ac_lists {
+        // A lead such as `i.` or `a.` is kept as typed, so the space after it starts its list.
+        let lead: String = line.get(..end).map(|l| l.iter().collect()).unwrap_or_default();
+        if auto_list_style(&lead).is_some() || start_auto_list(s, &t, &line, end)? {
+            return Ok(());
+        }
+    }
     let mut word_end = end - 1;
     let mut start = word_end;
     while start > 0 && line.get(start - 1).is_some_and(|c| !c.is_whitespace()) {
@@ -679,6 +954,83 @@ fn autocorrect(s: &mut Session, typing: bool) -> Result<()> {
     Ok(())
 }
 
+/// A list AutoFormat started: the text being edited right after it, the typed lead with its
+/// space, the paragraph's own formatting before, and the revision the change left.
+#[derive(Clone, Debug)]
+pub struct AutoList {
+    sel: TextSel,
+    typed: String,
+    props: deckcraft_model::text::ParaProps,
+    revision: u64,
+}
+
+/// The list a paragraph that starts with `lead` and a space or tab becomes, as the command and
+/// parameters that make it: `*` •, `-` or `–` –, `--` or `—` ■, `>` ➢, `<>` ◆, and the numbering
+/// styles `1.`, `1)`, `I.`, `i.`, `A.`, `a.` and `a)`.
+fn auto_list_style(lead: &str) -> Option<(&'static str, Value)> {
+    let bullet = |c: &str| Some(("format.bullets", json!({"on": true, "char": c})));
+    let number = |scheme: &str| Some(("format.numbering", json!({"on": true, "scheme": scheme})));
+    match lead {
+        "*" => bullet("•"),
+        "-" | "–" => bullet("–"),
+        "--" | "—" => bullet("■"),
+        ">" => bullet("➢"),
+        "<>" => bullet("◆"),
+        "1." => number("arabicPeriod"),
+        "1)" => number("arabicParenR"),
+        "I." => number("romanUcPeriod"),
+        "i." => number("romanLcPeriod"),
+        "A." => number("alphaUcPeriod"),
+        "a." => number("alphaLcPeriod"),
+        "a)" => number("alphaLcParenR"),
+        _ => None,
+    }
+}
+
+/// AutoFormat's automatic bulleted and numbered lists: when the caret's paragraph holds only a
+/// list lead (`*`, `1.`…) before the space or tab just typed, the lead and the space are removed
+/// and the paragraph becomes a list paragraph in that style. `false` when nothing changed.
+fn start_auto_list(s: &mut Session, t: &TextSel, line: &[char], end: usize) -> Result<bool> {
+    if t.is_range() || !line.get(end - 1).is_some_and(|c| *c == ' ' || *c == '\t') {
+        return Ok(false);
+    }
+    let lead: String = line.get(..end - 1).map(|l| l.iter().collect()).unwrap_or_default();
+    let Some((id, params)) = auto_list_style(&lead) else { return Ok(false) };
+    let typed: String = line.get(..end).map(|l| l.iter().collect()).unwrap_or_default();
+    let para = t.caret.0;
+    let props = body_of(s.doc()?, t).and_then(|b| b.paragraphs.get(para)).map(|p| p.props.clone()).unwrap_or_default();
+    edit_text(s, |body, tt| {
+        ed::delete(body, (para, 0), (para, end));
+        tt.anchor = (para, 0);
+        tt.caret = (para, 0);
+    })?;
+    s.execute(id, &params)?;
+    let st = s.doc_mut()?;
+    if let Some(sel) = st.selection.text.clone() {
+        st.auto_list = Some(AutoList { sel, typed, props, revision: st.revision });
+    }
+    Ok(true)
+}
+
+/// Backspace right after AutoFormat started a list: the paragraph gets back the typed lead and
+/// space and the formatting it had. `false` when the last change was anything else.
+fn undo_auto_list(s: &mut Session) -> Result<bool> {
+    let st = s.doc_mut()?;
+    let Some(a) = st.auto_list.take() else { return Ok(false) };
+    if a.revision != st.revision || st.selection.text.as_ref() != Some(&a.sel) {
+        return Ok(false);
+    }
+    edit_text(s, |body, t| {
+        if let Some(p) = body.paragraphs.get_mut(a.sel.caret.0) {
+            p.props = a.props.clone();
+        }
+        let c = ed::insert(body, a.sel.caret, &a.typed, None);
+        t.anchor = c;
+        t.caret = c;
+    })?;
+    Ok(true)
+}
+
 /// `word` is a number with the ordinal suffix it takes (1st, 22nd, 103rd, 11th), as AutoFormat
 /// superscripts it.
 fn is_ordinal(word: &str) -> bool {
@@ -726,6 +1078,7 @@ fn autocorrect_options(s: &mut Session, p: &Value) -> Result<Value> {
         ("capsLock", &mut pr.ac_caps_lock),
         ("fractions", &mut pr.ac_fractions),
         ("ordinals", &mut pr.ac_ordinals),
+        ("lists", &mut pr.ac_lists),
     ] {
         if let Some(v) = p.get(key).and_then(Value::as_bool) {
             *slot = v;
@@ -772,7 +1125,7 @@ fn autocorrect_options(s: &mut Session, p: &Value) -> Result<Value> {
     Ok(json!({
         "on": pr.autocorrect, "twoInitials": pr.ac_two_initials, "sentenceCaps": pr.ac_sentence_caps,
         "days": pr.ac_days, "capsLock": pr.ac_caps_lock, "fractions": pr.ac_fractions,
-        "ordinals": pr.ac_ordinals, "entries": list,
+        "ordinals": pr.ac_ordinals, "lists": pr.ac_lists, "entries": list,
     }))
 }
 
@@ -784,7 +1137,8 @@ pub(crate) fn paste_body(s: &mut Session, src: &TextBody) -> Result<Value> {
         let c = ed::insert_body(body, at, src);
         t.anchor = c;
         t.caret = c;
-        for pi in at.0..=c.0 {
+        let last = body.paragraphs.len().saturating_sub(1);
+        for pi in at.0..=c.0.min(last) {
             if let Some(para) = body.paragraphs.get_mut(pi) {
                 promote_rtl_if_needed(para, &inherited);
             }
@@ -841,7 +1195,9 @@ fn compose(s: &mut Session, p: &Value) -> Result<Value> {
     // A composition whose text was changed under it is kept as it is; a new one starts.
     let current = match current {
         Some(c) if !composition_fits(s.doc()?, &c) => {
-            s.end_composition();
+            // The text changed under the pre-edit: the app settled it, so the platform's copy
+            // must be cancelled too.
+            s.settle_composition();
             None
         }
         c => c,
@@ -1026,6 +1382,9 @@ fn insert(s: &mut Session, p: &Value) -> Result<Value> {
 }
 
 pub(crate) fn delete_dir(s: &mut Session, dir: &str) -> Result<Value> {
+    if dir == "backward" && undo_auto_list(s)? {
+        return ok();
+    }
     let dir = dir.to_string();
     edit_text(s, move |body, t| {
         let (a, b) = t.ordered();
@@ -1060,6 +1419,93 @@ pub(crate) fn delete_dir(s: &mut Session, dir: &str) -> Result<Value> {
     ok()
 }
 
+/// A `before`/`after` count from a control or input-method request.
+///
+/// Input-derived numbers are hostile: a value that does not fit `usize` (on 32-bit wasm, say) is
+/// clamped to `usize::MAX` and then bounded by the walk, never truncated to a smaller count that
+/// would delete different text than asked.
+fn count_param(p: &Value, name: &str) -> usize {
+    p.get(name).and_then(Value::as_u64).map_or(0, |v| usize::try_from(v).unwrap_or(usize::MAX))
+}
+
+/// Delete at most the requested character or byte counts around the selection or pre-edit,
+/// preserving selection direction and composition boundaries and recording one undo step
+/// outside composition.
+fn delete_surrounding(s: &mut Session, p: &Value) -> Result<Value> {
+    let before = count_param(p, "before");
+    let after = count_param(p, "after");
+    let bytes = bool_or(p, "bytes", false);
+    let st = s.doc()?;
+    let t = st.selection.text.clone().ok_or_else(|| bad("text.deleteSurrounding", "not editing text"))?;
+    let body = body_of(st, &t).ok_or_else(|| bad("text.deleteSurrounding", "the text being edited is gone"))?;
+    let comp = composition_range(body, st.composition.as_ref());
+    // The ranges are in the same logical coordinates `ime_surrounding` publishes: one byte for a
+    // paragraph separator and for a soft line break. A range may therefore cross paragraphs.
+    let ordered = {
+        let a = model_pos(body, t.anchor).ok_or_else(|| bad("text.deleteSurrounding", "the selection is not in the text"))?;
+        let b = model_pos(body, t.caret).ok_or_else(|| bad("text.deleteSurrounding", "the selection is not in the text"))?;
+        if a <= b { (a, b) } else { (b, a) }
+    };
+    // The selection (or the input method's pre-edit) stays exactly where it is. Only whole
+    // scalars fully inside the requested before/after ranges around it are removed.
+    let (start, end) = match comp {
+        Some((pi, cs, ce)) => ((pi, cs), (pi, ce)),
+        None => ordered,
+    };
+    let (from, before_chars, _) = walk_backward(body, comp, start, before, bytes);
+    let (to, after_chars, _) = walk_forward(body, comp, end, after, bytes);
+    let deleted = before_chars + after_chars;
+    if deleted == 0 {
+        return Ok(json!({"deleted": 0}));
+    }
+    let before_doc = st.doc.clone();
+    let before_sel = st.selection.clone();
+    let composing = st.composition.is_some();
+    let vertex_kind = s.tool.vertex_kind.clone();
+    edit_text(s, |body, t| {
+        // Delete the after-range first, so the positions of the earlier range stay valid; then
+        // the text before the selection.
+        if after_chars > 0 {
+            ed::delete(body, end, to);
+        }
+        if before_chars > 0 {
+            ed::delete(body, from, start);
+        }
+        t.anchor = remap_after_delete(t.anchor, start, from, before_chars);
+        t.caret = remap_after_delete(t.caret, start, from, before_chars);
+        t.line_end = None;
+    })?;
+    if composing {
+        if let Some(c) = s.doc_mut()?.composition.as_mut() {
+            c.start = if before_chars == 0 {
+                start
+            } else if from.0 == start.0 {
+                (start.0, start.1 - before_chars)
+            } else {
+                from
+            };
+        }
+    } else {
+        push_undo(s.doc_mut()?, HistoryEntry { label: "Delete Text".into(), doc: before_doc, selection: before_sel, vertex_kind });
+    }
+    Ok(json!({"deleted": deleted}))
+}
+
+/// Map a text position across the deletion of `before_chars` characters that begins at `start`
+/// and reaches back to `from`. Within the start paragraph its characters shift; from an earlier
+/// paragraph those paragraphs merge, so later paragraph numbers shift too.
+fn remap_after_delete(pos: (usize, usize), start: (usize, usize), from: (usize, usize), before_chars: usize) -> (usize, usize) {
+    if before_chars == 0 || pos < start {
+        return pos;
+    }
+    if from.0 == start.0 {
+        // Only endpoints in the start paragraph move; later paragraphs keep their text.
+        if pos.0 == start.0 { (pos.0, pos.1 - before_chars) } else { pos }
+    } else {
+        (from.0 + (pos.0 - start.0), if pos.0 == start.0 { from.1 + (pos.1 - start.1) } else { pos.1 })
+    }
+}
+
 fn delete(s: &mut Session, p: &Value) -> Result<Value> {
     delete_dir(s, str_param(p, "dir").unwrap_or("backward"))
 }
@@ -1124,7 +1570,7 @@ fn move_caret(s: &mut Session, p: &Value) -> Result<Value> {
             }
             None => match to.as_str() {
                 "up" => (caret.0.saturating_sub(1), caret.1),
-                "down" => ((caret.0 + 1).min(body.paragraphs.len().saturating_sub(1)), caret.1),
+                "down" => (caret.0.saturating_add(1).min(body.paragraphs.len().saturating_sub(1)), caret.1),
                 "lineStart" => (caret.0, 0),
                 _ => (caret.0, body.paragraphs.get(caret.0).map(|x| x.char_len()).unwrap_or(0)),
             },
@@ -1189,9 +1635,11 @@ fn select_para(s: &mut Session, p: &Value) -> Result<Value> {
     let t = st.selection.text.clone().ok_or_else(|| bad("text.selectParagraph", "not editing text"))?;
     let at = pos_param(p, "at").unwrap_or(t.caret);
     let body = body_of(st, &t);
+    // Clamp to the last paragraph so a huge index can neither overflow nor select past the body.
+    let at = (at.0.min(body.map_or(0, |b| b.paragraphs.len().saturating_sub(1))), at.1);
     let n = body.and_then(|b| b.paragraphs.get(at.0)).map(|x| x.char_len()).unwrap_or(0);
     // The paragraph mark is part of the paragraph (PowerPoint's triple-click selects it too).
-    let end = if body.is_some_and(|b| at.0 + 1 < b.paragraphs.len()) { (at.0 + 1, 0) } else { (at.0, n) };
+    let end = if body.is_some_and(|b| at.0.saturating_add(1) < b.paragraphs.len()) { (at.0.saturating_add(1), 0) } else { (at.0, n) };
     s.select(|_, sel| {
         if let Some(t) = sel.text.as_mut() {
             t.anchor = (at.0, 0);
@@ -1293,12 +1741,18 @@ pub(crate) fn format_run(s: &mut Session, f: &(dyn Fn(&mut RunProps) + Send + Sy
     if ids.is_empty() {
         return Err(bad("format", SELECT_TEXT_OR_SHAPE));
     }
+    let cells = st.selection.cells;
     edit_shapes(s, &json!({"ids": ids}), "format", |sh| {
+        let id = sh.id;
         match &mut sh.kind {
             ShapeKind::Table(t) => {
-                for row in &mut t.rows {
-                    for c in &mut row.cells {
-                        ed::format_all(&mut c.text, f);
+                // Only the selected cells, when a range of them is selected.
+                let range = super::table::selected_range(cells, id, t);
+                for (r, row) in t.rows.iter_mut().enumerate() {
+                    for (c, cell) in row.cells.iter_mut().enumerate() {
+                        if super::table::in_range(range, r, c) {
+                            ed::format_all(&mut cell.text, f);
+                        }
                     }
                 }
             }
@@ -1371,7 +1825,8 @@ pub(crate) fn format_para(s: &mut Session, f: &(dyn Fn(&mut deckcraft_model::tex
             if body.paragraphs.is_empty() {
                 body.paragraphs.push(Default::default());
             }
-            for pi in a.0..=b.0 {
+            let last = body.paragraphs.len().saturating_sub(1);
+            for pi in a.0..=b.0.min(last) {
                 if let Some(p) = body.paragraphs.get_mut(pi) {
                     f(p);
                 }
@@ -1383,12 +1838,17 @@ pub(crate) fn format_para(s: &mut Session, f: &(dyn Fn(&mut deckcraft_model::tex
     if ids.is_empty() {
         return Err(bad("format", SELECT_TEXT_OR_SHAPE));
     }
+    let cells = st.selection.cells;
     edit_shapes(s, &json!({"ids": ids}), "format", |sh| {
+        let id = sh.id;
         match &mut sh.kind {
             ShapeKind::Table(t) => {
-                for row in &mut t.rows {
-                    for c in &mut row.cells {
-                        c.text.paragraphs.iter_mut().for_each(f);
+                let range = super::table::selected_range(cells, id, t);
+                for (r, row) in t.rows.iter_mut().enumerate() {
+                    for (c, cell) in row.cells.iter_mut().enumerate() {
+                        if super::table::in_range(range, r, c) {
+                            cell.text.paragraphs.iter_mut().for_each(f);
+                        }
                     }
                 }
             }
@@ -1475,6 +1935,210 @@ mod rtl_promote_tests {
     }
 }
 
+#[cfg(test)]
+mod ime_surrounding_tests {
+    #![allow(clippy::unwrap_used, clippy::expect_used)]
+
+    use serde_json::json;
+
+    use crate::Session;
+
+    /// Test helper: insert and enter a rectangle containing `aé😀b`, returning its shape id.
+    fn edit(s: &mut Session) -> u64 {
+        let r = s.execute("shape.insert", &json!({"preset": "rect", "rect": [10, 10, 240, 60], "text": "aé😀b"})).unwrap();
+        let id = r["id"].as_u64().unwrap();
+        s.execute("text.edit", &json!({"id": id})).unwrap();
+        id
+    }
+
+    /// Test helper: return the identified shape's text, or an empty string when it is gone.
+    fn text(s: &Session, id: u64) -> String {
+        let id = deckcraft_model::ShapeId(u32::try_from(id).unwrap());
+        s.doc().unwrap().shape(id).and_then(|sh| sh.text.as_ref()).map(deckcraft_model::text::TextBody::text).unwrap_or_default()
+    }
+
+    /// Test helper: set an in-paragraph text selection through the engine command path.
+    fn select(s: &mut Session, anchor: usize, caret: usize) {
+        s.execute("text.select", &json!({"anchor": [0, anchor], "caret": [0, caret]})).unwrap();
+    }
+
+    /// DeleteSurrounding removes only the requested text around the selection. The selection
+    /// itself and its direction stay, so the following commit replaces it.
+    #[test]
+    fn selected_text_survives_the_requested_characters_or_bytes_around_it() {
+        let mut s = Session::with_new();
+        let id = edit(&mut s);
+        select(&mut s, 3, 1); // reversed: caret before anchor, selecting é😀
+        s.delete_surrounding(1, 1, false).unwrap();
+        assert_eq!(text(&s, id), "é😀", "a and b go; the selected run stays");
+        let t = s.doc().unwrap().selection.text.clone().unwrap();
+        assert_eq!((t.anchor, t.caret), ((0, 2), (0, 0)), "both endpoints shift and stay reversed");
+        s.execute("edit.undo", &json!({})).unwrap();
+        assert_eq!(text(&s, id), "aé😀b");
+
+        select(&mut s, 1, 3);
+        s.delete_surrounding(1, 1, true).unwrap();
+        assert_eq!(text(&s, id), "é😀", "byte counts around the selection delete a and b too");
+        s.execute("edit.undo", &json!({})).unwrap();
+        assert_eq!(text(&s, id), "aé😀b");
+    }
+
+    /// A byte range removes only whole scalars fully contained in it. A count that ends inside
+    /// a character leaves that character whole (and undeleted), never splitting it.
+    #[test]
+    fn byte_counts_round_inward_to_whole_characters() {
+        let mut s = Session::with_new();
+        let id = edit(&mut s);
+        select(&mut s, 2, 2); // after é: bytes 0..3
+        s.delete_surrounding(1, 0, true).unwrap();
+        assert_eq!(text(&s, id), "aé😀b", "one byte inside é is not the whole scalar");
+        s.delete_surrounding(2, 0, true).unwrap();
+        assert_eq!(text(&s, id), "a😀b", "two bytes reach é's start, so the whole é goes");
+        s.execute("edit.undo", &json!({})).unwrap();
+        assert_eq!(text(&s, id), "aé😀b");
+
+        select(&mut s, 2, 2);
+        s.delete_surrounding(0, 1, true).unwrap();
+        assert_eq!(text(&s, id), "aé😀b", "one byte into the emoji is not the whole scalar");
+        s.delete_surrounding(0, 4, true).unwrap();
+        assert_eq!(text(&s, id), "aéb", "four bytes contain the whole emoji");
+    }
+
+    /// The committed query is logical text with UTF-8 byte offsets; it keeps a reversed
+    /// selection, removes the model-stored pre-edit, and treats an empty body as available.
+    #[test]
+    fn surrounding_text_is_committed_logical_and_bounded() {
+        use super::{IME_SURROUNDING_MAX_BYTES, ime_surrounding};
+
+        let mut s = Session::with_new();
+        let id = edit(&mut s);
+        let st = s.doc().unwrap();
+        let t = st.selection.text.clone().unwrap();
+        let q = ime_surrounding(st, &t).unwrap();
+        assert_eq!((q.text.as_str(), q.cursor, q.anchor), ("aé😀b", 8, 8));
+
+        s.execute("text.select", &json!({"anchor": [0, 3], "caret": [0, 1]})).unwrap();
+        let st = s.doc().unwrap();
+        let t = st.selection.text.clone().unwrap();
+        let q = ime_surrounding(st, &t).unwrap();
+        assert_eq!((q.cursor, q.anchor), (1, 7), "reversed selection keeps caret before anchor");
+        assert_eq!(q.text, "aé😀b");
+
+        s.execute("text.set", &json!({"id": id, "text": "ab"})).unwrap();
+        s.execute("text.move", &json!({"to": "end"})).unwrap();
+        s.compose_text("日本", None).unwrap();
+        let st = s.doc().unwrap();
+        let t = st.selection.text.clone().unwrap();
+        let q = ime_surrounding(st, &t).unwrap();
+        assert_eq!((q.text.as_str(), q.cursor, q.anchor), ("ab", 2, 2), "pre-edit is not committed text");
+
+        s.execute("text.set", &json!({"id": id, "text": ""})).unwrap();
+        let st = s.doc().unwrap();
+        let t = st.selection.text.clone().unwrap();
+        let q = ime_surrounding(st, &t).unwrap();
+        assert_eq!((q.text.as_str(), q.cursor, q.anchor), ("", 0, 0), "empty body is available");
+
+        let long = "a".repeat(IME_SURROUNDING_MAX_BYTES + 1500);
+        s.execute("text.set", &json!({"id": id, "text": long})).unwrap();
+        s.execute("text.move", &json!({"to": "end"})).unwrap();
+        let st = s.doc().unwrap();
+        let t = st.selection.text.clone().unwrap();
+        let q = ime_surrounding(st, &t).unwrap();
+        assert!(q.text.len() <= IME_SURROUNDING_MAX_BYTES, "{}", q.text.len());
+        assert_eq!(q.cursor, q.text.len(), "caret stays at the end of the bounded window");
+    }
+
+    /// Paragraph marks are part of the logical text the platform sees (`\n`), so a deletion may
+    /// remove one and merge the paragraphs, exactly as the published offsets say.
+    #[test]
+    fn paragraph_marks_are_deletable_logical_text() {
+        use super::ime_surrounding;
+
+        let mut s = Session::with_new();
+        let id = edit(&mut s);
+        s.execute("text.set", &json!({"id": id, "text": "ab\ncd"})).unwrap();
+        // The caret at the start of the second paragraph: after "ab" and its paragraph mark.
+        s.execute("text.select", &json!({"anchor": [1, 0], "caret": [1, 0]})).unwrap();
+        let st = s.doc().unwrap();
+        let q = ime_surrounding(st, &st.selection.text.clone().unwrap()).unwrap();
+        assert_eq!((q.text.as_str(), q.cursor, q.anchor), ("ab\ncd", 3, 3));
+
+        // One byte before the caret is that paragraph mark.
+        s.delete_surrounding(1, 0, true).unwrap();
+        assert_eq!(text(&s, id), "abcd", "the mark goes and the paragraphs merge");
+        let t = s.doc().unwrap().selection.text.clone().unwrap();
+        assert_eq!(t.caret, (0, 2), "the caret stays where the merged text continues");
+        s.execute("edit.undo", &json!({})).unwrap();
+        assert_eq!(text(&s, id), "ab\ncd");
+
+        // Characters count the same mark.
+        s.execute("text.select", &json!({"anchor": [1, 0], "caret": [1, 0]})).unwrap();
+        s.delete_surrounding(1, 0, false).unwrap();
+        assert_eq!(text(&s, id), "abcd");
+        s.execute("edit.undo", &json!({})).unwrap();
+
+        // And from the other side: one character after the end of the first paragraph.
+        s.execute("text.select", &json!({"anchor": [0, 2], "caret": [0, 2]})).unwrap();
+        s.delete_surrounding(0, 1, false).unwrap();
+        assert_eq!(text(&s, id), "abcd");
+    }
+
+    /// A soft line break (Shift+Enter) is published as a newline, like a paragraph break: the
+    /// platform must never see the model's `\u{b}`, which its own text filter would reject.
+    #[test]
+    fn soft_line_breaks_read_as_newlines() {
+        use super::ime_surrounding;
+
+        let mut s = Session::with_new();
+        let id = edit(&mut s);
+        s.execute("text.autocorrect", &json!({"on": false})).unwrap(); // isolate logical line-break coordinates
+
+        s.execute("text.set", &json!({"id": id, "text": "ab"})).unwrap();
+        s.execute("text.select", &json!({"anchor": [0, 1], "caret": [0, 1]})).unwrap();
+        s.execute("text.insert", &json!({"text": "\u{b}"})).unwrap();
+        assert_eq!(text(&s, id), "a\u{b}b", "a line break inside one paragraph");
+        let st = s.doc().unwrap();
+        let q = ime_surrounding(st, &st.selection.text.clone().unwrap()).unwrap();
+        assert_eq!((q.text.as_str(), q.cursor, q.anchor), ("a\nb", 2, 2));
+
+        // The break is one logical byte, so removing it removes one character.
+        s.delete_surrounding(1, 0, true).unwrap();
+        assert_eq!(text(&s, id), "ab");
+        s.execute("edit.undo", &json!({})).unwrap();
+        assert_eq!(text(&s, id), "a\u{b}b");
+    }
+
+    /// A count that does not fit a `usize` (32-bit wasm) is clamped, never truncated to a
+    /// different number that would delete other text than the platform asked for.
+    #[test]
+    fn out_of_range_counts_clamp_instead_of_truncating() {
+        let mut s = Session::with_new();
+        let id = edit(&mut s);
+        select(&mut s, 1, 1);
+        s.delete_surrounding(usize::MAX, 0, false).unwrap();
+        assert_eq!(text(&s, id), "é😀b", "everything before the caret goes, no panic");
+        let expected = usize::try_from(4_294_967_296u64).unwrap_or(usize::MAX);
+        assert_eq!(super::count_param(&json!({"before": 4_294_967_296u64}), "before"), expected);
+        assert!(expected > 0, "the count is clamped, not wrapped to nothing");
+        assert_eq!(super::count_param(&json!({}), "before"), 0);
+    }
+
+    /// A non-composing input-method deletion is exactly one undo step; the manual history entry
+    /// must not be duplicated by the generic command wrapper.
+    #[test]
+    fn a_non_composing_ime_deletion_is_one_undo_step() {
+        let mut s = Session::with_new();
+        let id = edit(&mut s);
+        let undo = s.doc().unwrap().history.undo.len();
+        select(&mut s, 3, 3);
+        s.delete_surrounding(1, 0, false).unwrap();
+        assert_eq!(text(&s, id), "aéb");
+        assert_eq!(s.doc().unwrap().history.undo.len(), undo + 1, "one history entry, not two");
+        s.execute("edit.undo", &json!({})).unwrap();
+        assert_eq!(text(&s, id), "aé😀b");
+    }
+}
+
 #[cfg(test)]
 mod replace_font_tests {
     use serde_json::json;
@@ -1519,3 +2183,23 @@ mod replace_font_tests {
         assert!(s.execute("font.replace", &json!({"from": "Inter"})).is_err());
     }
 }
+
+#[cfg(test)]
+mod select_paragraph_tests {
+    use serde_json::json;
+
+    use crate::Session;
+
+    #[test]
+    fn select_paragraph_huge_at() {
+        let mut s = Session::with_new();
+        s.execute("slide.new", &json!({"layout": "titleAndContent", "title": "T", "body": "B"})).unwrap();
+        s.execute("insert.textBox", &json!({"rect": [10, 10, 200, 50], "text": "hello"})).unwrap();
+        s.execute("text.edit", &json!({})).unwrap();
+        let r = s.execute("text.selectParagraph", &json!({"at": [u64::MAX, 0]}));
+        assert!(r.is_ok(), "{r:?}");
+        let t = s.doc().unwrap().selection.text.clone().unwrap();
+        // Clamped to the last (only) paragraph, never past the end of the body.
+        assert_eq!((t.anchor, t.caret), ((0, 0), (0, 5)));
+    }
+}

crates/engine/src/cmd/transition.rs

@@ -6,7 +6,7 @@ use deckcraft_model::Transition;
 use deckcraft_model::anim::TRANSITIONS;
 use serde_json::{Value, json};
 
-use super::*;
+use super::{CommandSpec, NO_ID_SPACE, always, bad, bool_param, cmd, has_slide, ok, str_param, usize_param};
 use crate::{Result, Session};
 
 pub fn specs() -> Vec<CommandSpec> {
@@ -111,7 +111,11 @@ fn timing(s: &mut Session, p: &Value) -> Result<Value> {
                 }
                 match p.get("after") {
                     Some(Value::Null) => t.advance_after_ms = None,
-                    Some(v) => t.advance_after_ms = v.as_u64().map(|x| x.min(86_400_000) as u32),
+                    Some(v) => {
+                        if let Some(x) = v.as_u64() {
+                            t.advance_after_ms = Some(x.min(86_400_000) as u32);
+                        }
+                    }
                     None => {}
                 }
             }

crates/engine/src/cmd/zoom.rs

@@ -13,7 +13,7 @@ use deckcraft_model::text::{Action, Hyperlink, TextBody};
 use deckcraft_model::{LayoutType, Shape, ShapeId, ShapeKind, SlideId, defaults};
 use serde_json::{Value, json};
 
-use super::*;
+use super::{CommandSpec, NO_ID_SPACE, bad, bool_or, cmd, has_slide, str_param};
 use crate::{Result, Session};
 
 pub fn specs() -> Vec<CommandSpec> {

crates/engine/src/compare.rs

@@ -1,5 +1,5 @@
 //! Review › Compare: the differences between the open presentation and a revised copy of it, slide
-//! by slide, and accepting a revised slide into the open one.
+//! by slide, and accepting a revised slide into the open one or rejecting it.
 //!
 //! Slides match by id (a revised copy of the same deck keeps them); when the two decks share no
 //! slide id at all, by position. Shapes match by id, then by name.
@@ -7,7 +7,7 @@
 use std::collections::{HashMap, HashSet};
 use std::sync::Arc;
 
-use deckcraft_model::{Fill, MediaId, Presentation, Shape, ShapeId, ShapeKind, Slide, SlideId};
+use deckcraft_model::{MediaId, Presentation, Shape, ShapeId, ShapeKind, Slide, SlideId};
 use serde::Serialize;
 
 /// The revised presentation a document is being compared with.
@@ -18,6 +18,54 @@ pub struct Compare {
     /// Slides match by position (the decks shared no slide id when the compare started); fixed
     /// for the session so accepting slides doesn't switch the matching half way.
     pub by_position: bool,
+    /// Revisions rejected: no longer listed and never accepted, the open deck left as it is.
+    pub rejected: HashSet<ChangeKey>,
+}
+
+/// What a revision is about, stable while slides move: the open slide (for changed and deleted)
+/// and the revised slide (for changed and inserted).
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash)]
+pub struct ChangeKey {
+    kind: ChangeKind,
+    open: Option<SlideId>,
+    revised: Option<usize>,
+}
+
+impl ChangeKey {
+    pub fn of(doc: &Presentation, change: &Change) -> ChangeKey {
+        let open = match change.kind {
+            ChangeKind::Inserted => None,
+            ChangeKind::Changed | ChangeKind::Deleted => doc.slides.get(change.slide).map(|s| s.id),
+        };
+        ChangeKey { kind: change.kind, open, revised: change.revised }
+    }
+}
+
+/// The revisions still to review: [`diff`] without the rejected ones.
+pub fn pending(doc: &Presentation, c: &Compare) -> Vec<Change> {
+    let mut out = diff(doc, &c.revised, c.by_position);
+    out.retain(|ch| !is_rejected(doc, c, ch));
+    out
+}
+
+/// Whether `ch` was rejected. Positional matching re-pairs slides by index when the open deck gains
+/// or loses a slide, which changes the open half of the key; the revised index stays put, so any
+/// rejected key for the same revised slide counts. An open slide pushed past the end of the revised
+/// deck turns into a deletion; it stays kept when a rejected key names it.
+fn is_rejected(doc: &Presentation, c: &Compare, ch: &Change) -> bool {
+    if c.rejected.contains(&ChangeKey::of(doc, ch)) {
+        return true;
+    }
+    if !c.by_position {
+        return false;
+    }
+    match ch.kind {
+        ChangeKind::Deleted => {
+            let open = doc.slides.get(ch.slide).map(|s| s.id);
+            open.is_some() && c.rejected.iter().any(|k| k.open == open)
+        }
+        _ => ch.revised.is_some() && c.rejected.iter().any(|k| k.revised == ch.revised),
+    }
 }
 
 /// Whether `cur` and `rev` share no slide id (then slides match by position).
@@ -26,7 +74,7 @@ pub fn unrelated(cur: &Presentation, rev: &Presentation) -> bool {
     !cur.slides.iter().any(|s| ids.contains(&s.id))
 }
 
-#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize)]
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, Serialize)]
 #[serde(rename_all = "camelCase")]
 pub enum ChangeKind {
     /// Only in the revised deck.
@@ -233,14 +281,16 @@ fn max_shape_id(shapes: &[Shape], m: &mut u32) {
 pub fn adopt(doc: &mut Presentation, rev: &Presentation, slide: &Slide, replacing: Option<SlideId>) -> crate::Result<Slide> {
     let mut sl = slide.clone();
     // Media.
-    let mut mids = vec![];
-    crate::cmd::edit::media_of_shapes(&sl.shapes, &mut mids);
     let mut media_map: HashMap<MediaId, MediaId> = HashMap::new();
-    for id in mids {
+    for id in crate::media_refs::slide_media(&sl) {
         let Some(m) = rev.media(id) else { continue };
         match doc.media(id) {
             Some(x) if x.data == m.data => {}
-            None => doc.media.push(m.clone()),
+            None => {
+                // Keeps the revision's id, so later ids must start past it.
+                doc.media.push(m.clone());
+                doc.next_id = doc.next_id.max(id.0);
+            }
             Some(_) => {
                 let new = doc
                     .add_media(&m.name, &m.content_type, m.data.as_ref().clone())
@@ -262,7 +312,6 @@ pub fn adopt(doc: &mut Presentation, rev: &Presentation, slide: &Slide, replacin
         shapes: &mut [Shape],
         taken: &HashSet<u32>,
         ids: &mut HashMap<ShapeId, ShapeId>,
-        media: &HashMap<MediaId, MediaId>,
         depth: usize,
     ) -> crate::Result<()> {
         if depth > 64 {
@@ -274,31 +323,18 @@ pub fn adopt(doc: &mut Presentation, rev: &Presentation, slide: &Slide, replacin
                 ids.insert(s.id, new);
                 s.id = new;
             }
-            let remap = |m: &mut MediaId| {
-                if let Some(n) = media.get(m) {
-                    *m = *n;
-                }
-            };
-            match &mut s.kind {
-                ShapeKind::Picture { fill } => remap(&mut fill.media),
-                ShapeKind::Media(m) => {
-                    remap(&mut m.media);
-                    if let Some(p) = m.poster.as_mut() {
-                        remap(p);
-                    }
-                }
-                _ => {}
-            }
-            if let Some(Fill::Picture(pf)) = &mut s.fill {
-                remap(&mut pf.media);
-            }
             if let Some(ch) = s.children_mut() {
-                rec(doc, ch, taken, ids, media, depth + 1)?;
+                rec(doc, ch, taken, ids, depth + 1)?;
             }
         }
         Ok(())
     }
-    rec(doc, &mut sl.shapes, &taken, &mut id_map, &media_map, 0)?;
+    rec(doc, &mut sl.shapes, &taken, &mut id_map, 0)?;
+    crate::media_refs::visit_mut::slide(&mut sl, &mut |m: &mut MediaId| {
+        if let Some(n) = media_map.get(m) {
+            *m = *n;
+        }
+    });
     for a in &mut sl.animations {
         if let Some(n) = id_map.get(&a.shape) {
             a.shape = *n;
@@ -412,6 +448,52 @@ mod tests {
         assert_eq!(s.doc().unwrap().doc.slides.len(), n, "comparing alone changes nothing");
     }
 
+    /// A deck with one slide: a table whose cell has a picture fill, a picture background and a
+    /// transition sound. `tag` starts the bytes of each.
+    fn media_deck(tag: &str) -> deckcraft_model::Presentation {
+        use std::sync::Arc;
+
+        use deckcraft_model::style::PictureFill;
+        use deckcraft_model::{Background, Fill, Shape, ShapeId, ShapeKind, Table, Transition, defaults};
+
+        let mut p = defaults::new_presentation(None);
+        let cell = p.add_media("cell.png", "image/png", format!("{tag} cell").into_bytes()).expect("media");
+        let back = p.add_media("back.png", "image/png", format!("{tag} background").into_bytes()).expect("media");
+        let sound = p.add_media("sound.wav", "audio/wav", format!("{tag} sound").into_bytes()).expect("media");
+        let mut t = Table::new(1, 1, 100.0, 40.0);
+        t.rows[0].cells[0].fill = Some(Fill::Picture(PictureFill { media: cell, ..Default::default() }));
+        let id = ShapeId(p.alloc_id().expect("id"));
+        let mut s = (*p.slides.first().cloned().unwrap_or_default()).clone();
+        s.shapes.push(Shape { id, kind: ShapeKind::Table(t), ..Default::default() });
+        s.background = Some(Background::Fill { fill: Fill::Picture(PictureFill { media: back, ..Default::default() }) });
+        s.transition = Some(Transition { kind: "fade".into(), sound: Some(sound), ..Default::default() });
+        p.slides = vec![Arc::new(s)];
+        p
+    }
+
+    #[test]
+    fn an_accepted_slide_keeps_its_cell_picture_background_and_sound() {
+        use deckcraft_model::{Background, Fill, MediaId, ShapeKind};
+
+        // Both decks hold the same media ids with different bytes.
+        let mut doc = media_deck("open");
+        let rev = media_deck("revised");
+        let sl = super::adopt(&mut doc, &rev, &rev.slides[0], None).unwrap();
+        let bytes = |id: MediaId| doc.media(id).unwrap().data.as_ref().clone();
+        let table = sl.shapes.iter().find_map(|x| if let ShapeKind::Table(t) = &x.kind { Some(t) } else { None }).unwrap();
+        let Some(Fill::Picture(cell)) = &table.rows[0].cells[0].fill else { panic!("no cell picture") };
+        let Some(Background::Fill { fill: Fill::Picture(back) }) = &sl.background else { panic!("no background picture") };
+        let sound = sl.transition.as_ref().and_then(|t| t.sound).unwrap();
+        assert_eq!(
+            [bytes(cell.media), bytes(back.media), bytes(sound)],
+            ["revised cell", "revised background", "revised sound"].map(|x| x.as_bytes().to_vec())
+        );
+        // The open deck's own slide is untouched.
+        let own = &doc.slides[0];
+        let Some(Background::Fill { fill: Fill::Picture(back) }) = &own.background else { panic!("no background picture") };
+        assert_eq!(bytes(back.media), b"open background");
+    }
+
     #[test]
     fn accept_one_then_all_makes_the_decks_equal_and_undoes() {
         let (mut s, rev, n) = decks();
@@ -434,6 +516,50 @@ mod tests {
         assert!(s.execute("review.accept", &json!({"all": true})).is_err());
     }
 
+    #[test]
+    fn reject_keeps_the_open_deck_and_accept_all_skips_rejected_revisions() {
+        let (mut s, rev, n) = decks();
+        s.execute("review.compare", &json!({"name": "rev.deckcraft", "data": rev})).unwrap();
+        let before = s.execute("review.revisions", &json!({})).unwrap()["changes"].as_array().unwrap().clone();
+        let ins = before.iter().position(|c| c["kind"] == "inserted").unwrap();
+        let doc = s.doc().unwrap().doc.clone();
+        let undo = s.doc().unwrap().history.undo.len();
+        assert_eq!(s.execute("review.reject", &json!({"index": ins})).unwrap()["rejected"], 1);
+        assert!(std::sync::Arc::ptr_eq(&doc, &s.doc().unwrap().doc), "rejecting leaves the open deck as it is");
+        let left = s.execute("review.revisions", &json!({})).unwrap();
+        assert_eq!(kinds(&left).len(), before.len() - 1);
+        assert!(!kinds(&left).contains(&"inserted".into()), "{left}");
+        // Accept All takes the rest, never the rejected slide.
+        s.execute("review.accept", &json!({"all": true})).unwrap();
+        let st = s.doc().unwrap();
+        assert_eq!(st.doc.slides.len(), n - 1, "the deleted slide goes, the rejected insertion never comes");
+        assert!(!st.doc.slides.iter().any(|x| super::slide_title(x) == "Brand new"));
+        assert!(s.execute("review.revisions", &json!({})).unwrap()["changes"].as_array().unwrap().is_empty());
+        s.execute("edit.undo", &json!({})).unwrap();
+        assert!(std::sync::Arc::ptr_eq(&doc, &s.doc().unwrap().doc));
+        assert_eq!(s.doc().unwrap().history.undo.len(), undo, "rejecting is not an undo step");
+        // Reject All: nothing left to review, the deck as it was; Accept All then has nothing to take.
+        assert_eq!(s.execute("review.reject", &json!({"all": true})).unwrap()["rejected"], before.len() - 1);
+        assert!(s.execute("review.revisions", &json!({})).unwrap()["changes"].as_array().unwrap().is_empty());
+        assert!(s.execute("review.accept", &json!({"all": true})).is_err());
+        assert!(std::sync::Arc::ptr_eq(&doc, &s.doc().unwrap().doc));
+        assert!(s.execute("review.reject", &json!({"all": true})).is_err(), "nothing left to reject");
+        assert!(s.execute("review.reject", &json!({})).is_err());
+        s.execute("review.endCompare", &json!({})).unwrap();
+        assert!(s.execute("review.reject", &json!({"index": 0})).is_err());
+    }
+
+    #[test]
+    fn rejecting_one_revision_keeps_the_others_in_order() {
+        let (mut s, rev, _) = decks();
+        s.execute("review.compare", &json!({"name": "rev.deckcraft", "data": rev})).unwrap();
+        let before = s.execute("review.revisions", &json!({})).unwrap()["changes"].as_array().unwrap().clone();
+        assert!(s.execute("review.reject", &json!({"index": before.len()})).is_err());
+        s.execute("review.reject", &json!({"index": 0})).unwrap();
+        let left = s.execute("review.revisions", &json!({})).unwrap()["changes"].as_array().unwrap().clone();
+        assert_eq!(left.as_slice(), &before[1..], "the rejected one goes, the others stay in order");
+    }
+
     #[test]
     fn unrelated_decks_match_by_position_and_bad_input_fails() {
         let mut s = Session::with_new();
@@ -452,4 +578,65 @@ mod tests {
         assert!(s.execute("review.compare", &json!({})).is_err());
         assert!(s.execute("review.accept", &json!({"index": 999})).is_err());
     }
+
+    fn slide_texts(s: &Session) -> Vec<String> {
+        s.doc().unwrap().doc.slides.iter().map(|sl| sl.shapes.iter().filter_map(|x| x.text.as_ref()).map(|t| t.text()).collect::<String>()).collect()
+    }
+
+    /// By position, a rejected revision stays rejected when a slide is inserted into the open deck
+    /// and the same revised slide now pairs with a different open slide.
+    #[test]
+    fn a_rejected_positional_revision_stays_rejected_after_a_slide_is_inserted() {
+        let mut s = Session::with_new();
+        s.execute("slide.new", &json!({"layout": "title", "title": "A"})).unwrap();
+        let mut other = Session::with_new();
+        other.execute("slide.new", &json!({"layout": "title", "title": "B"})).unwrap();
+        let data = other.execute("file.saveBytes", &json!({"format": "pptx"})).unwrap()["data"].as_str().unwrap().to_string();
+        let v = s.execute("review.compare", &json!({"name": "o.pptx", "data": data})).unwrap();
+        assert_eq!(v["byPosition"], true, "{v}");
+        let changed = |v: &Value| -> Vec<u64> {
+            v["changes"].as_array().unwrap().iter().filter(|c| c["kind"] == "changed").map(|c| c["revised"].as_u64().unwrap()).collect()
+        };
+        let revised = changed(&v);
+        let last = *revised.last().expect("a changed slide");
+        let at = v["changes"].as_array().unwrap().iter().position(|c| c["revised"] == last).unwrap();
+        s.execute("review.reject", &json!({"index": at})).unwrap();
+        // A new slide at the front shifts every open slide down by one.
+        s.execute("slide.new", &json!({"layout": "title", "title": "N"})).unwrap();
+        let n_at = slide_texts(&s).iter().position(|t| t.contains('N')).unwrap();
+        s.execute("slide.move", &json!({"from": n_at, "to": 0})).unwrap();
+        assert_eq!(slide_texts(&s).iter().position(|t| t.contains('N')), Some(0));
+        let now = s.execute("review.revisions", &json!({})).unwrap();
+        assert!(!changed(&now).contains(&last), "{now}");
+        s.execute("review.accept", &json!({"all": true})).unwrap();
+        let texts = slide_texts(&s);
+        assert!(!texts.iter().any(|t| t.contains('B')), "{texts:?}");
+    }
+
+    /// By position, inserting a slide before a rejected pair pushes the pair's open slide past the
+    /// end of the revised deck; it must not turn into a deletion that Accept All carries out.
+    #[test]
+    fn a_rejected_positional_revision_does_not_become_a_deletion_when_a_slide_is_inserted() {
+        let mut s = Session::with_new();
+        let mut other = Session::with_new();
+        for t in ["A", "X"] {
+            s.execute("slide.new", &json!({"layout": "title", "title": t})).unwrap();
+        }
+        for t in ["B", "Y"] {
+            other.execute("slide.new", &json!({"layout": "title", "title": t})).unwrap();
+        }
+        let data = other.execute("file.saveBytes", &json!({"format": "pptx"})).unwrap()["data"].as_str().unwrap().to_string();
+        let v = s.execute("review.compare", &json!({"name": "o.pptx", "data": data})).unwrap();
+        assert_eq!(v["byPosition"], true, "{v}");
+        let changes = v["changes"].as_array().unwrap();
+        let last = changes.iter().filter(|c| c["kind"] == "changed").map(|c| c["revised"].as_u64().unwrap()).max().expect("a changed slide");
+        let at = changes.iter().position(|c| c["kind"] == "changed" && c["revised"] == last).unwrap();
+        let open_id = s.doc().unwrap().doc.slides[last as usize].id;
+        s.execute("review.reject", &json!({"index": at})).unwrap();
+        s.execute("slide.new", &json!({"layout": "title", "title": "N"})).unwrap();
+        let n_at = slide_texts(&s).iter().position(|t| t.contains('N')).unwrap();
+        s.execute("slide.move", &json!({"from": n_at, "to": 0})).unwrap();
+        s.execute("review.accept", &json!({"all": true})).unwrap();
+        assert!(s.doc().unwrap().doc.slides.iter().any(|sl| sl.id == open_id), "the open slide whose revision was rejected was deleted");
+    }
 }

crates/engine/src/guard.rs

@@ -36,11 +36,15 @@ impl Session {
     /// Run command `id` (`f`) inside the guard.
     pub(crate) fn guarded(&mut self, id: &str, f: impl FnOnce(&mut Session) -> Result<Value>) -> Result<Value> {
         let before = self.active().map(|d| (d.uid, d.doc.clone(), d.selection.clone(), d.revision));
+        let vertex_kind = self.tool.vertex_kind.clone();
         let depth = self.depth;
         match catch_unwind(AssertUnwindSafe(|| f(self))) {
             Ok(r) => r,
             Err(payload) => {
                 self.depth = depth;
+                // The remembered point type names a shape of the document it was chosen in.
+                let same = before.as_ref().is_some_and(|b| self.active().is_some_and(|st| st.uid == b.0));
+                self.tool.vertex_kind = if same { vertex_kind } else { None };
                 let msg = panic_message(payload.as_ref());
                 // Keep the document as it was before the command.
                 if let (Some((uid, doc, selection, revision)), Some(st)) = (before, self.active_mut())
@@ -91,6 +95,29 @@ mod tests {
         s.execute("shape.insert", &json!({"preset": "ellipse", "rect": [36, 236, 200, 400]})).unwrap();
     }
 
+    #[test]
+    fn a_panicking_command_keeps_the_remembered_point_type() {
+        let mut s = Session::new();
+        s.execute("file.new", &json!({})).unwrap();
+        let kept = Some((deckcraft_model::ShapeId(1), 0, 0, "straight".to_string()));
+        s.tool.vertex_kind = kept.clone();
+        let r = s.guarded("test.panic", |s| {
+            s.tool.vertex_kind = Some((deckcraft_model::ShapeId(1), 0, 0, "corner".to_string()));
+            panic!("boom");
+        });
+        assert!(r.is_err());
+        assert_eq!(s.tool.vertex_kind, kept);
+        // A command that opens another document and then panics leaves no point type behind: the
+        // one from before names a shape of the other document.
+        let r = s.guarded("test.panic", |s| {
+            s.execute("file.new", &json!({}))?;
+            s.tool.vertex_kind = Some((deckcraft_model::ShapeId(1), 0, 0, "corner".to_string()));
+            panic!("boom");
+        });
+        assert!(r.is_err());
+        assert_eq!(s.tool.vertex_kind, None);
+    }
+
     #[test]
     fn a_command_that_fails_after_editing_leaves_the_document_alone() {
         let mut s = Session::new();

crates/engine/src/io.rs

@@ -8,6 +8,14 @@
 #[cfg(not(target_arch = "wasm32"))]
 pub fn read_file(path: &str) -> Result<Vec<u8>, String> {
     crate::file_access::check_read(path)?;
+    let meta = std::fs::metadata(path).map_err(|e| format!("{path}: {e}"))?;
+    if !meta.is_file() {
+        return Err(format!("{path}: not a regular file"));
+    }
+    const MAX_FILE_SIZE: u64 = 2 << 30; // 2 GiB
+    if meta.len() > MAX_FILE_SIZE {
+        return Err(format!("{path}: file size {} exceeds 2 GiB limit", meta.len()));
+    }
     std::fs::read(path).map_err(|e| format!("{path}: {e}"))
 }
 
@@ -28,21 +36,29 @@ pub fn write_file(path: &str, bytes: &[u8]) -> Result<(), String> {
     static COUNTER: AtomicU64 = AtomicU64::new(0);
     crate::file_access::check_write(path)?;
     let err = |e: std::io::Error| format!("{path}: {e}");
-    // A uniquely named temporary sibling, created exclusively (never following or reusing an
-    // existing file or symlink), is renamed over the destination: concurrent saves never share
-    // temporary bytes.
+
+    let target_path = match std::fs::canonicalize(path) {
+        Ok(canonical) => canonical,
+        Err(_) => std::path::PathBuf::from(path),
+    };
+    let target_str = target_path.to_str().unwrap_or(path);
+    let existing_perms = std::fs::metadata(&target_path).ok().map(|m| m.permissions());
+
     let mut attempts = 0;
     let (tmp, mut file) = loop {
-        let tmp = format!("{path}.{}.{}.saving", std::process::id(), COUNTER.fetch_add(1, Ordering::Relaxed));
+        let tmp = format!("{target_str}.{}.{}.saving", std::process::id(), COUNTER.fetch_add(1, Ordering::Relaxed));
         match std::fs::OpenOptions::new().write(true).create_new(true).open(&tmp) {
             Ok(f) => break (tmp, f),
             Err(e) if e.kind() == std::io::ErrorKind::AlreadyExists && attempts < 16 => attempts += 1,
             Err(e) => return Err(err(e)),
         }
     };
+    if let Some(perms) = existing_perms {
+        let _ = file.set_permissions(perms);
+    }
     let written = file.write_all(bytes).and_then(|()| file.sync_all());
     drop(file);
-    let result = written.and_then(|()| std::fs::rename(&tmp, path));
+    let result = written.and_then(|()| std::fs::rename(&tmp, &target_path));
     if let Err(e) = result {
         let _ = std::fs::remove_file(&tmp);
         return Err(err(e));
@@ -67,3 +83,41 @@ pub fn file_len(path: &str) -> Option<u64> {
 pub fn file_len(_path: &str) -> Option<u64> {
     None
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn read_file_rejects_directory() {
+        let dir = std::env::temp_dir();
+        let res = read_file(dir.to_str().unwrap());
+        assert!(res.is_err());
+    }
+
+    #[test]
+    fn write_file_preserves_permissions_and_writes_content() {
+        let tmp_dir = std::env::temp_dir().join("deckcraft_io_test");
+        let _ = std::fs::create_dir_all(&tmp_dir);
+        let test_file = tmp_dir.join("test_write.txt");
+        let path_str = test_file.to_str().unwrap();
+
+        assert!(write_file(path_str, b"hello world").is_ok());
+        let read = read_file(path_str).unwrap();
+        assert_eq!(read, b"hello world");
+
+        #[cfg(unix)]
+        {
+            use std::os::unix::fs::PermissionsExt;
+            let perms = std::fs::Permissions::from_mode(0o640);
+            std::fs::set_permissions(&test_file, perms).unwrap();
+
+            assert!(write_file(path_str, b"updated world").is_ok());
+            let new_meta = std::fs::metadata(&test_file).unwrap();
+            assert_eq!(new_meta.permissions().mode() & 0o777, 0o640);
+        }
+
+        let _ = std::fs::remove_file(&test_file);
+        let _ = std::fs::remove_dir(&tmp_dir);
+    }
+}

crates/engine/src/keys.rs

@@ -49,17 +49,21 @@ impl Session {
     /// `ArrowLeft`…, `Home`, `End`, `PageUp`, `PageDown`, `F5`) or a character (`b`, `]`).
     /// Returns `{handled: bool, …}`.
     pub fn key(&mut self, key: &str, mods: Mods) -> Result<Value> {
-        self.end_composition();
+        self.settle_composition();
         let editing = self.active().is_some_and(|d| d.selection.text.is_some());
         let has_shapes = self.active().is_some_and(|d| !d.selection.shapes.is_empty());
         let k = key_token(key);
         let k = k.as_str();
+        if matches!(k, "escape" | "esc") && self.cancel_point_drag() {
+            return Ok(json!({"handled": true}));
+        }
         if self.tool.drawing_freeform() && matches!(k, "enter" | "return" | "escape") {
             return self.finish_freeform(false);
         }
         if self.tool.edit_points.is_some() && matches!(k, "enter" | "return" | "escape") {
             self.tool.edit_points = None;
             self.tool.edit_vertex = None;
+            self.tool.edit_segment = None;
             return Ok(json!({"handled": true, "command": "shape.editPoints"}));
         }
         if editing && let Some((id, params)) = self.text_key(k, mods) {
@@ -89,6 +93,21 @@ impl Session {
                 return Ok(json!({"handled": true}));
             }
         }
+        if !editing && has_shapes && !mods.cmd && mods.shift && !mods.alt {
+            // Shift+arrow grows or shrinks a selected range of table cells.
+            let d = match k {
+                "left" => Some((0, -1)),
+                "right" => Some((0, 1)),
+                "up" => Some((-1, 0)),
+                "down" => Some((1, 0)),
+                _ => None,
+            };
+            if let Some((dr, dc)) = d
+                && crate::cmd::table::extend_selected_cells(self, dr, dc)?
+            {
+                return Ok(json!({"handled": true}));
+            }
+        }
         if !editing && has_shapes && !mods.cmd {
             let step = if mods.alt { 1.0 } else { 6.0 };
             let d = match k {
@@ -247,6 +266,16 @@ impl Session {
         self.execute("text.commit", &json!({"text": text}))
     }
 
+    /// Remove text around the composition caret or selection, as an input method asks
+    /// (`ImeEvent::DeleteSurrounding`/`DeleteSurroundingBytes`). Counts are characters or UTF-8
+    /// bytes of the logical text the surrounding query publishes, so a range may cross a
+    /// paragraph mark (read as one `\n` byte) and whole scalars only are removed; out-of-range
+    /// counts are clamped. A deletion while composing stays inside the composition's single undo
+    /// step.
+    pub fn delete_surrounding(&mut self, before: usize, after: usize, bytes: bool) -> Result<Value> {
+        self.execute("text.deleteSurrounding", &json!({"before": before, "after": after, "bytes": bytes}))
+    }
+
     /// Ready to take typed `text`: editing text already, or one selected shape whose text editing
     /// starts with everything selected. False when there is nowhere to type (or nothing to type
     /// and nothing being edited).

crates/engine/src/lib.rs

@@ -155,6 +155,11 @@ pub struct Selection {
     pub text: Option<TextSel>,
     /// Selected table cells: (table, (r0, c0), (r1, c1)).
     pub cells: Option<(ShapeId, (usize, usize), (usize, usize))>,
+    /// Slide-list range last made with Shift-click: `(anchor, end)`. A further Shift-click extends from
+    /// the anchor while the current slide is still `end`; moving to another slide drops it. Held as
+    /// slide ids, so moving, inserting or deleting slides can't make it name other slides.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub range_anchor: Option<(SlideId, SlideId)>,
     pub target: Target,
 }
 
@@ -163,6 +168,8 @@ pub struct HistoryEntry {
     pub label: String,
     pub doc: Arc<Presentation>,
     pub selection: Selection,
+    /// The point type Edit Points remembered with `doc` (`ToolState::vertex_kind`).
+    pub vertex_kind: Option<(ShapeId, usize, usize, String)>,
 }
 
 #[derive(Clone, Debug, Default)]
@@ -184,6 +191,8 @@ pub struct Interaction {
     pub label: String,
     pub doc: Arc<Presentation>,
     pub selection: Selection,
+    /// The point type Edit Points remembered when it began.
+    pub vertex_kind: Option<(ShapeId, usize, usize, String)>,
 }
 
 /// Text an input method is composing (#101): its preedit sits in the edited text body, at `start`
@@ -225,6 +234,9 @@ pub struct DocState {
     /// The last Duplicate: where it happened and each original with its copy, so duplicating the
     /// copies again repeats how far they were moved, as in PowerPoint (#966).
     pub last_duplicate: Option<(usize, Target, Vec<(ShapeId, ShapeId)>)>,
+    /// The list AutoFormat just started from a typed `* ` or `1. `, so Backspace right after
+    /// can put the typed text back.
+    pub auto_list: Option<cmd::text::AutoList>,
 }
 
 static NEXT_UID: std::sync::atomic::AtomicU64 = std::sync::atomic::AtomicU64::new(0);
@@ -253,6 +265,7 @@ impl DocState {
             composition: None,
             compare: None,
             last_duplicate: None,
+            auto_list: None,
         }
     }
     pub fn is_dirty(&self) -> bool {
@@ -328,13 +341,15 @@ pub struct Prefs {
     pub smart_quotes: bool,
     /// AutoCorrect options (Tools ▸ AutoCorrect): fix TWo INitial CApitals, capitalize the first
     /// letter of sentences and the names of days, fix accidental cAPS lOCK, and replace 1/2, 1/4
-    /// and 3/4 with fraction characters; AutoFormat superscripts ordinals (1st) as you type.
+    /// and 3/4 with fraction characters; AutoFormat superscripts ordinals (1st) and starts
+    /// bulleted and numbered lists (`* `, `1. `) as you type.
     pub ac_two_initials: bool,
     pub ac_sentence_caps: bool,
     pub ac_days: bool,
     pub ac_caps_lock: bool,
     pub ac_fractions: bool,
     pub ac_ordinals: bool,
+    pub ac_lists: bool,
     /// Your own "replace … with …" entries; they win over the built-in list.
     pub ac_entries: Vec<(String, String)>,
     /// Built-in entries you deleted.
@@ -343,6 +358,9 @@ pub struct Prefs {
     pub undo_limit: usize,
     /// Minutes between AutoRecover saves of unsaved presentations.
     pub recovery_minutes: f64,
+    /// The unit the rulers, the Format pane and the size dialogs show (Preferences); the deck
+    /// itself always stores points.
+    pub units: deckcraft_geom::Unit,
 }
 
 impl Default for Prefs {
@@ -360,11 +378,13 @@ impl Default for Prefs {
             ac_caps_lock: true,
             ac_fractions: true,
             ac_ordinals: true,
+            ac_lists: true,
             ac_entries: Vec::new(),
             ac_removed: Vec::new(),
             author: "Presenter".into(),
             undo_limit: 500,
             recovery_minutes: 1.0,
+            units: deckcraft_geom::Unit::Inches,
         }
     }
 }
@@ -482,6 +502,8 @@ pub struct Session {
     /// Presentations a host read off the UI thread, waiting for `file.adopt` (by token).
     loaded: Vec<(u64, cmd::file::LoadedFile)>,
     next_loaded: u64,
+    /// Compositions the application settled itself (see [`Session::composition_settles`]).
+    composition_settles: u64,
 }
 
 impl Default for Session {
@@ -491,6 +513,8 @@ impl Default for Session {
 }
 
 impl Session {
+    /// Install the process panic hook and construct an empty session with default preferences,
+    /// clipboard, tool state, and no active document.
     pub fn new() -> Self {
         guard::install_panic_hook();
         Session {
@@ -513,6 +537,7 @@ impl Session {
             panics_caught: 0,
             loaded: vec![],
             next_loaded: 0,
+            composition_settles: 0,
         }
     }
     /// Hand over a presentation read on another thread ([`cmd::file::read_presentation_file`]);
@@ -557,16 +582,21 @@ impl Session {
         self.active_mut().ok_or(EngineError::NoDocument)
     }
     pub fn set_active(&mut self, i: usize) {
+        let was = self.active().map(|d| d.uid);
         if i < self.docs.len() {
             self.active = Some(i);
         }
+        self.forget_vertex_kind_unless(was);
     }
     pub fn add_document(&mut self, d: DocState) -> usize {
+        let was = self.active().map(|d| d.uid);
         self.docs.push(d);
         self.active = Some(self.docs.len() - 1);
+        self.forget_vertex_kind_unless(was);
         self.docs.len() - 1
     }
     pub fn close_document(&mut self, i: usize) {
+        let was = self.active().map(|d| d.uid);
         if i < self.docs.len() {
             let d = self.docs.remove(i);
             if let Some(dir) = &self.recovery_dir {
@@ -574,6 +604,14 @@ impl Session {
             }
             self.active = if self.docs.is_empty() { None } else { Some(i.min(self.docs.len() - 1)) };
         }
+        self.forget_vertex_kind_unless(was);
+    }
+    /// The point type Edit Points remembers names a shape of the active document, and another
+    /// document can have a shape with the same id: a change of active document forgets it.
+    fn forget_vertex_kind_unless(&mut self, was: Option<u64>) {
+        if self.active().map(|d| d.uid) != was {
+            self.tool.vertex_kind = None;
+        }
     }
     pub fn next_untitled(&mut self) -> String {
         self.untitled += 1;
@@ -586,11 +624,13 @@ impl Session {
         self.guarded(id, |s| s.execute_unguarded(id, params))
     }
 
+    /// Resolve and run a command, settling composition first, checking eligibility, rolling back a
+    /// failed outer command, and committing the resulting undo entry or journal record.
     fn execute_unguarded(&mut self, id: &str, params: &Value) -> Result<Value> {
         let spec = find_command(id).ok_or_else(|| EngineError::UnknownCommand(id.into()))?;
         // Any other edit (or a click, a key, undo) settles an input method's composition first.
         if self.depth == 0 && (spec.journal || spec.undoable) && !matches!(id, "text.compose" | "text.commit") {
-            self.end_composition();
+            self.settle_composition();
         }
         if let Err(e) = (spec.enabled)(self) {
             let named = (e == cmd::NOTHING_SELECTED || e == cmd::SELECT_TWO) && (params.get("ids").is_some() || params.get("id").is_some());
@@ -599,6 +639,7 @@ impl Session {
             }
         }
         let before = self.active().map(|d| (d.uid, d.doc.clone(), d.selection.clone()));
+        let vertex_kind = self.tool.vertex_kind.clone();
         let outer = self.depth == 0;
         self.depth += 1;
         let r = (spec.run)(self, params);
@@ -617,6 +658,9 @@ impl Session {
                     st.selection = sel;
                     st.revision += 1;
                 }
+                if outer {
+                    self.tool.vertex_kind = vertex_kind;
+                }
                 return Err(e);
             }
         };
@@ -630,7 +674,7 @@ impl Session {
             && spec.undoable
             && outer
         {
-            push_undo(st, HistoryEntry { label: spec.label.to_string(), doc: old, selection: sel });
+            push_undo(st, HistoryEntry { label: spec.label.to_string(), doc: old, selection: sel, vertex_kind });
         }
         if spec.journal && outer {
             self.journal.push((id.to_string(), params.clone()));
@@ -660,14 +704,39 @@ impl Session {
 
     /// Keep an input method's composition as it stands (#101): its text stays and the whole
     /// composition becomes one undo step. Nothing happens without one.
+    ///
+    /// This is also how the input method's own commit ends a composition: the platform has
+    /// already finished that one, so it must not ask for an interrupt.
     pub fn end_composition(&mut self) {
+        let vertex_kind = self.tool.vertex_kind.clone();
         let Some(st) = self.active_mut() else { return };
         let Some(c) = st.composition.take() else { return };
         if !Arc::ptr_eq(&c.before, &st.doc) {
-            push_undo(st, HistoryEntry { label: "Type Text".into(), doc: c.before, selection: c.before_selection });
+            push_undo(st, HistoryEntry { label: "Type Text".into(), doc: c.before, selection: c.before_selection, vertex_kind });
         }
     }
 
+    /// Settle a composition because the application did something else (a click, a key, a
+    /// command, a target change) rather than because the input method committed it.
+    ///
+    /// The platform still holds its own copy of that composition, so a host must publish one
+    /// `should_interrupt_composition` for each increment of [`Self::composition_settles`]: the
+    /// backend then cancels it instead of committing its text into whatever is selected next.
+    pub fn settle_composition(&mut self) {
+        if self.active().is_some_and(|d| d.composition.is_some()) {
+            self.composition_settles = self.composition_settles.wrapping_add(1);
+        }
+        self.end_composition();
+    }
+
+    /// How many compositions the application settled itself (clicks, keys, other commands).
+    ///
+    /// A host compares this with the value it last published; every increment is one platform
+    /// composition that must be interrupted. The input method's own commits do not count.
+    pub fn composition_settles(&self) -> u64 {
+        self.composition_settles
+    }
+
     /// Change only the selection (no undo step).
     pub fn select(&mut self, f: impl FnOnce(&Presentation, &mut Selection)) -> Result<()> {
         let st = self.doc_mut()?;
@@ -683,7 +752,7 @@ impl Session {
         st.revision += 1;
         // A composition belongs to the text body it began in: leaving that body settles it.
         if st.composition.is_some() && owner(&st.selection) != before {
-            self.end_composition();
+            self.settle_composition();
         }
         Ok(())
     }

crates/engine/src/recovery.rs

@@ -85,8 +85,20 @@ fn owner_alive(dir: &Path, owner: u64) -> bool {
 
 /// Write `bytes` to `path` through a temporary file and a rename, so a crash never leaves it torn.
 fn write_atomic(path: &Path, bytes: &[u8]) -> Result<()> {
+    use std::io::Write;
     let tmp = path.with_extension(format!("{}.tmp", path.extension().and_then(|e| e.to_str()).unwrap_or("")));
-    std::fs::write(&tmp, bytes).and_then(|_| std::fs::rename(&tmp, path)).map_err(|e| EngineError::Other(format!("{}: {e}", path.display())))
+    let mut opts = std::fs::OpenOptions::new();
+    opts.write(true).create(true).truncate(true);
+    #[cfg(unix)]
+    {
+        use std::os::unix::fs::OpenOptionsExt;
+        opts.mode(0o600);
+    }
+    let mut file = opts.open(&tmp).map_err(|e| EngineError::Other(format!("{}: {e}", tmp.display())))?;
+    file.write_all(bytes).and_then(|()| file.sync_all()).and_then(|()| std::fs::rename(&tmp, path)).map_err(|e| {
+        let _ = std::fs::remove_file(&tmp);
+        EngineError::Other(format!("{}: {e}", path.display()))
+    })
 }
 
 /// Presentations reopened per start; the rest stay on disk for the next one, so a folder

crates/engine/src/soak_tests.rs

@@ -9,7 +9,7 @@ use std::collections::VecDeque;
 
 use serde_json::{Value, json};
 
-use crate::*;
+use crate::{EngineError, Session, command_specs, sample};
 
 /// Commands that touch the file system, other windows or real time; the soak drives the rest.
 fn skipped(id: &str) -> bool {

crates/engine/src/spell.rs

@@ -357,6 +357,9 @@ impl Dictionary {
 
     /// Is `word` spelt correctly? Capitalised and upper-case forms of a lower-case word pass.
     pub fn check(&self, word: &str) -> bool {
+        if word.contains('\u{2019}') {
+            return self.check(&word.replace('\u{2019}', "'"));
+        }
         if word.is_empty() || word.chars().all(|c| !c.is_alphabetic()) {
             return true;
         }
@@ -800,6 +803,13 @@ SFX D Y 1\nSFX D 0 ed/S .\n";
         Dictionary::parse(AFF.as_bytes(), DIC.as_bytes())
     }
 
+    #[test]
+    fn curly_apostrophe_matches_ascii_entry() {
+        let d = Dictionary::parse(AFF.as_bytes(), "2\ndon't\nwork\n".as_bytes());
+        assert!(d.check("don't"));
+        assert!(d.check("don\u{2019}t"));
+    }
+
     #[test]
     fn roots_affixes_and_cross_products_check() {
         let d = d();

crates/engine/src/tools.rs

@@ -196,6 +196,9 @@ enum Drag {
         shape: ShapeId,
         /// The text selection before the press, to tell whether the drag changed it.
         before: Option<TextTarget>,
+        /// The text selection the press made. In a table, a drag that leaves its cell selects
+        /// whole cells, and coming back to the cell restores this.
+        press: Option<TextSel>,
     },
     /// Dragging a table border: the right edge of column `index`, or the bottom edge of row
     /// `index`. `start` is the table-local press point, `size` the column's width or the row's
@@ -266,8 +269,13 @@ pub struct ToolState {
     pub edit_points: Option<ShapeId>,
     /// The vertex (path, index) whose control handles show in Edit Points.
     pub edit_vertex: Option<(usize, usize)>,
-    /// The point type last chosen for a vertex (path, index, type): handle drags follow it.
-    pub vertex_kind: Option<(usize, usize, String)>,
+    /// The segment (path, index of the vertex ending it) last right-clicked in Edit Points, for
+    /// the segment menu.
+    pub edit_segment: Option<(usize, usize)>,
+    /// Where on that segment the right click was (0..1), where Add Point puts the new point.
+    pub edit_segment_t: Option<f64>,
+    /// The point type last chosen for a vertex (shape, path, index, type): handle drags follow it.
+    pub vertex_kind: Option<(ShapeId, usize, usize, String)>,
     /// Drawing guides are shown (View › Guides): they can be dragged and shapes snap to them.
     pub guides_visible: bool,
     /// The guide being dragged and where it is now (slide points); `None` once dropped.
@@ -451,7 +459,7 @@ impl Session {
         }
         // A press (not a hover) settles an input method's composition, as clicking does in PowerPoint.
         if !matches!(ev.kind, PointerKind::Move) {
-            self.end_composition();
+            self.settle_composition();
         }
         match ev.kind {
             PointerKind::Move => {
@@ -519,10 +527,11 @@ impl Session {
     }
 
     pub(crate) fn begin(&mut self, label: &str) {
+        let vertex_kind = self.tool.vertex_kind.clone();
         if let Some(st) = self.active_mut()
             && st.interaction.is_none()
         {
-            st.interaction = Some(crate::Interaction { label: label.into(), doc: st.doc.clone(), selection: st.selection.clone() });
+            st.interaction = Some(crate::Interaction { label: label.into(), doc: st.doc.clone(), selection: st.selection.clone(), vertex_kind });
         }
     }
 
@@ -531,10 +540,33 @@ impl Session {
             && let Some(i) = st.interaction.take()
             && !Arc::ptr_eq(&i.doc, &st.doc)
         {
-            crate::push_undo(st, HistoryEntry { label: i.label, doc: i.doc, selection: i.selection });
+            crate::push_undo(st, HistoryEntry { label: i.label, doc: i.doc, selection: i.selection, vertex_kind: i.vertex_kind });
         }
     }
 
+    /// Cancels a point or handle drag in Edit Points when Esc is pressed: ends the drag, puts back the
+    /// document and selection saved at the press, and adds no undo step. Returns whether a drag was cancelled.
+    pub(crate) fn cancel_point_drag(&mut self) -> bool {
+        if !matches!(self.tool.drag, Some(Drag::Vertex { .. } | Drag::Handle { .. })) {
+            return false;
+        }
+        self.tool.drag = None;
+        if let Some(st) = self.active_mut()
+            && st.interaction.as_ref().is_some_and(|i| i.label == "Edit Points")
+            && let Some(i) = st.interaction.take()
+        {
+            // A modifier held during the drag may have set a point type; the drag is undone, so is that.
+            let kind = i.vertex_kind;
+            if !Arc::ptr_eq(&i.doc, &st.doc) {
+                st.doc = i.doc;
+                st.selection = i.selection;
+                st.revision += 1;
+            }
+            self.tool.vertex_kind = kind;
+        }
+        true
+    }
+
     /// End the interaction only when it is the one `label` started. A twist must not commit a drag.
     pub(crate) fn commit_named(&mut self, label: &str) {
         let ours = self.active().and_then(|st| st.interaction.as_ref()).is_some_and(|i| i.label == label);
@@ -586,7 +618,8 @@ impl Session {
         // Clicking inside the text being edited moves the caret / starts a text selection.
         let before = self.text_selection();
         if let Some((shape, pos)) = self.place_caret(p, tol, mods.shift)? {
-            self.tool.drag = Some(Drag::TextSelect { shape, before });
+            let press = self.doc()?.selection.text.clone();
+            self.tool.drag = Some(Drag::TextSelect { shape, before, press });
             return Ok(json!({"caret": [pos.0, pos.1]}));
         }
         let hit = self.hit_test(p, tol);
@@ -671,6 +704,21 @@ impl Session {
                     self.tool.drag = Some(Drag::Warp { id, index, name, base, orig });
                 }
             }
+            Some(Hit::Shape { id, .. })
+                if !(mods.shift || mods.cmd)
+                    && st.selection.cells.is_some_and(|c| c.0 == id && st.selection.shapes == [id])
+                    && in_table_cell(st, id, p) =>
+            {
+                // A press in a table whose cells are selected starts again in the cell under the
+                // pointer: a click puts the caret there and a drag selects another range. A press
+                // on the table outside its cells selects and moves the table like any shape.
+                let before = self.text_selection();
+                if self.edit_text_at(id, p)? {
+                    self.select(|_, sel| sel.cells = None)?;
+                    let press = self.doc()?.selection.text.clone();
+                    self.tool.drag = Some(Drag::TextSelect { shape: id, before, press });
+                }
+            }
             Some(Hit::Shape { id, text }) => {
                 let selected = st.selection.shapes.contains(&id);
                 let toggle = mods.shift || mods.cmd;
@@ -691,10 +739,17 @@ impl Session {
                 let origs: Vec<(ShapeId, Xfrm)> =
                     ids.iter().filter_map(|i| st.shape(*i).filter(|s| !s.locked).map(|s| (*i, xfrm_of(&st.doc, &st.selection, s)))).collect();
                 // A click (no drag) on text puts the caret there; unselected text boxes and
-                // placeholders take the caret straight away like PowerPoint. A click in a selected
-                // table puts the caret in the clicked cell.
+                // placeholders take the caret straight away like PowerPoint. A click in a cell of a
+                // selected table puts the caret there; a click on its grab band keeps the table selected.
                 let table = st.shape(id).is_some_and(|s| matches!(s.kind, ShapeKind::Table(_)));
-                let enter_text = (!toggle && ((text && (selected || is_text_first(st, id))) || (table && selected))).then_some((id, p));
+                // A click on the frame band of a text box selects the box whole, as PowerPoint
+                // does, so it can be moved, duplicated or deleted; only the inside takes the caret.
+                let on_frame = text
+                    && is_text_first(st, id)
+                    && st.shape(id).is_some_and(|s| edit_zone(&xfrm_of(&st.doc, &st.selection, s), p, tol) == EditZone::Frame);
+                let enter_text =
+                    (!toggle && !on_frame && ((text && (selected || is_text_first(st, id))) || (table && selected && in_table_cell(st, id, p))))
+                        .then_some((id, p));
                 let ids2 = ids.clone();
                 self.select(|_, sel| {
                     sel.shapes = ids2;
@@ -885,7 +940,18 @@ impl Session {
             Drag::Handle { id, path, index, out } => {
                 self.tool.drag = Some(Drag::Handle { id, path, index, out });
                 let side = if out { "out" } else { "in" };
-                if let Err(e) = self.execute_inner_move_handle(id, path, index, side, p) {
+                // Shift, Ctrl or Alt held while dragging a handle makes the point smooth, straight or
+                // corner, as in PowerPoint; Cmd and Option count as Ctrl and Alt.
+                let held = if mods.shift {
+                    Some("smooth")
+                } else if mods.cmd {
+                    Some("straight")
+                } else if mods.alt {
+                    Some("corner")
+                } else {
+                    None
+                };
+                if let Err(e) = self.execute_inner_move_handle(id, path, index, side, p, held) {
                     log::debug!("edit handle: {e}");
                 }
                 return Ok(Value::Null);
@@ -942,8 +1008,29 @@ impl Session {
                 };
                 self.tool.preview = Some(x);
             }
-            Drag::TextSelect { shape, .. } => {
-                // The selection stays in the shape or table cell where it started.
+            Drag::TextSelect { shape, press, .. } => {
+                // In a table, leaving the cell the drag started in selects whole cells, as in
+                // PowerPoint; coming back to that cell selects text in it again.
+                let st = self.doc()?;
+                if let Some(start) = press.as_ref().and_then(|t| t.cell)
+                    && let Some(f) = st.shape(shape).and_then(|sh| cmd::table::table_frame(st, sh))
+                    && let Some(cell) = f.cell_at(f.local(p))
+                {
+                    if cell != start {
+                        self.select(|_, sel| {
+                            sel.text = None;
+                            sel.shapes = vec![shape];
+                            sel.cells = Some((shape, start, cell));
+                        })?;
+                        return Ok(Value::Null);
+                    }
+                    if st.selection.text.is_none() {
+                        self.select(|_, sel| {
+                            sel.cells = None;
+                            sel.text = press;
+                        })?;
+                    }
+                }
                 let st = self.doc()?;
                 if let Some(t) = st.selection.text.as_ref().filter(|t| t.shape == shape) {
                     let pos = cmd::text::text_pos_at(st, t, p);
@@ -1004,9 +1091,19 @@ impl Session {
         Ok(())
     }
 
-    fn execute_inner_move_handle(&mut self, id: ShapeId, path: usize, index: usize, side: &str, p: Point) -> Result<Value> {
-        let kind = self.tool.vertex_kind.clone().filter(|(pp, i, _)| (*pp, *i) == (path, index)).map(|k| k.2);
-        cmd::points::move_handle_raw(self, &json!({"id": id.0, "path": path, "index": index, "side": side, "x": p.x, "y": p.y, "type": kind}))
+    /// Moves a control handle during a drag. `held` is the point type set by the modifier held
+    /// during the drag; the point keeps that type for later drags, as after `shape.pointType`.
+    fn execute_inner_move_handle(&mut self, id: ShapeId, path: usize, index: usize, side: &str, p: Point, held: Option<&str>) -> Result<Value> {
+        let kind = match held {
+            Some(k) => Some(k.to_string()),
+            None => self.tool.vertex_kind.clone().filter(|(s, pp, i, _)| (*s, *pp, *i) == (id, path, index)).map(|k| k.3),
+        };
+        let r =
+            cmd::points::move_handle_raw(self, &json!({"id": id.0, "path": path, "index": index, "side": side, "x": p.x, "y": p.y, "type": kind}))?;
+        if let Some(k) = held {
+            self.tool.vertex_kind = Some((id, path, index, k.to_string()));
+        }
+        Ok(r)
     }
 
     fn up(&mut self, p: Point, mods: Mods) -> Result<Value> {
@@ -1243,6 +1340,12 @@ impl Session {
             ) => Some(*id),
             None => None,
         };
+        // Edit Points: the point or else the segment under the pointer picks the menu.
+        let picked = self.tool.editing_points(st).and_then(|eid| st.shape(eid)).map(|sh| match &hit {
+            Some(Hit::Vertex { path, index, .. }) => (Some((*path, *index)), None),
+            Some(Hit::Handle { .. }) => (None, None),
+            _ => (None, cmd::points::segment_at(&st.doc, &st.selection, sh, p, tol * 1.6)),
+        });
         if !id.is_some_and(|id| st.selection.shapes.contains(&id)) {
             self.select(|_, sel| {
                 sel.text = None;
@@ -1250,6 +1353,14 @@ impl Session {
                 sel.shapes = id.into_iter().collect();
             })?;
         }
+        if let Some((vertex, segment)) = picked {
+            // A control handle belongs to the picked point: its menu stays.
+            if !matches!(hit, Some(Hit::Handle { .. })) {
+                self.tool.edit_vertex = vertex;
+            }
+            self.tool.edit_segment = segment.map(|(path, seg, _)| (path, seg));
+            self.tool.edit_segment_t = segment.map(|(_, _, t)| t);
+        }
         let st = self.doc()?;
         Ok(json!({
             "hit": serde_json::to_value(&hit).unwrap_or_default(),
@@ -1669,8 +1780,9 @@ impl Session {
             }
             Ok(())
         })?;
+        let vertex_kind = self.tool.vertex_kind.clone();
         if let Some(st) = self.active_mut() {
-            crate::push_undo(st, HistoryEntry { label: "Erase".into(), doc: before, selection: sel_before });
+            crate::push_undo(st, HistoryEntry { label: "Erase".into(), doc: before, selection: sel_before, vertex_kind });
         }
         Ok(Value::Null)
     }
@@ -1883,6 +1995,15 @@ pub fn resize_box(o: &Xfrm, h: u8, d: Vec2, keep_aspect: bool, from_center: bool
     Xfrm { x: c.x - nw / 2.0, y: c.y - nh / 2.0, w: nw, h: nh, rot: o.rot, flip_h: fh, flip_v: fv }
 }
 
+/// Whether `p` lies in a cell of table `id`, not in the grab band around it (`cell_at` would take
+/// the nearest cell).
+fn in_table_cell(st: &crate::DocState, id: ShapeId, p: Point) -> bool {
+    st.shape(id).and_then(|sh| cmd::table::table_frame(st, sh)).is_some_and(|f| {
+        let q = f.local(p);
+        (0.0..=f.width()).contains(&q.x) && (0.0..=f.height()).contains(&q.y) && f.cell_at(q).is_some()
+    })
+}
+
 fn hit_shape(st: &crate::DocState, sh: &Shape, p: Point, tol: f64) -> Option<Hit> {
     let x = xfrm_of(&st.doc, &st.selection, sh);
     let inv = x.affine().inverse();

crates/engine/tests/show_paragraph_builds.rs

@@ -0,0 +1,262 @@
+//! #844: a paragraph-by-paragraph build read from a PPTX file takes the clicks PowerPoint gives
+//! it. The file lists one effect per paragraph, each with its own start (On Click or With
+//! Previous); the show must not ask for more clicks, or fewer, than those effects.
+
+use std::io::{Cursor, Read, Write};
+use std::sync::Arc;
+
+use deckcraft_anim::{ShowAction, ShowState};
+use deckcraft_geom::Xfrm;
+use deckcraft_model::anim::{AnimStart, Animation, TextBuild};
+use deckcraft_model::text::TextBody;
+use deckcraft_model::{LayoutType, Presentation, Shape, ShapeId, defaults};
+use zip::write::SimpleFileOptions;
+
+fn shape(p: &mut Presentation, name: &str, text: &str, y: f64) -> Shape {
+    Shape {
+        id: ShapeId(p.alloc_id().expect("id")),
+        name: name.into(),
+        xfrm: Some(Xfrm::new(100.0, y, 600.0, 150.0)),
+        text: Some(TextBody::from_text(text)),
+        ..Default::default()
+    }
+}
+
+/// Two slides: "Body" (paragraphs `body`, at `levels`) and "Picture" on the first, nothing on
+/// the second, saved as PPTX.
+fn saved(body: &str, levels: &[u8]) -> Vec<u8> {
+    let mut p = defaults::new_presentation(None);
+    p.slides.clear();
+    let mut b = shape(&mut p, "Body", body, 50.0);
+    if let Some(t) = b.text.as_mut() {
+        for (para, lvl) in t.paragraphs.iter_mut().zip(levels) {
+            para.level = *lvl;
+        }
+    }
+    let pic = shape(&mut p, "Picture", "Picture", 300.0);
+    let anims = vec![
+        Animation { shape: b.id, text_build: TextBuild::ByParagraph, start: AnimStart::OnClick, duration_ms: 500, ..Default::default() },
+        Animation { shape: pic.id, start: AnimStart::WithPrevious, duration_ms: 500, ..Default::default() },
+    ];
+    for (shapes, animations) in [(vec![b, pic], anims), (vec![], vec![])] {
+        let layout = defaults::layout_of_kind(&p, LayoutType::Blank).unwrap_or_default();
+        let mut s = defaults::new_slide(&mut p, layout).expect("slide");
+        s.shapes = shapes;
+        s.animations = animations;
+        p.slides.push(Arc::new(s));
+    }
+    deckcraft_pptx::export(&p).expect("export")
+}
+
+fn spid(xml: &str, name: &str) -> String {
+    let at = xml.find(&format!(r#"name="{name}""#)).expect("shape");
+    let head = &xml[..at];
+    let id = head.rfind(r#"id=""#).expect("id") + 4;
+    head[id..].split('"').next().expect("spid").to_string()
+}
+
+/// One effect node as PowerPoint writes it: Fade in on `spid` (paragraph `para`).
+fn effect(ids: &mut u32, spid: &str, para: Option<u32>, node: &str) -> String {
+    let mut id = || {
+        *ids += 1;
+        *ids
+    };
+    let tgt = match para {
+        Some(p) => format!(r#"<p:spTgt spid="{spid}"><p:txEl><p:pRg st="{p}" end="{p}"/></p:txEl></p:spTgt>"#),
+        None => format!(r#"<p:spTgt spid="{spid}"/>"#),
+    };
+    format!(
+        r#"<p:par><p:cTn id="{}" presetID="10" presetClass="entr" presetSubtype="0" fill="hold" grpId="0" nodeType="{node}"><p:stCondLst><p:cond delay="0"/></p:stCondLst><p:childTnLst><p:set><p:cBhvr><p:cTn id="{}" dur="1" fill="hold"><p:stCondLst><p:cond delay="0"/></p:stCondLst></p:cTn><p:tgtEl>{tgt}</p:tgtEl><p:attrNameLst><p:attrName>style.visibility</p:attrName></p:attrNameLst></p:cBhvr><p:to><p:strVal val="visible"/></p:to></p:set><p:animEffect transition="in" filter="fade"><p:cBhvr><p:cTn id="{}" dur="500"/><p:tgtEl>{tgt}</p:tgtEl></p:cBhvr></p:animEffect></p:childTnLst></p:cTn></p:par>"#,
+        id(),
+        id(),
+        id()
+    )
+}
+
+/// A click group holding `effects`.
+fn click(ids: &mut u32, effects: &[String]) -> String {
+    *ids += 2;
+    format!(
+        r#"<p:par><p:cTn id="{}" fill="hold"><p:stCondLst><p:cond delay="indefinite"/></p:stCondLst><p:childTnLst><p:par><p:cTn id="{}" fill="hold"><p:stCondLst><p:cond delay="0"/></p:stCondLst><p:childTnLst>{}</p:childTnLst></p:cTn></p:par></p:childTnLst></p:cTn></p:par>"#,
+        *ids - 1,
+        *ids,
+        effects.concat()
+    )
+}
+
+/// `bytes` with the first slide's timing replaced by `clicks` (built with `effect` and `click`
+/// from the spids of Body and Picture), Body's build "By paragraph".
+fn with_timing(bytes: &[u8], clicks: impl Fn(&mut u32, &str, &str) -> Vec<String>) -> Vec<u8> {
+    let mut src = zip::ZipArchive::new(Cursor::new(bytes)).expect("zip");
+    let mut out = zip::ZipWriter::new(Cursor::new(Vec::new()));
+    for i in 0..src.len() {
+        let mut f = src.by_index(i).expect("entry");
+        let name = f.name().to_string();
+        let mut data = Vec::new();
+        f.read_to_end(&mut data).expect("read");
+        if name == "ppt/slides/slide1.xml" {
+            let xml = String::from_utf8(data).expect("utf8");
+            let (body, pic) = (spid(&xml, "Body"), spid(&xml, "Picture"));
+            let mut ids = 2;
+            let main = clicks(&mut ids, &body, &pic).concat();
+            let timing = format!(
+                r#"<p:timing><p:tnLst><p:par><p:cTn id="1" dur="indefinite" restart="never" nodeType="tmRoot"><p:childTnLst><p:seq concurrent="1" nextAc="seek"><p:cTn id="2" dur="indefinite" nodeType="mainSeq"><p:childTnLst>{main}</p:childTnLst></p:cTn><p:prevCondLst><p:cond evt="onPrev" delay="0"><p:tgtEl><p:sldTgt/></p:tgtEl></p:cond></p:prevCondLst><p:nextCondLst><p:cond evt="onNext" delay="0"><p:tgtEl><p:sldTgt/></p:tgtEl></p:cond></p:nextCondLst></p:seq></p:childTnLst></p:cTn></p:par></p:tnLst><p:bldLst><p:bldP spid="{body}" grpId="0" build="p"/><p:bldP spid="{pic}" grpId="0" animBg="1"/></p:bldLst></p:timing>"#
+            );
+            let a = xml.find("<p:timing>").expect("timing");
+            let b = xml.find("</p:timing>").expect("timing end") + "</p:timing>".len();
+            data = format!("{}{timing}{}", &xml[..a], &xml[b..]).into_bytes();
+        }
+        out.start_file(name, SimpleFileOptions::default()).expect("start");
+        out.write_all(&data).expect("write");
+    }
+    out.finish().expect("finish").into_inner()
+}
+
+/// Clicks (Next with nothing playing) from the start of the first slide to the second one.
+fn clicks_to_second_slide(pres: &Presentation) -> usize {
+    let mut s = ShowState::new(pres);
+    for n in 1..=50 {
+        match s.next(pres) {
+            ShowAction::PlayStep(_) => {
+                // The step clock runs out before the next click.
+                s.step_done(pres);
+            }
+            ShowAction::Slide(1) => return n,
+            a => panic!("unexpected {a:?}"),
+        }
+    }
+    usize::MAX
+}
+
+#[test]
+fn a_paragraph_build_split_by_another_shapes_effect_takes_powerpoints_clicks() {
+    // As PowerPoint writes "Body: By paragraph, Picture: With Previous after the first
+    // paragraph": click 1 = Body ¶0 + Picture, click 2 = Body ¶1, click 3 = Body ¶2.
+    let bytes = with_timing(&saved("One\nTwo\nThree", &[0, 0, 0]), |ids, body, pic| {
+        let e0 = effect(ids, body, Some(0), "clickEffect");
+        let ep = effect(ids, pic, None, "withEffect");
+        let e1 = effect(ids, body, Some(1), "clickEffect");
+        let e2 = effect(ids, body, Some(2), "clickEffect");
+        vec![click(ids, &[e0, ep]), click(ids, &[e1]), click(ids, &[e2])]
+    });
+    let pres = deckcraft_pptx::import(&bytes).expect("import");
+    assert_eq!(ShowState::steps(&pres, 0), 3, "three click steps, as in the file");
+    assert_eq!(clicks_to_second_slide(&pres), 4, "three builds and one click to move on");
+}
+
+#[test]
+fn a_build_by_second_level_paragraphs_takes_a_click_per_paragraph() {
+    // "By 2nd level paragraphs": the heading and each sub-point have their own click.
+    // Picture comes in with the last one, so nothing splits Body's build.
+    let bytes = with_timing(&saved("Question\nFirst\nSecond", &[0, 1, 1]), |ids, body, pic| {
+        let e0 = effect(ids, body, Some(0), "clickEffect");
+        let e1 = effect(ids, body, Some(1), "clickEffect");
+        let e2 = effect(ids, body, Some(2), "clickEffect");
+        let ep = effect(ids, pic, None, "withEffect");
+        vec![click(ids, &[e0]), click(ids, &[e1]), click(ids, &[e2, ep])]
+    });
+    let pres = deckcraft_pptx::import(&bytes).expect("import");
+    assert_eq!(ShowState::steps(&pres, 0), 3, "three click steps, as in the file");
+}
+
+/// The first slide's XML in a saved PPTX.
+fn slide_xml(bytes: &[u8]) -> String {
+    let mut zip = zip::ZipArchive::new(Cursor::new(bytes)).expect("zip");
+    let mut xml = String::new();
+    zip.by_name("ppt/slides/slide1.xml").expect("slide").read_to_string(&mut xml).expect("read");
+    xml
+}
+
+/// Paragraph and start of each animation on the first slide.
+fn effects(pres: &Presentation) -> Vec<(Option<u32>, AnimStart, TextBuild)> {
+    pres.slides[0].animations.iter().map(|a| (a.paragraph, a.start, a.text_build)).collect()
+}
+
+/// "By 1st level paragraphs" as PowerPoint writes it: a sub-point comes in with its parent.
+fn first_level_build() -> Vec<u8> {
+    with_timing(&saved("One\nSub\nTwo", &[0, 1, 0]), |ids, body, pic| {
+        let e0 = effect(ids, body, Some(0), "clickEffect");
+        let e1 = effect(ids, body, Some(1), "withEffect");
+        let e2 = effect(ids, body, Some(2), "clickEffect");
+        let ep = effect(ids, pic, None, "withEffect");
+        vec![click(ids, &[e0, e1]), click(ids, &[e2, ep])]
+    })
+}
+
+#[test]
+fn a_whole_first_level_build_still_reads_as_one_by_paragraph_animation() {
+    let pres = deckcraft_pptx::import(&first_level_build()).expect("import");
+    assert_eq!(effects(&pres)[0], (None, AnimStart::OnClick, TextBuild::ByParagraph));
+    assert_eq!(pres.slides[0].animations.len(), 2, "Body's build and Picture");
+    assert_eq!(ShowState::steps(&pres, 0), 2);
+}
+
+#[test]
+fn a_by_paragraph_build_with_sub_points_survives_saving() {
+    let pres = deckcraft_pptx::import(&first_level_build()).expect("import");
+    let again = deckcraft_pptx::import(&deckcraft_pptx::export(&pres).expect("export")).expect("reimport");
+    assert_eq!(effects(&again), effects(&pres));
+    assert_eq!(ShowState::steps(&again, 0), 2, "the sub-point still comes in with its parent");
+}
+
+#[test]
+fn paragraph_effects_save_as_powerpoint_writes_them_and_read_back_unchanged() {
+    let bytes = with_timing(&saved("One\nTwo\nThree", &[0, 0, 0]), |ids, body, pic| {
+        let e0 = effect(ids, body, Some(0), "clickEffect");
+        let ep = effect(ids, pic, None, "withEffect");
+        let e1 = effect(ids, body, Some(1), "clickEffect");
+        let e2 = effect(ids, body, Some(2), "clickEffect");
+        vec![click(ids, &[e0, ep]), click(ids, &[e1]), click(ids, &[e2])]
+    });
+    let pres = deckcraft_pptx::import(&bytes).expect("import");
+    let saved = deckcraft_pptx::export(&pres).expect("export");
+    let xml = slide_xml(&saved);
+    let body = spid(&xml, "Body");
+    let blds: Vec<&str> = xml.split("<p:bldP ").skip(1).filter(|b| b.starts_with(&format!(r#"spid="{body}""#))).collect();
+    // ¶0 is its own build (Picture sits between), ¶1 and ¶2 share one.
+    assert_eq!(blds.len(), 2, "{blds:?}");
+    assert!(blds.iter().all(|b| b.contains(r#"build="p""#) && !b.contains("animBg")), "{blds:?}");
+    let again = deckcraft_pptx::import(&saved).expect("reimport");
+    assert_eq!(effects(&again), effects(&pres));
+    assert_eq!(ShowState::steps(&again, 0), 3);
+}
+
+#[test]
+fn a_by_paragraph_build_on_blank_text_saves_as_a_whole_shape_effect() {
+    let xml = slide_xml(&saved(" ", &[0]));
+    assert!(!xml.contains(r#"build="p""#), "no paragraph build without a paragraph to animate");
+    assert!(!xml.contains("<p:txEl>"), "the effect targets the whole shape");
+}
+
+/// Body's three paragraphs under `build="p"`, effects in the order `effects` gives them, then
+/// Picture with the last one.
+fn three_paragraphs(effects: impl Fn(&mut u32, &str) -> Vec<String>) -> Presentation {
+    let bytes = with_timing(&saved("One\nTwo\nThree", &[0, 0, 0]), |ids, body, pic| {
+        let mut clicks: Vec<String> = effects(ids, body).iter().map(|e| click(ids, std::slice::from_ref(e))).collect();
+        let ep = effect(ids, pic, None, "clickEffect");
+        clicks.push(click(ids, &[ep]));
+        clicks
+    });
+    deckcraft_pptx::import(&bytes).expect("import")
+}
+
+#[test]
+fn a_reversed_build_keeps_its_order() {
+    let pres = three_paragraphs(|ids, body| (0..3).rev().map(|p| effect(ids, body, Some(p), "clickEffect")).collect());
+    let paras: Vec<Option<u32>> = pres.slides[0].animations.iter().map(|a| a.paragraph).collect();
+    assert_eq!(paras, vec![Some(2), Some(1), Some(0), None], "last paragraph first, as in the file");
+}
+
+#[test]
+fn a_paragraph_with_its_own_duration_keeps_its_own_effect() {
+    let pres = three_paragraphs(|ids, body| {
+        (0..3)
+            .map(|p| {
+                let e = effect(ids, body, Some(p), "clickEffect");
+                if p == 1 { e.replace(r#"dur="500""#, r#"dur="900""#) } else { e }
+            })
+            .collect()
+    });
+    let durs: Vec<(Option<u32>, u32)> = pres.slides[0].animations.iter().map(|a| (a.paragraph, a.duration_ms)).collect();
+    assert_eq!(durs, vec![(Some(0), 500), (Some(1), 900), (Some(2), 500), (None, 500)]);
+}

crates/fonts/Cargo.toml

@@ -15,4 +15,4 @@ harfrust = { workspace = true }
 unicode-bidi = { workspace = true }
 log = { workspace = true }
 # Last-resort face only (Ubuntu Light); no UI code.
-epaint_default_fonts = "0.36"
+epaint_default_fonts = "0.37"

crates/fonts/build.rs

@@ -1,27 +1,61 @@
 //! Optional craft-fonts build input (https://github.com/storytold/craft-fonts, recipe from its
 //! `docs/integration.md`). With `CRAFT_FONTS_DIR=<checkout>` the fonts in its
 //! `fonts/latin-manifest.txt` (presentation fonts) and `fonts/manifest.txt` are embedded as
-//! `CRAFT_FONTS`, Latin first; unset, `CRAFT_FONTS` is empty. Web (wasm32) builds embed only Inter
-//! Regular/Bold and BIZ UDPGothic Regular, to stay within the web size budget. It only reads the
-//! local checkout: no network.
+//! `CRAFT_FONTS`, Latin first. Native builds additionally read
+//! `fonts/simplified-chinese-manifest.txt`; it is optional for ordinary local builds but a required
+//! native input (`CRAFT_FONTS_REQUIRED`) fails without it. Unset, `CRAFT_FONTS` is empty. Web
+//! (wasm32) builds embed only Inter Regular/Bold (or a supported Variable face) and BIZ UDPGothic
+//! Regular, to stay within the web size budget; native builds also carry BIZ UDPGothic Bold.
+//! Required builds verify the faces they promise survive exclusion (and, on wasm, the web filter),
+//! so a pin without the Latin manifest or the native bold face fails instead of silently dropping
+//! them. It only reads the local checkout: no network.
 use std::fmt::Write as _;
 use std::path::PathBuf;
 
-/// Families DeckCraft never embeds (AGENTS.md §1: no Adobe-authored visual design).
-const EXCLUDED_FAMILIES: &[&str] = &["Source Sans 3", "Source Serif 4", "Source Han Sans", "Source Han Serif", "Noto Sans CJK SC"];
+/// Families DeckCraft never embeds (AGENTS.md §1: no Adobe-authored visual design, and no Noto
+/// CJK rebrand of Source Han on any platform).
+const EXCLUDED_FAMILIES: &[&str] = &["Source Sans 3", "Source Serif 4", "Source Han Sans", "Source Han Serif"];
 
+/// Reject source families prohibited by the asset policy, including Source Han and every
+/// Noto CJK/Serif/Mono CJK variant.
+fn is_excluded_family(family: &str) -> bool {
+    EXCLUDED_FAMILIES.contains(&family)
+        || family.starts_with("Source Han Sans")
+        || family.starts_with("Source Han Serif")
+        || family.starts_with("Noto Sans CJK")
+        || family.starts_with("Noto Serif CJK")
+        || family.starts_with("Noto Sans Mono CJK")
+}
+
+/// The generated initialisers plus the faces that were actually embedded after exclusion and web
+/// filtering. Validation must use the latter, not the raw manifest text.
+#[derive(Default)]
+struct FontInput {
+    source: String,
+    faces: Vec<(String, String)>,
+}
+
+impl FontInput {
+    /// Concatenate another input's generated source and embedded-face list into this one.
+    fn append(&mut self, other: Self) {
+        self.source.push_str(&other.source);
+        self.faces.extend(other.faces);
+    }
+}
+
+/// Read font-input environment and target architecture, write `craft_fonts.rs`, report font-input
+/// failures as warnings unless required, and always fail when the generated file cannot be written.
 fn main() {
     println!("cargo::rerun-if-env-changed=CRAFT_FONTS_DIR");
     println!("cargo::rerun-if-env-changed=CRAFT_FONTS_REQUIRED");
     let mut src = String::from("pub static CRAFT_FONTS: &[CraftFont] = &[\n");
-    if let Some(dir) = std::env::var_os("CRAFT_FONTS_DIR").map(PathBuf::from) {
-        match craft_fonts(&dir) {
-            Ok(entries) => src.push_str(&entries),
-            Err(e) if std::env::var_os("CRAFT_FONTS_REQUIRED").is_some() => {
-                println!("cargo::error=CRAFT_FONTS_DIR={}: {e}", dir.display());
-            }
-            Err(e) => println!("cargo::warning=building without craft-fonts: CRAFT_FONTS_DIR={}: {e}", dir.display()),
-        }
+    let dir = std::env::var_os("CRAFT_FONTS_DIR").map(PathBuf::from);
+    let required = std::env::var_os("CRAFT_FONTS_REQUIRED").is_some();
+    let wasm = std::env::var("CARGO_CFG_TARGET_ARCH").is_ok_and(|a| a == "wasm32");
+    match input_fonts(dir.as_deref(), wasm, required) {
+        Ok(entries) => src.push_str(&entries),
+        Err(e) if required => println!("cargo::error={e}"),
+        Err(e) => println!("cargo::warning=building without craft-fonts: {e}"),
     }
     src.push_str("];\n");
     let out = PathBuf::from(std::env::var_os("OUT_DIR").unwrap_or_default()).join("craft_fonts.rs");
@@ -31,30 +65,88 @@ fn main() {
 }
 
 /// One `CraftFont { .. }` initialiser per manifest line.
-fn craft_fonts(dir: &std::path::Path) -> Result<String, String> {
-    let mut out = String::new();
-    // The Latin presentation fonts are optional within craft-fonts (older checkouts lack them).
-    let latin = dir.join("fonts/latin-manifest.txt");
-    println!("cargo::rerun-if-changed={}", latin.display());
-    if latin.exists() {
-        out.push_str(&manifest(dir, &latin)?);
-    }
-    out.push_str(&manifest(dir, &dir.join("fonts/manifest.txt"))?);
-    Ok(out)
+fn input_fonts(dir: Option<&std::path::Path>, wasm: bool, required: bool) -> Result<String, String> {
+    load_fonts(dir, wasm, required).map(|input| input.source)
 }
 
-fn manifest(dir: &std::path::Path, manifest: &std::path::Path) -> Result<String, String> {
+/// Use no fonts when the directory is absent unless required; otherwise load the manifests.
+fn load_fonts(dir: Option<&std::path::Path>, wasm: bool, required: bool) -> Result<FontInput, String> {
+    match dir {
+        Some(dir) => craft_fonts(dir, wasm, required),
+        None if required => Err("CRAFT_FONTS_REQUIRED is set but CRAFT_FONTS_DIR is missing".into()),
+        None => Ok(FontInput::default()),
+    }
+}
+
+/// Load optional Latin input, required main input, and native-only Chinese input, then validate
+/// the promised required faces after filtering.
+fn craft_fonts(dir: &std::path::Path, wasm: bool, required: bool) -> Result<FontInput, String> {
+    let mut input = FontInput::default();
+    // The Latin presentation fonts are optional within craft-fonts (older checkouts lack them).
+    // A malformed or incomplete optional manifest is skipped as a unit: the main Japanese/symbol/RTL
+    // faces and the native Chinese addition stay usable, and required builds still fail validation.
+    let latin = dir.join("fonts/latin-manifest.txt");
+    println!("cargo::rerun-if-changed={}", latin.display());
+    let latin_exists = match latin.try_exists() {
+        Ok(exists) => exists,
+        Err(e) if required => return Err(format!("{}: {e}", latin.display())),
+        Err(e) => {
+            println!("cargo::warning=skipping optional Latin fonts: {}: {e}", latin.display());
+            false
+        }
+    };
+    if latin_exists {
+        match manifest(dir, &latin, wasm) {
+            Ok(entries) => input.append(entries),
+            Err(e) if required => return Err(e),
+            Err(e) => println!("cargo::warning=skipping optional Latin fonts: {e}"),
+        }
+    }
+    input.append(manifest(dir, &dir.join("fonts/manifest.txt"), wasm)?);
+    // Native consumers opt in; older craft-fonts checkouts need not carry this manifest.
+    // An invalid optional addition must never discard the main Japanese/symbol/RTL faces.
+    if !wasm {
+        let chinese = dir.join("fonts/simplified-chinese-manifest.txt");
+        println!("cargo::rerun-if-changed={}", chinese.display());
+        let exists = match chinese.try_exists() {
+            Ok(exists) => exists,
+            Err(e) if required => return Err(format!("{}: {e}", chinese.display())),
+            Err(e) => {
+                println!("cargo::warning=skipping optional Chinese fonts: {}: {e}", chinese.display());
+                false
+            }
+        };
+        if exists {
+            match manifest(dir, &chinese, false) {
+                Ok(entries) => input.append(entries),
+                Err(e) if required => return Err(e),
+                Err(e) => println!("cargo::warning=skipping optional Chinese fonts: {e}"),
+            }
+        } else if required {
+            // A required native font input that silently lacks the reviewed Chinese manifest
+            // would make the Chinese UI/canvas test pass only by skipping.
+            return Err(format!("{}: CRAFT_FONTS_REQUIRED is set but the simplified-Chinese font manifest is missing", chinese.display()));
+        }
+    }
+    if required {
+        validate_required_faces(&input.faces, wasm)?;
+    }
+    Ok(input)
+}
+
+/// Parse one manifest, reject malformed rows, exclude banned families, apply the wasm filter,
+/// canonicalise assets, and emit initialisers.
+fn manifest(dir: &std::path::Path, manifest: &std::path::Path, wasm: bool) -> Result<FontInput, String> {
     println!("cargo::rerun-if-changed={}", manifest.display());
     let text = std::fs::read_to_string(manifest).map_err(|e| format!("{}: {e}", manifest.display()))?;
-    let wasm = std::env::var("CARGO_CFG_TARGET_ARCH").is_ok_and(|a| a == "wasm32");
-    let mut out = String::new();
+    let mut input = FontInput::default();
     for line in text.lines().map(str::trim).filter(|l| !l.is_empty() && !l.starts_with('#')) {
         let f: Vec<&str> = line.split(" | ").map(str::trim).collect();
         let [family, style, file, scripts, ..] = f.as_slice() else {
             return Err(format!("malformed manifest line: {line}"));
         };
         // DeckCraft's asset policy: no Adobe-authored typefaces, even openly licensed ones.
-        if EXCLUDED_FAMILIES.contains(family) {
+        if is_excluded_family(family) {
             continue;
         }
         if wasm && !matches!((*family, *style), ("BIZ UDPGothic", "Regular") | ("Inter", "Regular" | "Bold" | "Variable")) {
@@ -63,12 +155,357 @@ fn manifest(dir: &std::path::Path, manifest: &std::path::Path) -> Result<String,
         let path = dir.join(file).canonicalize().map_err(|e| format!("{file}: {e}"))?;
         println!("cargo::rerun-if-changed={}", path.display());
         let scripts: Vec<String> = scripts.split(',').map(|s| format!("{:?}", s.trim())).collect();
+        input.faces.push(((*family).to_owned(), (*style).to_owned()));
         let _ = writeln!(
-            out,
+            input.source,
             "    CraftFont {{ family: {family:?}, style: {style:?}, scripts: &[{}], bytes: include_bytes!({:?}) }},",
             scripts.join(", "),
             path.display().to_string(),
         );
     }
-    Ok(out)
+    Ok(input)
+}
+
+/// Required builds must actually carry the faces the platform promises: Inter Regular and Bold
+/// (or one Variable face) and BIZ UDPGothic Regular everywhere, BIZ UDPGothic Bold natively (the
+/// weight-pair metric test relies on it), plus LXGW WenKai Lite Regular for native builds. This
+/// runs after exclusion and, on wasm, the web filter, so an absent manifest, empty/all-excluded
+/// rows, a wrong-family row or a partial catalog cannot satisfy the gate. Wasm deliberately
+/// embeds only BIZ Regular to stay within the web size budget.
+fn validate_required_faces(faces: &[(String, String)], wasm: bool) -> Result<(), String> {
+    let has = |family: &str, style: &str| faces.iter().any(|(f, s)| f == family && s == style);
+    let inter = has("Inter", "Variable") || (has("Inter", "Regular") && has("Inter", "Bold"));
+    let biz_regular = has("BIZ UDPGothic", "Regular");
+    let biz_bold = wasm || has("BIZ UDPGothic", "Bold");
+    let chinese = wasm || has("LXGW WenKai Lite", "Regular");
+    let mut missing = Vec::new();
+    if !inter {
+        missing.push("Inter Regular/Bold (or Inter Variable)");
+    }
+    if !biz_regular {
+        missing.push("BIZ UDPGothic Regular");
+    }
+    if !biz_bold {
+        missing.push("BIZ UDPGothic Bold");
+    }
+    if !chinese {
+        missing.push("LXGW WenKai Lite Regular");
+    }
+    if missing.is_empty() {
+        Ok(())
+    } else {
+        Err(format!("CRAFT_FONTS_REQUIRED is set but the embedded font set after filtering lacks {}", missing.join(" and ")))
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::sync::atomic::{AtomicU64, Ordering};
+
+    static NEXT_FIXTURE: AtomicU64 = AtomicU64::new(0);
+    const CHINESE_ROW: &str = "LXGW WenKai Lite | Regular | fonts/fixture.ttf | Hani,Hans | OFL-1.1 | OFL.txt | fixture | https://example.invalid\n";
+
+    struct InputFixture(PathBuf);
+
+    impl InputFixture {
+        /// Test helper: create a unique temporary fixture with a main manifest and asset file.
+        fn new() -> Self {
+            let path = std::env::temp_dir().join(format!("deck-font-input-{}-{}", std::process::id(), NEXT_FIXTURE.fetch_add(1, Ordering::Relaxed)));
+            std::fs::create_dir(&path).unwrap();
+            std::fs::create_dir(path.join("fonts")).unwrap();
+            std::fs::write(path.join("fonts/fixture.ttf"), b"build-input path fixture").unwrap();
+            std::fs::write(
+                path.join("fonts/manifest.txt"),
+                "BIZ UDPGothic | Regular | fonts/fixture.ttf | Jpan,Latn | OFL-1.1 | OFL.txt | fixture | https://example.invalid\n\
+                 BIZ UDPGothic | Bold | fonts/fixture.ttf | Jpan,Latn | OFL-1.1 | OFL.txt | fixture | https://example.invalid\n",
+            )
+            .unwrap();
+            Self(path)
+        }
+
+        /// Test helper: replace the fixture's main manifest contents.
+        fn main(&self, text: &str) {
+            std::fs::write(self.0.join("fonts/manifest.txt"), text).unwrap();
+        }
+
+        /// Test helper: write the fixture's optional Latin manifest.
+        fn latin(&self, text: &str) {
+            std::fs::write(self.0.join("fonts/latin-manifest.txt"), text).unwrap();
+        }
+
+        /// Test helper: remove the optional Latin manifest.
+        fn no_latin(&self) {
+            let _ = std::fs::remove_file(self.0.join("fonts/latin-manifest.txt"));
+        }
+
+        /// Test helper: install a valid Inter Regular/Bold Latin manifest.
+        fn valid_latin(&self) {
+            self.latin(
+                "Inter | Regular | fonts/fixture.ttf | Latn | OFL-1.1 | OFL.txt | fixture | https://example.invalid\n\
+                 Inter | Bold | fonts/fixture.ttf | Latn | OFL-1.1 | OFL.txt | fixture | https://example.invalid\n",
+            );
+        }
+
+        /// Test helper: write the optional native Chinese manifest with the supplied rows.
+        fn optional(&self, text: &str) {
+            std::fs::write(self.0.join("fonts/simplified-chinese-manifest.txt"), text).unwrap();
+        }
+    }
+
+    impl Drop for InputFixture {
+        /// Test helper: best-effort removal of the temporary fixture directory.
+        fn drop(&mut self) {
+            let _ = std::fs::remove_dir_all(&self.0);
+        }
+    }
+
+    /// A required build without a font directory fails; an optional build embeds no fonts.
+    #[test]
+    fn required_input_cannot_silently_disappear() {
+        assert!(input_fonts(None, false, true).unwrap_err().contains("CRAFT_FONTS_DIR"));
+        assert_eq!(input_fonts(None, false, false).unwrap(), "");
+    }
+
+    /// A malformed optional Chinese manifest, or one naming a missing asset, leaves the main catalog
+    /// unchanged in optional builds, while a required build fails.
+    #[test]
+    fn broken_optional_manifest_preserves_the_main_fonts() {
+        let fixture = InputFixture::new();
+        let main = input_fonts(Some(&fixture.0), false, false).unwrap();
+        fixture.optional("malformed row");
+        assert_eq!(input_fonts(Some(&fixture.0), false, false).unwrap(), main);
+        assert!(input_fonts(Some(&fixture.0), false, true).is_err());
+        fixture.optional("LXGW WenKai Lite | Regular | missing.ttf | Hani,Hans | OFL-1.1 | OFL.txt | fixture | https://example.invalid");
+        assert_eq!(input_fonts(Some(&fixture.0), false, false).unwrap(), main);
+        assert!(input_fonts(Some(&fixture.0), false, true).is_err());
+    }
+
+    /// Adding or breaking native Chinese input must not change the wasm font initialiser bytes.
+    #[test]
+    fn native_opt_in_does_not_change_wasm_embedded_bytes() {
+        let fixture = InputFixture::new();
+        fixture.valid_latin();
+        let before = input_fonts(Some(&fixture.0), true, true).unwrap();
+        fixture.optional(CHINESE_ROW);
+        let native = input_fonts(Some(&fixture.0), false, true).unwrap();
+        assert!(native.contains("LXGW WenKai Lite"));
+        assert_eq!(input_fonts(Some(&fixture.0), true, true).unwrap(), before);
+        fixture.optional("malformed row");
+        assert_eq!(input_fonts(Some(&fixture.0), true, true).unwrap(), before);
+    }
+
+    /// Required native builds fail without the Chinese manifest; optional native and wasm builds
+    /// stay valid.
+    #[test]
+    fn required_native_input_requires_the_chinese_manifest() {
+        let fixture = InputFixture::new();
+        fixture.valid_latin();
+        assert!(input_fonts(Some(&fixture.0), false, true).unwrap_err().contains("simplified-Chinese"));
+        // Optional native builds and wasm keep working without it.
+        assert!(input_fonts(Some(&fixture.0), false, false).is_ok());
+        assert!(input_fonts(Some(&fixture.0), true, true).is_ok());
+    }
+
+    /// Every prohibited Source Han/Noto CJK family is excluded while permitted CJK, Latin, and
+    /// Hebrew faces survive.
+    #[test]
+    fn all_noto_cjk_families_are_excluded_from_every_platform() {
+        for family in [
+            "Noto Sans CJK SC",
+            "Noto Sans CJK TC",
+            "Noto Sans CJK JP",
+            "Noto Sans CJK KR",
+            "Noto Sans CJK HK",
+            "Noto Serif CJK SC",
+            "Noto Serif CJK JP",
+            "Noto Sans Mono CJK SC",
+            "Source Han Sans SC",
+            "Source Han Serif JP",
+        ] {
+            assert!(is_excluded_family(family), "{family} would be embedded");
+        }
+        for family in ["LXGW WenKai Lite", "Noto Sans Hebrew", "Inter", "Noto Sans Symbols 2"] {
+            assert!(!is_excluded_family(family), "{family} is an allowed input");
+        }
+        let fixture = InputFixture::new();
+        fixture.valid_latin();
+        let mut rows = String::from(CHINESE_ROW);
+        for family in ["Noto Sans CJK SC", "Noto Serif CJK JP", "Noto Sans Mono CJK KR"] {
+            rows.push_str(&format!("{family} | Regular | fonts/fixture.ttf | Hani | OFL-1.1 | OFL.txt | fixture | https://example.invalid\n"));
+        }
+        fixture.optional(&rows);
+        let native = input_fonts(Some(&fixture.0), false, true).unwrap();
+        assert!(!native.contains("Noto Sans CJK") && !native.contains("Noto Serif CJK") && !native.contains("Noto Sans Mono CJK"));
+        assert!(native.contains("BIZ UDPGothic"), "the allowed main manifest is retained");
+        assert!(native.contains("LXGW WenKai Lite"), "the valid Chinese row is retained");
+    }
+
+    /// A required native Chinese manifest must embed LXGW WenKai Lite Regular, not merely list a
+    /// nonempty manifest.
+    #[test]
+    fn required_native_chinese_manifest_must_emit_the_reviewed_face() {
+        let fixture = InputFixture::new();
+        fixture.valid_latin();
+        let excluded = "Noto Sans CJK SC | Regular | fonts/fixture.ttf | Hani | OFL-1.1 | OFL.txt | fixture | https://example.invalid\n\
+                        Noto Serif CJK JP | Regular | fonts/fixture.ttf | Hani | OFL-1.1 | OFL.txt | fixture | https://example.invalid\n";
+        let wrong_family = "LXGW WenKai | Regular | fonts/fixture.ttf | Hani,Hans | OFL-1.1 | OFL.txt | fixture | https://example.invalid\n";
+        for rows in ["", excluded, wrong_family] {
+            fixture.optional(rows);
+            let e = input_fonts(Some(&fixture.0), false, true).unwrap_err();
+            assert!(e.contains("LXGW WenKai Lite Regular"), "rows={rows:?}: {e}");
+            assert!(input_fonts(Some(&fixture.0), false, false).is_ok(), "optional builds still preserve the valid core");
+        }
+        fixture.optional(CHINESE_ROW);
+        let native = input_fonts(Some(&fixture.0), false, true).unwrap();
+        assert!(native.contains("CraftFont { family: \"LXGW WenKai Lite\", style: \"Regular\""), "{native}");
+        assert!(native.contains("BIZ UDPGothic") && native.contains("Inter"), "the rest of the required catalog is retained");
+    }
+
+    /// A broken optional Latin manifest is skipped as a unit, preserving main and valid Chinese
+    /// faces; required builds still fail.
+    #[test]
+    fn optional_broken_latin_manifest_is_skipped_without_losing_core_or_chinese() {
+        let fixture = InputFixture::new();
+        fixture.optional(CHINESE_ROW);
+        let missing_asset = "Inter | Regular | fonts/missing.ttf | Latn | OFL-1.1 | OFL.txt | fixture | https://example.invalid\n";
+        for latin in [None, Some("malformed row"), Some(missing_asset)] {
+            match latin {
+                Some(text) => fixture.latin(text),
+                None => fixture.no_latin(),
+            }
+            for wasm in [false, true] {
+                let catalog = input_fonts(Some(&fixture.0), wasm, false).unwrap();
+                assert!(catalog.contains("BIZ UDPGothic"), "wasm={wasm}: the main manifest is retained");
+                assert!(!catalog.contains("Inter"), "wasm={wasm}: the broken Latin manifest is skipped as a unit");
+                if !wasm {
+                    assert!(catalog.contains("LXGW WenKai Lite"), "the valid Chinese addition is retained");
+                }
+            }
+            assert!(input_fonts(Some(&fixture.0), false, true).is_err(), "required builds must not skip the missing required faces");
+        }
+    }
+
+    /// The reviewed Latin catalog keeps 43 permitted faces plus BIZ and LXGW natively, while wasm
+    /// remains a three-face subset.
+    #[test]
+    fn full_prior_latin_catalog_keeps_permitted_native_families() {
+        let fixture = InputFixture::new();
+        fixture.latin(include_str!("tests/fixtures/latin-families.txt"));
+        fixture.optional(CHINESE_ROW);
+        let native = input_fonts(Some(&fixture.0), false, true).unwrap();
+        assert_eq!(native.matches("CraftFont {").count(), 46, "43 permitted Latin faces plus BIZ Regular/Bold and LXGW");
+        for family in [
+            "Carlito",
+            "Caladea",
+            "Liberation Serif",
+            "Montserrat",
+            "Lato",
+            "Open Sans",
+            "Roboto",
+            "Merriweather",
+            "Playfair Display",
+            "Poppins",
+            "Nunito Sans",
+        ] {
+            assert!(native.contains(family), "missing prior presentation family {family}");
+        }
+        let web = input_fonts(Some(&fixture.0), true, true).unwrap();
+        assert_eq!(web.matches("CraftFont {").count(), 3, "Inter Regular/Bold and BIZ only");
+        for catalog in [&native, &web] {
+            assert!(!catalog.contains("Source Sans 3"));
+            assert!(!catalog.contains("Source Serif 4"));
+        }
+    }
+
+    /// Required builds without the Latin catalog fail because Inter Regular/Bold (or Variable) is
+    /// mandatory.
+    #[test]
+    fn required_builds_need_the_latin_catalog_for_inter() {
+        let fixture = InputFixture::new();
+        fixture.optional(CHINESE_ROW);
+        for wasm in [true, false] {
+            let e = input_fonts(Some(&fixture.0), wasm, true).unwrap_err();
+            assert!(e.contains("Inter Regular/Bold"), "wasm={wasm}: {e}");
+            assert!(input_fonts(Some(&fixture.0), wasm, false).is_ok(), "optional builds still work");
+        }
+    }
+
+    /// A single Inter weight, non-Inter substitutes, or excluded faces cannot satisfy the required
+    /// Inter contract.
+    #[test]
+    fn required_builds_reject_partial_or_unrelated_faces() {
+        let fixture = InputFixture::new();
+        fixture.optional(CHINESE_ROW);
+        for latin in [
+            "Inter | Regular | fonts/fixture.ttf | Latn | OFL-1.1 | OFL.txt | fixture | https://example.invalid\n",
+            "Inter | Bold | fonts/fixture.ttf | Latn | OFL-1.1 | OFL.txt | fixture | https://example.invalid\n",
+            "Inter | Italic | fonts/fixture.ttf | Latn | OFL-1.1 | OFL.txt | fixture | https://example.invalid\n\
+             Inter | SemiBold | fonts/fixture.ttf | Latn | OFL-1.1 | OFL.txt | fixture | https://example.invalid\n",
+            "Carlito | Regular | fonts/fixture.ttf | Latn | OFL-1.1 | OFL.txt | fixture | https://example.invalid\n",
+            "Source Sans 3 | Regular | fonts/fixture.ttf | Latn | OFL-1.1 | OFL.txt | fixture | https://example.invalid\n\
+             Source Sans 3 | Bold | fonts/fixture.ttf | Latn | OFL-1.1 | OFL.txt | fixture | https://example.invalid\n",
+        ] {
+            fixture.latin(latin);
+            for wasm in [true, false] {
+                let e = input_fonts(Some(&fixture.0), wasm, true).unwrap_err();
+                assert!(e.contains("Inter Regular/Bold"), "wasm={wasm}: {e}");
+                assert!(input_fonts(Some(&fixture.0), wasm, false).is_ok(), "optional builds still work");
+            }
+        }
+    }
+
+    /// BIZ UDPGothic Regular is required on every platform; required native builds additionally
+    /// need Bold.
+    #[test]
+    fn required_builds_need_biz_udpgothic_regular() {
+        let fixture = InputFixture::new();
+        fixture.valid_latin();
+        fixture.main(
+            "Inter | Regular | fonts/fixture.ttf | Latn | OFL-1.1 | OFL.txt | fixture | https://example.invalid\n\
+             Inter | Bold | fonts/fixture.ttf | Latn | OFL-1.1 | OFL.txt | fixture | https://example.invalid\n",
+        );
+        fixture.optional(CHINESE_ROW);
+        for wasm in [true, false] {
+            let e = input_fonts(Some(&fixture.0), wasm, true).unwrap_err();
+            assert!(e.contains("BIZ UDPGothic Regular"), "wasm={wasm}: {e}");
+            if !wasm {
+                assert!(e.contains("BIZ UDPGothic Bold"), "native builds need the weight pair: {e}");
+            }
+            assert!(input_fonts(Some(&fixture.0), wasm, false).is_ok(), "optional builds still work");
+        }
+    }
+
+    /// Native required builds need the real BIZ Bold face for weight metrics; wasm deliberately
+    /// embeds only Regular to stay within its size budget. This pins the contract the engine's
+    /// required-build metric pair assertion relies on.
+    #[test]
+    fn required_native_builds_need_biz_bold_but_wasm_does_not() {
+        let fixture = InputFixture::new();
+        fixture.valid_latin();
+        fixture.optional(CHINESE_ROW);
+        fixture.main("BIZ UDPGothic | Regular | fonts/fixture.ttf | Jpan,Latn | OFL-1.1 | OFL.txt | fixture | https://example.invalid\n");
+        let e = input_fonts(Some(&fixture.0), false, true).unwrap_err();
+        assert!(e.contains("BIZ UDPGothic Bold"), "required native build accepted a Regular-only catalog: {e}");
+        let web = input_fonts(Some(&fixture.0), true, true).unwrap();
+        assert_eq!(web.matches("CraftFont {").count(), 3, "wasm keeps Inter Regular/Bold and BIZ Regular only");
+    }
+
+    /// Required checks accept either static Inter Regular+Bold or a single Variable face, together
+    /// with BIZ.
+    #[test]
+    fn required_builds_accept_static_or_variable_inter_with_biz() {
+        let fixture = InputFixture::new();
+        fixture.valid_latin();
+        fixture.optional(CHINESE_ROW);
+        for wasm in [true, false] {
+            let static_catalog = input_fonts(Some(&fixture.0), wasm, true).unwrap();
+            assert!(static_catalog.contains("Inter") && static_catalog.contains("BIZ UDPGothic"));
+        }
+        fixture.latin("Inter | Variable | fonts/fixture.ttf | Latn | OFL-1.1 | OFL.txt | fixture | https://example.invalid\n");
+        for wasm in [true, false] {
+            let variable_catalog = input_fonts(Some(&fixture.0), wasm, true).unwrap();
+            assert!(variable_catalog.contains("Inter") && variable_catalog.contains("BIZ UDPGothic"));
+        }
+    }
 }

crates/fonts/src/lib.rs

@@ -409,16 +409,38 @@ mod tests {
         assert!(feature("liga").is_some());
     }
 
+    /// When the Latin build input exists, the runtime catalogue carries the expected Latin faces;
+    /// required builds also assert their presence.
     #[test]
     fn craft_fonts_latin_when_present() {
+        let required = option_env!("CRAFT_FONTS_REQUIRED").is_some();
         if !CRAFT_FONTS.iter().any(|f| f.family == "Inter") {
+            assert!(!required, "CRAFT_FONTS_REQUIRED must embed Inter rather than skip the optional Latin manifest");
             eprintln!("skipped: built without craft-fonts' Latin manifest (set CRAFT_FONTS_DIR)");
             return;
         }
+        let inter = |style: &str| CRAFT_FONTS.iter().find(|f| f.family == "Inter" && f.style == style);
+        let (regular, bold, variable) = (inter("Regular"), inter("Bold"), inter("Variable"));
+        if required {
+            assert!(
+                variable.is_some() || (regular.is_some() && bold.is_some()),
+                "CRAFT_FONTS_REQUIRED must embed Inter Regular and Bold (or a Variable face)"
+            );
+        }
         let db = FontDb::with_font_dirs(Vec::new());
         db.set_system_fallback(false);
         assert_eq!(db.face("Inter", "Regular").family, "Inter");
         assert_eq!(db.face("Aptos", "Regular").family, "Inter");
+        if let (Some(regular), Some(bold)) = (regular, bold) {
+            // The build input carries one entry per face; real static Bold must not be the Regular
+            // file relabelled in the manifest.
+            assert_ne!(regular.bytes, bold.bytes, "Inter Bold must be a distinct face file from Regular");
+            let (r, b) = (db.face("Inter", "Regular"), db.face("Inter", "Bold"));
+            assert_eq!((r.family.as_str(), r.style.as_str()), ("Inter", "Regular"));
+            assert_eq!((b.family.as_str(), b.style.as_str()), ("Inter", "Bold"));
+            assert_ne!(r.id(), b.id(), "Inter Bold must load as its own face");
+            assert!(b.weight > r.weight, "Inter Bold weight {} is not above Regular {}", b.weight, r.weight);
+        }
         if CRAFT_FONTS.iter().any(|f| f.family == "Carlito") {
             assert_eq!(db.face("Calibri", "Bold").family, "Carlito");
         }

crates/fonts/tests/build_input.rs

@@ -0,0 +1,4 @@
+//! Exercise the build-input parser without changing process environment variables.
+#[allow(dead_code)]
+#[path = "../build.rs"]
+mod build_script;

crates/fonts/tests/fixtures/latin-families.txt

@@ -0,0 +1,52 @@
+# Synthetic paths; family/style inventory from craft-fonts 76ba5a0496503c0e2841abd626295038cbe07cde.
+Inter | Regular | fonts/fixture.ttf | Latn
+Inter | Italic | fonts/fixture.ttf | Latn
+Inter | SemiBold | fonts/fixture.ttf | Latn
+Inter | Bold | fonts/fixture.ttf | Latn
+Carlito | Regular | fonts/fixture.ttf | Latn
+Carlito | Bold | fonts/fixture.ttf | Latn
+Carlito | Italic | fonts/fixture.ttf | Latn
+Carlito | Bold Italic | fonts/fixture.ttf | Latn
+Caladea | Regular | fonts/fixture.ttf | Latn
+Caladea | Bold | fonts/fixture.ttf | Latn
+Caladea | Italic | fonts/fixture.ttf | Latn
+Caladea | Bold Italic | fonts/fixture.ttf | Latn
+Liberation Sans | Regular | fonts/fixture.ttf | Latn
+Liberation Sans | Bold | fonts/fixture.ttf | Latn
+Liberation Sans | Italic | fonts/fixture.ttf | Latn
+Liberation Sans | Bold Italic | fonts/fixture.ttf | Latn
+Liberation Serif | Regular | fonts/fixture.ttf | Latn
+Liberation Serif | Bold | fonts/fixture.ttf | Latn
+Liberation Serif | Italic | fonts/fixture.ttf | Latn
+Liberation Serif | Bold Italic | fonts/fixture.ttf | Latn
+Liberation Mono | Regular | fonts/fixture.ttf | Latn
+Liberation Mono | Bold | fonts/fixture.ttf | Latn
+Liberation Mono | Italic | fonts/fixture.ttf | Latn
+Liberation Mono | Bold Italic | fonts/fixture.ttf | Latn
+Source Sans 3 | Regular | fonts/fixture.ttf | Latn
+Source Sans 3 | Italic | fonts/fixture.ttf | Latn
+Source Sans 3 | Semibold | fonts/fixture.ttf | Latn
+Source Sans 3 | Bold | fonts/fixture.ttf | Latn
+Source Serif 4 | Regular | fonts/fixture.ttf | Latn
+Source Serif 4 | Italic | fonts/fixture.ttf | Latn
+Source Serif 4 | Semibold | fonts/fixture.ttf | Latn
+Source Serif 4 | Bold | fonts/fixture.ttf | Latn
+Montserrat | Variable | fonts/fixture.ttf | Latn
+Montserrat | Italic Variable | fonts/fixture.ttf | Latn
+Lato | Regular | fonts/fixture.ttf | Latn
+Lato | Bold | fonts/fixture.ttf | Latn
+Lato | Italic | fonts/fixture.ttf | Latn
+Open Sans | Variable | fonts/fixture.ttf | Latn
+Open Sans | Italic Variable | fonts/fixture.ttf | Latn
+Roboto | Variable | fonts/fixture.ttf | Latn
+Roboto | Italic Variable | fonts/fixture.ttf | Latn
+Merriweather | Regular | fonts/fixture.ttf | Latn
+Merriweather | Bold | fonts/fixture.ttf | Latn
+Merriweather | Italic | fonts/fixture.ttf | Latn
+Playfair Display | Variable | fonts/fixture.ttf | Latn
+Playfair Display | Italic Variable | fonts/fixture.ttf | Latn
+Poppins | Regular | fonts/fixture.ttf | Latn
+Poppins | Bold | fonts/fixture.ttf | Latn
+Poppins | Italic | fonts/fixture.ttf | Latn
+Nunito Sans | Variable | fonts/fixture.ttf | Latn
+Nunito Sans | Italic Variable | fonts/fixture.ttf | Latn

crates/format/src/chart_parts_tests.rs

@@ -1,6 +1,9 @@
-use super::*;
+use std::io::{Cursor, Write};
+use std::sync::Arc;
+
+use super::{Budget, Presentation, load, load_checked, load_within, read_entry, read_entry_max, save};
 use deckcraft_model::chart::{Chart, ChartPart, ChartRel, ChartType};
-use deckcraft_model::{Master, Shape, ShapeId};
+use deckcraft_model::{Master, Shape, ShapeId, ShapeKind};
 use serde_json::{Value, json};
 
 const PART: &str = "ppt/embeddings/owned.xlsx";

crates/format/src/lib.rs

@@ -6,6 +6,7 @@
 
 mod chart_parts;
 mod finite;
+pub mod rtf;
 
 #[cfg(test)]
 mod chart_parts_tests;
@@ -661,6 +662,7 @@ pub fn slides_to_outline(p: &Presentation) -> String {
             if let ShapeKind::Table(t) = &sh.kind {
                 for row in &t.rows {
                     let cells: Vec<String> = row.cells.iter().map(|c| c.text.text().replace(['\u{b}', '\n'], " ")).collect();
+                    out.push('\t');
                     out.push_str(&cells.join("\t"));
                     out.push('\n');
                 }
@@ -1100,3 +1102,33 @@ mod tests {
         assert!(out.contains("Cell A2\tCell B2"), "{out}");
     }
 }
+
+#[test]
+fn outline_table_rows_are_indented_and_do_not_become_slides() {
+    use deckcraft_model::table::{Cell, Row, Table};
+    use deckcraft_model::{Shape, ShapeKind, Xfrm};
+    let mut p = defaults::new_presentation(None);
+    let layout = defaults::layout_of_kind(&p, LayoutType::TitleAndContent).unwrap();
+    let mut s = defaults::new_slide(&mut p, layout).expect("slide");
+    for sh in s.shapes.iter_mut().filter(|sh| sh.ph_type().is_some_and(|k| k.is_title())) {
+        sh.text = Some(TextBody::from_text("Slide title"));
+    }
+    let mut table = Table { cols: vec![200.0, 200.0], ..Default::default() };
+    for texts in [["A1", "B1"], ["A2", "B2"]] {
+        let cells: Vec<Cell> = texts.iter().map(|t| Cell { text: TextBody::from_text(t), ..Default::default() }).collect();
+        table.rows.push(Row { height: 30.0, cells });
+    }
+    let mut tbl = Shape { xfrm: Some(Xfrm::new(0.0, 100.0, 400.0, 60.0)), ..Default::default() };
+    tbl.kind = ShapeKind::Table(table);
+    s.shapes.push(tbl);
+    p.slides = vec![std::sync::Arc::new(s)];
+
+    let out = slides_to_outline(&p);
+    let mut q = defaults::new_presentation(None);
+    q.slides.clear();
+    assert_eq!(outline_to_slides(&mut q, &out), 1, "table rows became slides: {out:?}");
+    assert_eq!(q.slides.len(), 1, "{out:?}");
+    let body = q.slides[0].shapes.iter().filter_map(|sh| sh.text.as_ref()).map(|t| t.text()).collect::<Vec<_>>().join("\n");
+    assert!(body.contains("A1\tB1"), "{body:?}");
+    assert!(body.contains("A2\tB2"), "{body:?}");
+}

crates/format/src/rtf.rs

@@ -0,0 +1,411 @@
+//! Outline / RTF: PowerPoint's "Outline/RTF" save type, and reading such a file back as slides.
+//!
+//! The export writes one paragraph per slide title (outline level 0, bold, larger) and one per
+//! body paragraph (outline level = indent + 1, indented), keeping bold, italic and underline.
+//! The import reads paragraphs and their `\outlinelevel` (or, failing that, `\li` indent) into
+//! the tab-indented outline [`crate::outline_to_slides`] understands.
+
+use deckcraft_model::Presentation;
+use deckcraft_model::text::{Paragraph, RunKind};
+
+/// RTF-escape `s` (non-ASCII as `\uN?`, UTF-16, signed as RTF wants).
+fn escape(out: &mut String, s: &str) {
+    for c in s.chars() {
+        match c {
+            '\\' | '{' | '}' => {
+                out.push('\\');
+                out.push(c);
+            }
+            '\t' => out.push_str("\\tab "),
+            '\u{b}' | '\n' => out.push_str("\\line "),
+            c if c.is_ascii() && !c.is_ascii_control() => out.push(c),
+            c if c.is_ascii() => {}
+            c => {
+                let mut buf = [0u16; 2];
+                for u in c.encode_utf16(&mut buf) {
+                    out.push_str(&format!("\\u{}?", *u as i16));
+                }
+            }
+        }
+    }
+}
+
+fn runs(out: &mut String, p: &Paragraph) {
+    for r in &p.runs {
+        if matches!(r.kind, RunKind::Break) {
+            out.push_str("\\line ");
+            continue;
+        }
+        let (b, i, u) = (r.props.bold == Some(true), r.props.italic == Some(true), r.props.underline.as_deref().is_some_and(|u| u != "none"));
+        if !(b || i || u) {
+            escape(out, &r.text);
+            continue;
+        }
+        out.push('{');
+        out.push_str(if b { "\\b" } else { "" });
+        out.push_str(if i { "\\i" } else { "" });
+        out.push_str(if u { "\\ul" } else { "" });
+        out.push(' ');
+        escape(out, &r.text);
+        out.push('}');
+    }
+}
+
+/// The presentation's outline (slide titles and body text) as RTF.
+pub fn slides_to_rtf(p: &Presentation) -> String {
+    let mut out = String::from("{\\rtf1\\ansi\\ansicpg1252\\deff0\\uc1{\\fonttbl{\\f0\\fswiss Liberation Sans;}}\n");
+    for s in &p.slides {
+        let title = s.shapes.iter().find(|sh| sh.ph_type().is_some_and(|k| k.is_title())).and_then(|sh| sh.text.as_ref());
+        out.push_str("\\pard\\outlinelevel0\\sb240\\b\\fs32 ");
+        // The title stays one outline paragraph (a `\par` would start another slide on re-import),
+        // so its paragraphs are joined with line breaks.
+        let mut tps = title.into_iter().flat_map(|t| &t.paragraphs).filter(|p| !p.is_empty()).peekable();
+        if tps.peek().is_none() {
+            escape(&mut out, &s.title());
+        }
+        for (k, tp) in tps.enumerate() {
+            if k > 0 {
+                out.push_str("\\line ");
+            }
+            runs(&mut out, tp);
+        }
+        out.push_str("\\b0\\par\n");
+        for sh in &s.shapes {
+            if sh.ph_type().is_some_and(|k| k.is_title()) {
+                continue;
+            }
+            let Some(t) = &sh.text else { continue };
+            for para in t.paragraphs.iter().filter(|p| !p.is_empty()) {
+                let lvl = para.level.min(8) as u32;
+                out.push_str(&format!("\\pard\\outlinelevel{}\\li{}\\fs24 ", lvl + 1, 360 * (lvl + 1)));
+                runs(&mut out, para);
+                out.push_str("\\par\n");
+            }
+        }
+    }
+    out.push_str("}\n");
+    out
+}
+
+/// Whether `bytes` look like RTF.
+pub fn sniff_rtf(bytes: &[u8]) -> bool {
+    bytes.trim_ascii_start().starts_with(b"{\\rtf")
+}
+
+/// Destinations whose text is not document text.
+const SKIP: &[&str] = &[
+    "fonttbl",
+    "colortbl",
+    "stylesheet",
+    "info",
+    "pict",
+    "header",
+    "footer",
+    "footnote",
+    "listtable",
+    "listoverridetable",
+    "generator",
+    "xmlnstbl",
+    "themedata",
+    "datastore",
+    "latentstyles",
+    "rsidtbl",
+    "object",
+    "fldinst",
+    // A list item's rendered bullet or number, written before its text (Word: listtext; RTF 1.5 and
+    // older writers: pntext, pntxta, pntxtb). Its `\pard` must not reset the paragraph's indent.
+    "listtext",
+    "pntext",
+    "pntxta",
+    "pntxtb",
+];
+
+/// `i + n`, or one character on when that would land inside a multi-byte character (a fallback
+/// run after `\uN` or `\'hh` may be followed by non-ASCII text).
+fn advance(rtf: &str, i: usize, n: usize) -> usize {
+    if rtf.is_char_boundary(i + n) { i + n } else { i + rtf.get(i..).and_then(|r| r.chars().next()).map_or(1, char::len_utf8) }
+}
+
+/// Read an RTF outline into tab-indented outline text: a paragraph's outline level (or its left
+/// indent in 0.25" steps) becomes its number of tabs.
+pub fn rtf_to_outline(rtf: &str) -> String {
+    #[derive(Clone, Copy)]
+    struct St {
+        skip: bool,
+        uc: usize,
+    }
+    let b = rtf.as_bytes();
+    let mut stack: Vec<St> = vec![];
+    let mut st = St { skip: false, uc: 1 };
+    let (mut level, mut indent): (Option<u32>, i64) = (None, 0);
+    let mut line = String::new();
+    let mut out = String::new();
+    let mut pending_skip = 0usize;
+    let mut i = 0;
+    let flush = |line: &mut String, level: Option<u32>, indent: i64, out: &mut String| {
+        let text = line.trim();
+        if !text.is_empty() {
+            let n = level.map(|l| l as i64).unwrap_or(indent.saturating_add(180) / 360).clamp(0, 9) as usize;
+            out.push_str(&"\t".repeat(n));
+            out.push_str(text);
+            out.push('\n');
+        }
+        line.clear();
+    };
+    while i < b.len() {
+        let c = b[i];
+        match c {
+            b'{' => {
+                stack.push(st);
+                i += 1;
+                // `{\*\dest …}`: an ignorable destination.
+                if b[i..].starts_with(b"\\*") {
+                    st.skip = true;
+                }
+            }
+            b'}' => {
+                st = stack.pop().unwrap_or(St { skip: false, uc: 1 });
+                i += 1;
+            }
+            b'\\' => {
+                i += 1;
+                let Some(&n) = b.get(i) else { break };
+                if n.is_ascii_alphabetic() {
+                    let s = i;
+                    while i < b.len() && b[i].is_ascii_alphabetic() {
+                        i += 1;
+                    }
+                    let word = &rtf[s..i];
+                    let ns = i;
+                    if i < b.len() && (b[i] == b'-' || b[i].is_ascii_digit()) {
+                        i += 1;
+                        while i < b.len() && b[i].is_ascii_digit() {
+                            i += 1;
+                        }
+                    }
+                    let arg: Option<i64> = rtf[ns..i].parse().ok();
+                    if i < b.len() && b[i] == b' ' {
+                        i += 1;
+                    }
+                    if pending_skip > 0 {
+                        pending_skip -= 1;
+                        continue;
+                    }
+                    if SKIP.contains(&word) {
+                        st.skip = true;
+                    }
+                    if st.skip {
+                        continue;
+                    }
+                    match word {
+                        "par" => {
+                            flush(&mut line, level, indent, &mut out);
+                        }
+                        "pard" => {
+                            level = None;
+                            indent = 0;
+                        }
+                        "outlinelevel" => level = arg.map(|a| a.clamp(0, 9) as u32),
+                        "li" => indent = arg.unwrap_or(0),
+                        "tab" | "line" => line.push(' '),
+                        "uc" => st.uc = arg.unwrap_or(1).clamp(0, 8) as usize,
+                        "u" => {
+                            let v = arg.unwrap_or(0);
+                            // RTF writes UTF-16 units as signed 16-bit values.
+                            push_utf16(&mut line, (v & 0xffff) as u32);
+                            pending_skip = 0;
+                            // Skip the fallback characters.
+                            let mut k = st.uc;
+                            while k > 0 && i < b.len() {
+                                if b[i] == b'\\' && b.get(i + 1) == Some(&b'\'') {
+                                    i = advance(rtf, i, 4);
+                                } else if b[i] == b'{' || b[i] == b'}' || b[i] == b'\\' {
+                                    break;
+                                } else {
+                                    i = advance(rtf, i, 1);
+                                }
+                                k -= 1;
+                            }
+                        }
+                        "emdash" => line.push('—'),
+                        "endash" => line.push('–'),
+                        "bullet" => line.push('•'),
+                        "lquote" => line.push('‘'),
+                        "rquote" => line.push('’'),
+                        "ldblquote" => line.push('“'),
+                        "rdblquote" => line.push('”'),
+                        _ => {}
+                    }
+                } else if n == b'\'' {
+                    let hex = rtf.get(i + 1..i + 3).filter(|h| h.bytes().all(|b| b.is_ascii_hexdigit())).and_then(|h| u8::from_str_radix(h, 16).ok());
+                    i = advance(rtf, i, 3);
+                    if !st.skip
+                        && let Some(h) = hex
+                        && h != 0
+                    {
+                        line.push(cp1252(h));
+                    }
+                } else {
+                    i += 1;
+                    if st.skip {
+                        continue;
+                    }
+                    match n {
+                        b'\\' | b'{' | b'}' => line.push(n as char),
+                        b'~' => line.push('\u{a0}'),
+                        b'_' => line.push('\u{2011}'),
+                        b'\n' | b'\r' => flush(&mut line, level, indent, &mut out),
+                        _ => {}
+                    }
+                }
+            }
+            b'\r' | b'\n' => i += 1,
+            _ => {
+                let s = i;
+                while i < b.len() && !matches!(b[i], b'{' | b'}' | b'\\' | b'\r' | b'\n') {
+                    i += 1;
+                }
+                if !st.skip
+                    && let Some(t) = rtf.get(s..i)
+                {
+                    line.push_str(&t.replace('\u{0}', ""));
+                }
+            }
+        }
+    }
+    flush(&mut line, level, indent, &mut out);
+    finish_surrogates(out)
+}
+
+/// Push a UTF-16 unit; surrogate halves are parked as private markers (NUL plus four hex digits)
+/// and joined afterwards. NUL itself is the marker, so a NUL unit is dropped.
+fn push_utf16(line: &mut String, v: u32) {
+    if v == 0 {
+        return;
+    }
+    match char::from_u32(v) {
+        Some(c) => line.push(c),
+        None => line.push_str(&format!("\u{0}{v:04x}")),
+    }
+}
+
+fn finish_surrogates(s: String) -> String {
+    if !s.contains('\u{0}') {
+        return s;
+    }
+    let mut out = String::new();
+    let mut rest = s.as_str();
+    while let Some(p) = rest.find('\u{0}') {
+        out.push_str(&rest[..p]);
+        let hi = rest.get(p + 1..p + 5).and_then(|h| u32::from_str_radix(h, 16).ok());
+        let lo = rest.get(p + 6..p + 10).filter(|_| rest.get(p + 5..p + 6) == Some("\u{0}")).and_then(|h| u32::from_str_radix(h, 16).ok());
+        match (hi, lo) {
+            (Some(h), Some(l)) if (0xD800..0xDC00).contains(&h) && (0xDC00..0xE000).contains(&l) => {
+                out.extend(char::from_u32(0x10000 + ((h - 0xD800) << 10) + (l - 0xDC00)));
+                rest = &rest[p + 10..];
+            }
+            _ => {
+                out.push('\u{fffd}');
+                // Skip the NUL and, when four hex digits follow, the digits; otherwise
+                // resume right after the NUL so no following character is lost.
+                let skip = if hi.is_some() { p + 5 } else { p + 1 };
+                rest = rest.get(skip..).unwrap_or("");
+            }
+        }
+    }
+    out.push_str(rest);
+    out
+}
+
+fn cp1252(b: u8) -> char {
+    const HIGH: [char; 32] = [
+        '€', '\u{81}', '‚', 'ƒ', '„', '…', '†', '‡', 'ˆ', '‰', 'Š', '‹', 'Œ', '\u{8d}', 'Ž', '\u{8f}', '\u{90}', '‘', '’', '“', '”', '•', '–', '—',
+        '˜', '™', 'š', '›', 'œ', '\u{9d}', 'ž', 'Ÿ',
+    ];
+    match b {
+        0x80..=0x9f => HIGH[(b - 0x80) as usize],
+        _ => b as char,
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    #![allow(clippy::unwrap_used)]
+    use super::*;
+
+    /// A sign in a `\'hh` escape is not a hex digit and must be ignored.
+    #[test]
+    fn hex_escape_rejects_sign() {
+        assert_eq!(rtf_to_outline(r"{\rtf1 a\'+5b\par}"), "ab\n");
+    }
+
+    /// Non-ASCII text after a `\\uN` or `\\'hh` escape used to split a character and panic.
+    #[test]
+    fn non_ascii_text_after_escapes_does_not_panic() {
+        let out = rtf_to_outline(r"{\rtf1\pard \u233é x \'€y\par}");
+        assert!(out.contains('x'), "{out:?}");
+        for rtf in [r"{\rtf1 \u233é€ z\par}", r"{\rtf1 \'é\par}", r"{\rtf1 \'4", r"{\rtf1 \u233"] {
+            let _ = rtf_to_outline(rtf);
+        }
+    }
+
+    /// NUL is the surrogate marker, so NULs from `\u0`, `\'00` or raw bytes must not reach `finish_surrogates`.
+    #[test]
+    fn nul_escapes_do_not_drop_text_or_add_a_slide() {
+        assert_eq!(rtf_to_outline(r"{\rtf1 \u0?abcé\par}"), "abcé\n");
+        assert_eq!(rtf_to_outline(r"{\rtf1 a\'00bé\par}"), "abé\n");
+        assert_eq!(rtf_to_outline("{\\rtf1 a\0b\\par}\0\0"), "ab\n");
+        assert_eq!(rtf_to_outline(r"{\rtf1 x\u-70000?y\par}"), "x\u{ee90}y\n");
+    }
+
+    /// `\\_` is RTF's non-breaking hyphen: a visible character, not markup.
+    #[test]
+    fn non_breaking_hyphen_is_kept() {
+        assert_eq!(rtf_to_outline(r"{\rtf1\pard Year\_end review\par}"), "Year\u{2011}end review\n");
+    }
+
+    /// A hostile `\li` near `i64::MAX` overflowed the rounding addend in debug builds.
+    #[test]
+    fn huge_left_indent_gives_the_deepest_level() {
+        let out = rtf_to_outline(r"{\rtf1\pard\li9223372036854775807 deep\par\pard\li-9223372036854775808 flat\par}");
+        assert_eq!(out, format!("{}deep\nflat\n", "\t".repeat(9)));
+    }
+
+    #[test]
+    fn export_reads_back_as_the_same_outline() {
+        let mut p = deckcraft_model::defaults::blank_presentation(deckcraft_model::defaults::WIDE, Default::default(), false);
+        let outline = "Plan {Q3}\n\tGrow — fast 😀\n\t\tEurope\\Asia\nCafé résumé\n\tDone\n";
+        crate::outline_to_slides(&mut p, outline);
+        let rtf = slides_to_rtf(&p);
+        assert!(sniff_rtf(rtf.as_bytes()));
+        assert!(rtf.contains("\\outlinelevel2") && rtf.contains("Plan \\{Q3\\}"), "{rtf}");
+        assert_eq!(rtf_to_outline(&rtf), crate::slides_to_outline(&p));
+    }
+
+    /// A title with two paragraphs: the plain outline keeps both, the RTF export kept only the first.
+    #[test]
+    fn every_title_paragraph_is_exported() {
+        let mut p = deckcraft_model::defaults::blank_presentation(deckcraft_model::defaults::WIDE, Default::default(), false);
+        crate::outline_to_slides(&mut p, "First line\n\tBody\n");
+        let slide = std::sync::Arc::make_mut(&mut p.slides[0]);
+        let title = slide.shapes.iter_mut().find(|sh| sh.ph_type().is_some_and(|k| k.is_title())).and_then(|sh| sh.text.as_mut()).unwrap();
+        title.paragraphs.push(Paragraph::new("Second line"));
+        let rtf = slides_to_rtf(&p);
+        assert!(rtf.contains("First line\\line Second line\\b0\\par"), "{rtf}");
+        assert_eq!(rtf_to_outline(&rtf), crate::slides_to_outline(&p));
+    }
+
+    #[test]
+    fn reads_word_style_rtf_by_indent_and_hex_escapes() {
+        let rtf = r"{\rtf1\ansi{\fonttbl{\f0 Arial;}}{\*\generator X;}\pard\b Title one\b0\par\pard\li720 Point \'93a\'94\par\pard\li1440 Sub\par}";
+        assert_eq!(rtf_to_outline(rtf), "Title one\n\t\tPoint “a”\n\t\t\t\tSub\n");
+    }
+
+    /// Word writes a list item's bullet as `{\\listtext\\pard\\plain …\\'b7\\tab}` (older writers:
+    /// `{\\pntext …}`) after the paragraph's own `\\li`. That group is the rendered bullet, not text.
+    #[test]
+    fn word_list_bullets_are_not_text_and_keep_the_indent() {
+        let rtf = r"{\rtf1\ansi\pard Title\par\pard\fi-360\li720{\listtext\pard\plain\f1\'b7\tab}Point\par\pard\li720{\pntext\f1\'b7\tab}Old\par}";
+        assert_eq!(rtf_to_outline(rtf), "Title\n\t\tPoint\n\t\tOld\n");
+    }
+}

crates/geom/src/preset.rs

@@ -1334,7 +1334,9 @@ pub fn build(name: &str, w: f64, h: f64, adj: &[f64]) -> Option<Geometry> {
             let (y1, y2) = (h / 2.0 - h * k / 2.0, h / 2.0 + h * k / 2.0);
             let dx = (ss * a(1).max(0.0) / 1e5).min(w);
             if name == "notchedRightArrow" {
-                let n = dx * (k / 2.0) * 0.9;
+                // x1 = dy1 · dx2 / hd2 in presetShapeDefinitions, with dy1 = h·k/2: the notch's
+                // edges run parallel to the head's
+                let n = dx * k;
                 let pts = [(0.0, y1), (w - dx, y1), (w - dx, 0.0), (w, h / 2.0), (w - dx, h), (w - dx, y2), (0.0, y2), (n, h / 2.0)];
                 g.paths = vec![fill(Pb::new().poly(&pts).take())];
             } else {
@@ -1860,10 +1862,10 @@ fn wedge_rect(w: f64, h: f64, a0: f64, a1: f64, r: f64) -> Geometry {
     let r = r.min(w / 2.0).min(h / 2.0);
     // Walk clockwise from the top-left; insert the wedge on the edge facing the tip.
     let horiz = dx.abs() > dy.abs();
-    let (bx0, bx1) = (w * 5.0 / 12.0, w * 7.0 / 12.0);
-    let (by0, by1) = (h * 5.0 / 12.0, h * 7.0 / 12.0);
-    let (bx0, bx1) = if tip.x < w / 2.0 { (w * 2.0 / 12.0, w * 5.0 / 12.0) } else { (bx0 + w / 12.0 * 2.0 - w / 12.0 * 2.0, bx1 + w * 2.0 / 12.0) };
-    let (by0, by1) = if tip.y < h / 2.0 { (h * 2.0 / 12.0, h * 5.0 / 12.0) } else { (by0, by1 + h * 2.0 / 12.0) };
+    // The wedge's base: 2..5 twelfths of the edge on the tip's side of the centre when it is
+    // before it, 7..10 twelfths when after (presetShapeDefinitions' xg1/xg2, yg1/yg2).
+    let (bx0, bx1) = if tip.x < w / 2.0 { (w * 2.0 / 12.0, w * 5.0 / 12.0) } else { (w * 7.0 / 12.0, w * 10.0 / 12.0) };
+    let (by0, by1) = if tip.y < h / 2.0 { (h * 2.0 / 12.0, h * 5.0 / 12.0) } else { (h * 7.0 / 12.0, h * 10.0 / 12.0) };
     b.m(r, 0.0);
     if !inside && !horiz && dy < 0.0 {
         b.l(bx0, 0.0).l(tip.x, tip.y).l(bx1, 0.0);
@@ -2454,6 +2456,20 @@ mod tests {
         assert!(on_path(&g, at(2972.0, 0.0), 1e-6) && on_path(&g, at(18595.0, 18022.0), 1e-6));
     }
 
+    #[test]
+    fn notched_arrow_notch_parallels_the_head() {
+        // presetShapeDefinitions: the notch's point is at x1 = dy1 · dx2 / hd2, so its edges run
+        // parallel to the head's (25 on a 200 × 100 arrow at the default adjusts).
+        for (w, h, adj, x1) in [(200.0, 100.0, [50000.0, 50000.0], 25.0), (300.0, 120.0, [80000.0, 30000.0], 28.8)] {
+            let g = build("notchedRightArrow", w, h, &adj).unwrap();
+            let notch = g.paths[0].path.elements().iter().find_map(|e| match e {
+                kurbo::PathEl::MoveTo(p) | kurbo::PathEl::LineTo(p) if (p.y - h / 2.0).abs() < 1e-9 && p.x < w / 2.0 => Some(*p),
+                _ => None,
+            });
+            assert!(notch.is_some_and(|p| (p.x - x1).abs() < 1e-6), "{w}x{h} {adj:?}: notch at {notch:?}, want x = {x1}");
+        }
+    }
+
     #[test]
     fn equation_shapes_match_powerpoints_outlines() {
         // Corners read off PowerPoint's own outlines of the presets at their default adjusts.
@@ -2590,4 +2606,46 @@ mod tests {
             assert!(g.paths.iter().any(|p| p.stroke && p.fill == FillMode::None), "{name}: the curve is outlined");
         }
     }
+
+    /// The end points of a path's move/line elements, in order.
+    fn vertices(p: &BezPath) -> Vec<Point> {
+        p.elements()
+            .iter()
+            .filter_map(|e| match e {
+                kurbo::PathEl::MoveTo(q) | kurbo::PathEl::LineTo(q) => Some(*q),
+                _ => None,
+            })
+            .collect()
+    }
+
+    #[test]
+    fn wedge_callout_mirrors_with_its_tip() {
+        // A tip below and right of the centre draws the mirror image of the same tip on the left;
+        // the same for a tip right of the centre, above or below it. presetShapeDefinitions puts
+        // the wedge's base at 2..5 twelfths of the edge on the near side of the centre and at
+        // 7..10 twelfths on the far side.
+        let (w, h) = (240.0, 120.0);
+        // Sorted and deduplicated: the outline closes on the corner it starts from, which the
+        // mirror moves to the opposite corner.
+        let sorted = |mut v: Vec<Point>| {
+            v.sort_by(|a, b| a.x.total_cmp(&b.x).then(a.y.total_cmp(&b.y)));
+            v.dedup_by(|a, b| (*a - *b).hypot() < 1e-9);
+            v
+        };
+        for (right, left, flip_x) in [([10000.0, 80000.0], [-10000.0, 80000.0], true), ([80000.0, 10000.0], [80000.0, -10000.0], false)] {
+            let a = vertices(&build("wedgeRectCallout", w, h, &right).unwrap().paths[0].path);
+            let b = vertices(&build("wedgeRectCallout", w, h, &left).unwrap().paths[0].path);
+            let b: Vec<Point> = b.iter().map(|p| if flip_x { Point::new(w - p.x, p.y) } else { Point::new(p.x, h - p.y) }).collect();
+            let (a, b) = (sorted(a), sorted(b));
+            assert_eq!(a.len(), b.len(), "{right:?}: {a:?} vs mirrored {left:?}: {b:?}");
+            for (p, q) in a.iter().zip(&b) {
+                assert!((*p - *q).hypot() < 1e-6, "{right:?}: {a:?}\n is not the mirror of {left:?}: {b:?}");
+            }
+        }
+        // The bottom wedge of a tip right of the centre leaves the edge at 7/12 and 10/12 of the width.
+        let a = vertices(&build("wedgeRectCallout", w, h, &[10000.0, 80000.0]).unwrap().paths[0].path);
+        for x in [w * 7.0 / 12.0, w * 10.0 / 12.0] {
+            assert!(a.iter().any(|p| (p.x - x).abs() < 1e-6 && (p.y - h).abs() < 1e-6), "no wedge corner at ({x}, {h}): {a:?}");
+        }
+    }
 }

crates/geom/src/preset/extra.rs

@@ -2,7 +2,10 @@
 //! ribbons, gears, tabs and chart markers. Like the rest of `preset`, every outline is our own
 //! construction, fitted to how the shapes look and to what their adjust values mean.
 
-use super::*;
+use super::{
+    Corner, Dir, FillMode, Geometry, Handle, Pb, Point, Rect, Vec2, corner_rect, fill, fill_eo, fill_only, mid_sites, orient, shade, simple,
+    stroke_only, vis,
+};
 
 /// Builds the presets this module knows; `None` for any other name.
 pub(super) fn build(name: &str, w: f64, h: f64, a: &dyn Fn(usize) -> f64) -> Option<Geometry> {

crates/geom/src/warp/tests.rs

@@ -1,4 +1,6 @@
-use super::*;
+use super::{
+    Band, BezPath, CATALOG, Guide, Point, Rect, WarpLine, adjust_count, adjust_defaults, band_of_line, handles, is_follow, is_supported, warp,
+};
 
 const W: f64 = 420.0;
 const H: f64 = 200.0;

crates/h264/src/cabac_mb.rs

@@ -3,7 +3,7 @@
 
 use crate::cabac::Cabac;
 use crate::error::{Result, ensure, invalid};
-use crate::mbtypes::*;
+use crate::mbtypes::{MbTypeInfo, Part, SubMbInfo, b_mb_type, b_sub_mb_type, intra_mb_type, p_mb_type, p_sub_mb_type};
 use crate::picture::MbKind;
 use crate::slice::SliceType;
 use crate::slicedec::{MbCur, SliceDecoder};

crates/h264/src/cavlc.rs

@@ -1,6 +1,6 @@
 //! CAVLC residual block parsing (9.2).
 
-use crate::cavlc_tables::*;
+use crate::cavlc_tables::{COEFF_TOKEN, RUN_BEFORE, TOTAL_ZEROS_2X2, TOTAL_ZEROS_2X4, TOTAL_ZEROS_4X4};
 use crate::error::{Result, ensure};
 use deckcraft_bitstream::BitReader;
 use std::sync::OnceLock;

crates/h264/src/deblock.rs

@@ -232,7 +232,7 @@ fn filter_vertical<const N: usize>(pix: &mut [u8], stride: usize, x: usize, y: u
     let mut w = [0u64; N];
     for (i, w) in w.iter_mut().enumerate() {
         let o = (y + i) * stride + x - 4;
-        let Some(&b) = pix.get(o..).and_then(|p| p.first_chunk::<8>()) else {
+        let Some(&b) = pix.get(o..).and_then(<[_]>::first_chunk::<8>) else {
             return;
         };
         *w = u64::from_le_bytes(b);
@@ -259,7 +259,7 @@ fn filter_horizontal<const N: usize>(pix: &mut [u8], stride: usize, x: usize, y:
     let base = (y - 4) * stride + x;
     let mut s = [[0i16; N]; 8];
     for (k, row) in s.iter_mut().enumerate() {
-        let Some(src) = pix.get(base + k * stride..).and_then(|p| p.first_chunk::<N>()) else {
+        let Some(src) = pix.get(base + k * stride..).and_then(<[_]>::first_chunk::<N>) else {
             return;
         };
         for i in 0..N {
@@ -269,7 +269,7 @@ fn filter_horizontal<const N: usize>(pix: &mut [u8], stride: usize, x: usize, y:
     filter_lanes(&mut s, ep, chroma);
     let (k0, k1) = if chroma { (3, 5) } else { (1, 7) };
     for (k, row) in s.iter().enumerate().take(k1).skip(k0) {
-        let Some(dst) = pix.get_mut(base + k * stride..).and_then(|p| p.first_chunk_mut::<N>()) else {
+        let Some(dst) = pix.get_mut(base + k * stride..).and_then(<[_]>::first_chunk_mut::<N>) else {
             return;
         };
         for i in 0..N {

crates/h264/src/dpb.rs

@@ -327,12 +327,18 @@ impl Dpb {
                     had5 = true;
                 }
                 6 => {
-                    for e in &mut self.entries {
-                        if e.mark == RefMark::Long && e.long_term_frame_idx == m.long_term_frame_idx {
-                            e.mark = RefMark::Unused;
+                    let allowed = match self.max_long_term_frame_idx {
+                        Some(max) => m.long_term_frame_idx <= max,
+                        None => false,
+                    };
+                    if allowed {
+                        for e in &mut self.entries {
+                            if e.mark == RefMark::Long && e.long_term_frame_idx == m.long_term_frame_idx {
+                                e.mark = RefMark::Unused;
+                            }
                         }
+                        *cur_long = Some(m.long_term_frame_idx);
                     }
-                    *cur_long = Some(m.long_term_frame_idx);
                 }
                 _ => {}
             }
@@ -410,6 +416,11 @@ impl Dpb {
         } else {
             while self.entries.len() >= self.capacity {
                 if !self.bump(out) {
+                    if let Some(pos) = self.entries.iter().position(|e| !e.needed_for_output) {
+                        self.entries.remove(pos);
+                    } else {
+                        self.entries.remove(0);
+                    }
                     break;
                 }
             }

crates/h264/src/params.rs

@@ -1,7 +1,7 @@
 //! Sequence and picture parameter sets (7.3.2.1, 7.3.2.2) including VUI and scaling lists.
 
 use crate::error::{Result, ensure, unsupported};
-use crate::tables::*;
+use crate::tables::{DEFAULT_4X4_INTER, DEFAULT_4X4_INTRA, DEFAULT_8X8_INTER, DEFAULT_8X8_INTRA, ZIGZAG4, ZIGZAG8};
 use deckcraft_bitstream::BitReader;
 
 /// Scaling matrices after applying fall-back rules, stored in raster order (weightScale).

crates/h264/src/picture.rs

@@ -301,7 +301,7 @@ fn plane_allocator() -> fn(usize) -> Vec<u8> {
 fn copy_line<const N: usize>(line: &[u8], x0: i32, out: &mut [u8], w: usize) {
     if w <= N
         && x0 >= 0
-        && let Some(src) = line.get(x0 as usize..).and_then(|l| l.first_chunk::<N>())
+        && let Some(src) = line.get(x0 as usize..).and_then(<[_]>::first_chunk::<N>)
         && let Some(dst) = out.first_chunk_mut::<N>()
     {
         *dst = *src;

crates/h264/src/slicedec.rs

@@ -5,11 +5,11 @@ use crate::deblock;
 use crate::error::{Result, ensure, invalid};
 use crate::inter::{self, Weight};
 use crate::intra::{self, Avail};
-use crate::mbtypes::*;
+use crate::mbtypes::{CBP_ME, MbTypeInfo, Part, SubMbInfo, SubPart, b_mb_type, b_sub_mb_type, intra_mb_type, p_mb_type, p_sub_mb_type};
 use crate::params::{Pps, Sps};
-use crate::picture::*;
+use crate::picture::{Frame, FrameRef, MbKind, MbState, Planes, RefPic};
 use crate::slice::{SliceHeader, SliceType};
-use crate::tables::*;
+use crate::tables::{BLK4_XY, QPC_TABLE, RASTER_TO_BLK4, ZIGZAG4, ZIGZAG8};
 use crate::transform::{self, LevelScale};
 use deckcraft_bitstream::BitReader;
 
@@ -907,7 +907,7 @@ impl<'a> SliceDecoder<'a> {
         let stride = self.pic.planes.width;
         let px = self.mb_x * 16 + (raster & 3) * 4;
         let py = self.mb_y * 16 + (raster >> 2) * 4;
-        let Some(blk) = self.s.coef.get_mut(raster * 16..).and_then(|c| c.first_chunk_mut::<16>()) else {
+        let Some(blk) = self.s.coef.get_mut(raster * 16..).and_then(<[_]>::first_chunk_mut::<16>) else {
             return;
         };
         transform::idct4_add(blk, &mut self.pic.planes.y[py * stride + px..], stride);
@@ -921,7 +921,7 @@ impl<'a> SliceDecoder<'a> {
         let stride = self.pic.planes.width;
         let px = self.mb_x * 16 + (b8 & 1) * 8;
         let py = self.mb_y * 16 + (b8 >> 1) * 8;
-        let Some(blk) = self.s.coef.get_mut(b8 * 64..).and_then(|c| c.first_chunk_mut::<64>()) else {
+        let Some(blk) = self.s.coef.get_mut(b8 * 64..).and_then(<[_]>::first_chunk_mut::<64>) else {
             return;
         };
         transform::idct8_add(blk, &mut self.pic.planes.y[py * stride + px..], stride);
@@ -940,7 +940,7 @@ impl<'a> SliceDecoder<'a> {
                 }
                 let px = self.mb_x * 8 + (b & 1) * 4;
                 let py = self.mb_y * 8 + (b >> 1) * 4;
-                let Some(blk) = self.s.coef_c[c].get_mut(b * 16..).and_then(|c| c.first_chunk_mut::<16>()) else {
+                let Some(blk) = self.s.coef_c[c].get_mut(b * 16..).and_then(<[_]>::first_chunk_mut::<16>) else {
                     continue;
                 };
                 let plane = if c == 0 { &mut self.pic.planes.cb } else { &mut self.pic.planes.cr };

crates/h264/src/synth_tests.rs

@@ -107,7 +107,7 @@ struct Pic {
 
 impl Pic {
     fn is_p(&self) -> bool {
-        !self.idr && !self.b && self.mbs.iter().any(|m| m.is_none())
+        !self.idr && !self.b && self.mbs.iter().any(Option::is_none)
     }
     fn inter(&self) -> bool {
         self.b || self.is_p()

crates/h264/src/transform.rs

@@ -91,11 +91,21 @@ fn clip_u8(v: i32) -> u8 {
     v.clamp(0, 255) as u8
 }
 
+/// A dequantised coefficient the inverse transforms are defined for: the dequantisation wraps
+/// by design (see [`huge_levels_dequantise_without_overflow_panics`]), so their butterflies
+/// clamp an r outside −2^15..2^15−1 to this range — where the spec leaves the output
+/// unspecified anyway (8.5.12.1, 8.5.13.1) — instead of overflowing the plain i32 additions.
+#[inline(always)]
+fn r_clamp(v: i32) -> i32 {
+    v.clamp(-(1 << 15), (1 << 15) - 1)
+}
+
 /// Inverse 4x4 transform of raster-order `d` and add to `dst` (8.5.12.2, 8.5.14).
 ///
 /// Rows first, then columns (the spec's order: the `>> 1` steps make it matter). The column
 /// pass and the reconstruction run across all columns at once so they vectorise.
 pub fn idct4_add(d: &[i32; 16], dst: &mut [u8], stride: usize) {
+    let d: [i32; 16] = std::array::from_fn(|i| r_clamp(d[i]));
     let mut t = [[0i32; 4]; 4];
     for (i, row) in t.iter_mut().enumerate() {
         let r = &d[i * 4..i * 4 + 4];
@@ -117,7 +127,7 @@ pub fn idct4_add(d: &[i32; 16], dst: &mut [u8], stride: usize) {
         o[3][j] = e - h;
     }
     for (i, row) in o.iter().enumerate() {
-        let Some(line) = dst.get_mut(i * stride..).and_then(|d| d.first_chunk_mut::<4>()) else {
+        let Some(line) = dst.get_mut(i * stride..).and_then(<[_]>::first_chunk_mut::<4>) else {
             return;
         };
         for (p, &v) in line.iter_mut().zip(row) {
@@ -161,6 +171,7 @@ fn idct8_1d(d: [i32; 8]) -> [i32; 8] {
 /// Inverse 8x8 transform of raster-order `d` and add to `dst` (8.5.13.2): rows, then columns,
 /// the column pass and reconstruction across all columns at once (they vectorise).
 pub fn idct8_add(d: &[i32; 64], dst: &mut [u8], stride: usize) {
+    let d: [i32; 64] = std::array::from_fn(|i| r_clamp(d[i]));
     let mut t = [[0i32; 8]; 8];
     for (row, src) in t.iter_mut().zip(d.as_chunks::<8>().0) {
         *row = idct8_1d(*src);
@@ -173,7 +184,7 @@ pub fn idct8_add(d: &[i32; 64], dst: &mut [u8], stride: usize) {
         }
     }
     for (i, row) in o.iter().enumerate() {
-        let Some(line) = dst.get_mut(i * stride..).and_then(|d| d.first_chunk_mut::<8>()) else {
+        let Some(line) = dst.get_mut(i * stride..).and_then(<[_]>::first_chunk_mut::<8>) else {
             return;
         };
         for (p, &v) in line.iter_mut().zip(row) {
@@ -304,4 +315,32 @@ mod tests {
         let _ = scale8(i32::MIN, 16 * 25, 51);
         let _ = scale8(i32::MIN, 16 * 25, 0);
     }
+
+    /// The same wrapping dequantisation hands the inverse transforms any i32 coefficient, and
+    /// their butterflies add in plain i32: `i32::MAX + i32::MAX` panicked a debug build. The
+    /// spec leaves the transforms' output unspecified when a dequantised value falls outside
+    /// −2^15..2^15−1 (8.5.12.1, 8.5.13.1), so those inputs are clamped to that range —
+    /// bit-exact for every stream inside it — instead of panicking.
+    #[test]
+    fn huge_coefficients_are_clamped_to_the_spec_r_range() {
+        assert_eq!(r_clamp(-32769), -32768);
+        assert_eq!(r_clamp(-32768), -32768);
+        assert_eq!(r_clamp(32767), 32767);
+        assert_eq!(r_clamp(32768), 32767);
+        let clamp = |v: i32| v.clamp(-(1 << 15), (1 << 15) - 1);
+        for d in [[i32::MAX; 16], [i32::MIN; 16], std::array::from_fn(|i| if i % 2 == 0 { i32::MIN } else { i32::MAX })] {
+            let clamped = std::array::from_fn(|i| clamp(d[i]));
+            let (mut a, mut b) = ([0u8; 64], [0u8; 64]);
+            idct4_add(&d, &mut a, 8);
+            idct4_add(&clamped, &mut b, 8);
+            assert_eq!(a, b, "idct4 of extremes equals idct4 of the spec range");
+        }
+        for d in [[i32::MIN; 64], [i32::MAX; 64]] {
+            let clamped = std::array::from_fn(|i| clamp(d[i]));
+            let (mut a, mut b) = ([0u8; 64], [0u8; 64]);
+            idct8_add(&d, &mut a, 8);
+            idct8_add(&clamped, &mut b, 8);
+            assert_eq!(a, b, "idct8 of extremes equals idct8 of the spec range");
+        }
+    }
 }

crates/hevc/src/decoder.rs

@@ -440,11 +440,22 @@ impl Decoder {
         let template = Frame::new(0, 0, w, h, sps.log2_ctb, sps.bit_depth_luma, sps.bit_depth_chroma);
         let next_id = &mut self.next_id;
         let mut missing = 0u64;
+        let max_missing = (sps.max_dec_pic_buffering as u64).clamp(1, 16);
+        let mut shared_gray: Option<FrameRef> = None;
         let mut make_missing = |p: i32| -> FrameRef {
             missing += 1;
+            if missing > max_missing
+                && let Some(ref g) = shared_gray
+            {
+                return g.clone();
+            }
             let id = *next_id;
             *next_id += 1;
-            Arc::new(Frame::gray(id, p, &template))
+            let f = Arc::new(Frame::gray(id, p, &template));
+            if shared_gray.is_none() {
+                shared_gray = Some(f.clone());
+            }
+            f
         };
         let rps = self.dpb.apply_rps(sh, poc, max_lsb, irap_no_rasl, &mut make_missing)?;
         if missing > 0 {