diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d5b820d2..d0d1fd87 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,10 +1,7 @@
-# The CLAUDE.md quality gate (`cargo xtask ci`: fmt, clippy -D warnings, tests, assets, layers,
-# wasm) on every pull request and every push to main. Today only path-filtered workflows run on
-# pull requests, so most PRs land with no test run at all.
-#
-# Ported from wordcraft#800. Linux only; standard GitHub-hosted runner, no secrets.
 name: CI
 
+# Quality gates for every push to main and every pull request (`cargo xtask ci`), through the
+# suite's shared gate workflow in craft-common-actions.
 on:
   push:
     branches: [main]
@@ -14,58 +11,19 @@ on:
 permissions:
   contents: read
 
+# A newer push to a PR branch cancels its older run; every push to main runs to the end.
 concurrency:
-  group: ci-${{ github.ref }}
+  group: ci-${{ github.event_name == 'pull_request' && github.ref || github.run_id }}
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
-env:
-  # Same craft-fonts commit as release.yml, so the font tests see what a release build embeds.
-  CRAFT_FONTS_REF: abb83316d96aa59c1cf64784289e378fe9fa5695
-
 jobs:
   gate:
-    name: cargo xtask ci
-    runs-on: ubuntu-24.04
-    timeout-minutes: 90
-    env:
-      CARGO_TERM_COLOR: always
-      CARGO_INCREMENTAL: "0"
-      RUST_BACKTRACE: "1"
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
-
-      - name: Check out craft-fonts
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          repository: storytold/craft-fonts
-          ref: ${{ env.CRAFT_FONTS_REF }}
-          path: craft-fonts
-          persist-credentials: false
-
-      - name: Install Linux build dependencies
-        uses: storytold/craft-common-actions/actions/install-apt-packages@main
-        with:
-          packages: >-
-            pkg-config libxkbcommon-dev libwayland-dev libx11-dev libxcb1-dev libxcursor-dev
-            libxrandr-dev libxi-dev libfontconfig1-dev libfreetype-dev mesa-vulkan-drivers
-
-      - name: Install Rust (stable + clippy, rustfmt, wasm32)
-        run: |
-          rustup toolchain install stable --profile minimal --component clippy,rustfmt \
-            --target wasm32-unknown-unknown
-          rustup default stable
-
-      - uses: taiki-e/install-action@f7e5d7c961414b23f5b25b2da9294395d08513ad # v2.87.26
-        with:
-          tool: cargo-nextest@0.9.145
-
-      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
-        with:
-          save-if: ${{ github.ref == 'refs/heads/main' }}
-
-      - name: Quality gate
-        env:
-          CRAFT_FONTS_DIR: ${{ github.workspace }}/craft-fonts
-        run: cargo xtask ci
+    # Tracks @main so suite-wide CI fixes reach every app without a PR in each repository.
+    uses: storytold/craft-common-actions/.github/workflows/gate.yml@main
+    with:
+      # Same craft-fonts commit as release.yml.
+      craft-fonts-ref: a71c20e30af613287c504f7e685ca8fad77752bc
+      timeout-minutes: 90
+      packages: >-
+        pkg-config libxkbcommon-dev libwayland-dev libx11-dev libxcb1-dev libxcursor-dev
+        libxrandr-dev libxi-dev libfontconfig1-dev libfreetype-dev mesa-vulkan-drivers
diff --git a/.github/workflows/freebsd.yml b/.github/workflows/freebsd.yml
index e60c2bdf..d6b897ce 100644
--- a/.github/workflows/freebsd.yml
+++ b/.github/workflows/freebsd.yml
@@ -2,16 +2,17 @@
 # (GitHub has no FreeBSD runners). GPU tests skip themselves when the VM has no adapter.
 name: FreeBSD
 
+# The VM build is slow, so it runs nightly on main and on pushes to `release`, not on every pull
+# request: a drifted dependency still shows up within a day, and always before a release ships.
+# PRs that change the FreeBSD workflow itself still run it.
 on:
   push:
-    branches: [main]
+    branches: [release]
   pull_request:
     paths:
-      - Cargo.toml
-      - Cargo.lock
-      - "**/Cargo.toml"
-      - "crates/fonts/**"
       - .github/workflows/freebsd.yml
+  schedule:
+    - cron: "27 2 * * *"
   workflow_dispatch:
 
 concurrency:
@@ -26,4 +27,4 @@ jobs:
     # Intentionally tracked at @main (not SHA-pinned) so org-wide CI improvements, security fixes, and build optimizations propagate without PR churn across all craftapp repos.
     uses: storytold/craft-common-actions/.github/workflows/freebsd.yml@main
     with:
-      craft-fonts-ref: abb83316d96aa59c1cf64784289e378fe9fa5695
+      craft-fonts-ref: a71c20e30af613287c504f7e685ca8fad77752bc
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 57eb9bb5..f65960f2 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -11,20 +11,65 @@ on:
         default: ""
 
 permissions:
-  contents: write
+  contents: read
 
 concurrency:
   group: release-${{ github.ref }}
   cancel-in-progress: false
 
 jobs:
+  git-sources:
+    name: Git dependencies come from storytold
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Git dependencies come from storytold
+        run: |
+          set -euo pipefail
+          test -f Cargo.lock || { echo "Cargo.lock is missing"; exit 1; }
+          # Source replacement, patches and path overrides in cargo config never show up
+          # in Cargo.lock. Parsed rather than grepped: TOML has many spellings of one key.
+          # Cargo still reads the legacy .cargo/config.
+          python3 - <<'PY'
+          import os, sys, tomllib
+          for path in (".cargo/config", ".cargo/config.toml"):
+              if not os.path.exists(path):
+                  continue
+              config = tomllib.load(open(path, "rb"))
+              replaced = [name for name, source in config.get("source", {}).items()
+                          if isinstance(source, dict) and "replace-with" in source]
+              if replaced or "patch" in config or "paths" in config:
+                  print(f"{path} replaces, patches or overrides a source")
+                  sys.exit(1)
+          PY
+          # Fails when Cargo.lock is out of date with the manifests.
+          cargo metadata --locked --format-version 1 > /dev/null
+          python3 - <<'PY'
+          import sys, tomllib
+          lock = tomllib.load(open("Cargo.lock", "rb"))
+          bad = sorted({p["source"] for p in lock.get("package", [])
+                        if p.get("source", "").startswith("git+")
+                        and not p["source"].startswith("git+https://github.com/storytold/")})
+          if bad:
+              print("Git dependencies outside github.com/storytold:", *bad, sep="\n")
+              sys.exit(1)
+          PY
+
   release:
+    needs: git-sources
+    permissions:
+      contents: write
     # Intentionally tracked at @main (not SHA-pinned) so org-wide CI improvements, security fixes, and build optimizations propagate without PR churn across all craftapp repos.
     uses: storytold/craft-common-actions/.github/workflows/release.yml@main
     with:
       app-name: designcraft
       app-title: DesignCraft
-      craft-fonts-ref: abb83316d96aa59c1cf64784289e378fe9fa5695
+      craft-fonts-ref: a71c20e30af613287c504f7e685ca8fad77752bc
+      web-craft-fonts: true
       version: ${{ inputs.version }}
     secrets:
       APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
diff --git a/.github/workflows/sonarcloud.yml b/.github/workflows/sonarcloud.yml
index ecee45a6..e78fe1ea 100644
--- a/.github/workflows/sonarcloud.yml
+++ b/.github/workflows/sonarcloud.yml
@@ -11,7 +11,8 @@ permissions:
 
 concurrency:
   group: sonarcloud-${{ github.ref }}
-  cancel-in-progress: true
+  # A push to main is the run that publishes coverage; superseded runs there would never finish.
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
 
 jobs:
   sonarcloud:
diff --git a/.github/workflows/windows-arm64.yml b/.github/workflows/windows-arm64.yml
index ed7060b9..85856800 100644
--- a/.github/workflows/windows-arm64.yml
+++ b/.github/workflows/windows-arm64.yml
@@ -4,19 +4,17 @@
 # out for now: PdfCraft saw an intermittent access violation in egui UI tests there.)
 name: Windows ARM64
 
+# Nightly on main and on pushes to `release` (dependency and runner-image drift shows up within a
+# day, and always before a release ships), and on PRs that change the Windows packaging itself.
 on:
+  schedule:
+    - cron: "3 5 * * *"
   push:
-    branches: [main]
+    branches: [release]
   pull_request:
     paths:
-      - Cargo.toml
-      - Cargo.lock
-      - "**/Cargo.toml"
-      - "**/build.rs"
       - .github/workflows/windows-arm64.yml
       - packaging/windows/**
-  schedule:
-    - cron: "41 4 * * 1" # weekly, so drift in the runner images shows up
   workflow_dispatch:
 
 concurrency:
diff --git a/Cargo.lock b/Cargo.lock
index e75e8d5a..beb1f6f8 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -841,7 +841,7 @@ source = "git+https://github.com/storytold/craft-libs?rev=82a24b006eefa036b43c09
 [[package]]
 name = "craft-pdf"
 version = "0.1.0"
-source = "git+https://github.com/storytold/craft-libs?rev=89dcbb3060377a26c99a6d80caa16084366704c4#89dcbb3060377a26c99a6d80caa16084366704c4"
+source = "git+https://github.com/storytold/craft-libs?rev=9f75d3dc19b4b514c4f3d4847ed1ec1b0e86b4ef#9f75d3dc19b4b514c4f3d4847ed1ec1b0e86b4ef"
 dependencies = [
  "bytemuck",
  "hayro",
@@ -2123,7 +2123,7 @@ dependencies = [
 [[package]]
 name = "hayro"
 version = "0.7.1"
-source = "git+https://github.com/storytold/craft-libs?rev=89dcbb3060377a26c99a6d80caa16084366704c4#89dcbb3060377a26c99a6d80caa16084366704c4"
+source = "git+https://github.com/storytold/craft-libs?rev=9f75d3dc19b4b514c4f3d4847ed1ec1b0e86b4ef#9f75d3dc19b4b514c4f3d4847ed1ec1b0e86b4ef"
 dependencies = [
  "bytemuck",
  "hayro-interpret",
@@ -2143,8 +2143,7 @@ checksum = "9f4d0e94ddd48749f06bbe4e5389fb9799a0c45bcaf00495042076ef05e3241a"
 [[package]]
 name = "hayro-cmap"
 version = "0.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "24d285dc30731c8485de5fa732fbdf2b3affdf01e4da7c2135022ca6fa664bf6"
+source = "git+https://github.com/storytold/craft-libs?rev=9f75d3dc19b4b514c4f3d4847ed1ec1b0e86b4ef#9f75d3dc19b4b514c4f3d4847ed1ec1b0e86b4ef"
 dependencies = [
  "brotli",
  "hayro-postscript",
@@ -2153,7 +2152,7 @@ dependencies = [
 [[package]]
 name = "hayro-interpret"
 version = "0.7.0"
-source = "git+https://github.com/storytold/craft-libs?rev=89dcbb3060377a26c99a6d80caa16084366704c4#89dcbb3060377a26c99a6d80caa16084366704c4"
+source = "git+https://github.com/storytold/craft-libs?rev=9f75d3dc19b4b514c4f3d4847ed1ec1b0e86b4ef#9f75d3dc19b4b514c4f3d4847ed1ec1b0e86b4ef"
 dependencies = [
  "bitflags 2.13.2",
  "hayro-cmap",
@@ -2171,7 +2170,7 @@ dependencies = [
 [[package]]
 name = "hayro-jbig2"
 version = "0.3.0"
-source = "git+https://github.com/storytold/craft-libs?rev=89dcbb3060377a26c99a6d80caa16084366704c4#89dcbb3060377a26c99a6d80caa16084366704c4"
+source = "git+https://github.com/storytold/craft-libs?rev=9f75d3dc19b4b514c4f3d4847ed1ec1b0e86b4ef#9f75d3dc19b4b514c4f3d4847ed1ec1b0e86b4ef"
 dependencies = [
  "fearless_simd",
  "hayro-ccitt",
@@ -2195,7 +2194,7 @@ checksum = "885c5ef0654933139a9b9546fc2c69e18d37f38aa2520f079092b1be18f1fcaa"
 [[package]]
 name = "hayro-syntax"
 version = "0.7.2"
-source = "git+https://github.com/storytold/craft-libs?rev=89dcbb3060377a26c99a6d80caa16084366704c4#89dcbb3060377a26c99a6d80caa16084366704c4"
+source = "git+https://github.com/storytold/craft-libs?rev=9f75d3dc19b4b514c4f3d4847ed1ec1b0e86b4ef#9f75d3dc19b4b514c4f3d4847ed1ec1b0e86b4ef"
 dependencies = [
  "flate2",
  "hayro-ccitt",
@@ -2559,7 +2558,7 @@ dependencies = [
 [[package]]
 name = "krilla"
 version = "0.8.2"
-source = "git+https://github.com/storytold/craft-libs?rev=89dcbb3060377a26c99a6d80caa16084366704c4#89dcbb3060377a26c99a6d80caa16084366704c4"
+source = "git+https://github.com/storytold/craft-libs?rev=9f75d3dc19b4b514c4f3d4847ed1ec1b0e86b4ef#9f75d3dc19b4b514c4f3d4847ed1ec1b0e86b4ef"
 dependencies = [
  "base64",
  "bumpalo",
diff --git a/Cargo.toml b/Cargo.toml
index 8a83e046..0245708f 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -12,7 +12,7 @@ repository = "https://github.com/storytold/designcraft"
 
 [workspace.dependencies]
 # Shared reader and writer; publish the immutable revision before this consumer.
-craft-pdf = { git = "https://github.com/storytold/craft-libs", rev = "89dcbb3060377a26c99a6d80caa16084366704c4", version = "=0.1.0", default-features = false }
+craft-pdf = { git = "https://github.com/storytold/craft-libs", rev = "9f75d3dc19b4b514c4f3d4847ed1ec1b0e86b4ef", version = "=0.1.0", default-features = false }
 # internal
 designcraft-geom = { path = "crates/geom" }
 designcraft-color = { path = "crates/color" }
@@ -122,9 +122,10 @@ debug = 0
 
 # Opt-in cancelable macOS termination on the pinned winit 0.30 line.
 [patch.crates-io]
-krilla = { git = "https://github.com/storytold/craft-libs", rev = "89dcbb3060377a26c99a6d80caa16084366704c4", version = "=0.8.2" }
+krilla = { git = "https://github.com/storytold/craft-libs", rev = "9f75d3dc19b4b514c4f3d4847ed1ec1b0e86b4ef", version = "=0.8.2" }
 winit = { git = "https://github.com/storytold/winit.git", rev = "3d51077fd1a966f84df9ef287839dc84fd5b4ca7" }
-hayro = { git = "https://github.com/storytold/craft-libs", rev = "89dcbb3060377a26c99a6d80caa16084366704c4", version = "=0.7.1" }
-hayro-interpret = { git = "https://github.com/storytold/craft-libs", rev = "89dcbb3060377a26c99a6d80caa16084366704c4", version = "=0.7.0" }
-hayro-syntax = { git = "https://github.com/storytold/craft-libs", rev = "89dcbb3060377a26c99a6d80caa16084366704c4", version = "=0.7.2" }
-hayro-jbig2 = { git = "https://github.com/storytold/craft-libs", rev = "89dcbb3060377a26c99a6d80caa16084366704c4", version = "=0.3.0" }
+hayro = { git = "https://github.com/storytold/craft-libs", rev = "9f75d3dc19b4b514c4f3d4847ed1ec1b0e86b4ef", version = "=0.7.1" }
+hayro-interpret = { git = "https://github.com/storytold/craft-libs", rev = "9f75d3dc19b4b514c4f3d4847ed1ec1b0e86b4ef", version = "=0.7.0" }
+hayro-syntax = { git = "https://github.com/storytold/craft-libs", rev = "9f75d3dc19b4b514c4f3d4847ed1ec1b0e86b4ef", version = "=0.7.2" }
+hayro-jbig2 = { git = "https://github.com/storytold/craft-libs", rev = "9f75d3dc19b4b514c4f3d4847ed1ec1b0e86b4ef", version = "=0.3.0" }
+hayro-cmap = { git = "https://github.com/storytold/craft-libs", rev = "9f75d3dc19b4b514c4f3d4847ed1ec1b0e86b4ef", version = "=0.1.0" }
diff --git a/NOTICE b/NOTICE
index f1e99715..71abff77 100644
--- a/NOTICE
+++ b/NOTICE
@@ -92,14 +92,15 @@ No Adobe icons, images or artwork are included.
 
 PDF backend source
 
-The patched hayro 0.7.1, hayro-interpret 0.7.0, hayro-syntax 0.7.2 and hayro-jbig2 0.3.0
-are fetched from https://github.com/storytold/craft-libs at revision
-89dcbb3060377a26c99a6d80caa16084366704c4. The four source snapshots were transferred
+The patched hayro 0.7.1, hayro-interpret 0.7.0, hayro-syntax 0.7.2, hayro-jbig2 0.3.0 and
+hayro-cmap 0.1.0 are fetched from https://github.com/storytold/craft-libs at revision
+9f75d3dc19b4b514c4f3d4847ed1ec1b0e86b4ef. The first four source snapshots were transferred
 from https://github.com/storytold/pdfcraft at revision
-7437bde378f43856eada40af25b983812e615e8a, then patched in craft-libs. Their upstream project is
+7437bde378f43856eada40af25b983812e615e8a and hayro-cmap at revision
+a2ec27b4775f53c40cad3456936d9406611e3a8d, then patched in craft-libs. Their upstream project is
 https://github.com/LaurenzV/hayro, licensed MIT OR Apache-2.0. The snapshot retains each
 crate's upstream licence files. The patch ledger is at
-https://github.com/storytold/craft-libs/blob/89dcbb3060377a26c99a6d80caa16084366704c4/vendor/README.craft-reader.md.
+https://github.com/storytold/craft-libs/blob/9f75d3dc19b4b514c4f3d4847ed1ec1b0e86b4ef/vendor/README.craft-reader.md.
 Per-crate vendor/SOURCE.json files record transferred and local source hashes; asset
 origins and unchanged per-file hashes are recorded separately in ASSETS.md.
 
diff --git a/ROADMAP.md b/ROADMAP.md
index 0b12be18..15355591 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -11,6 +11,9 @@
 
 DesignCraft aims at full Adobe InDesign parity — and to be better: faster, open (documented JSON format + IDML), scriptable by agents (MCP), and available on the web.
 
+- **2026-10-23** · PDF layer choices now validate before editing all targets; rejected rewrites
+  leave document/undo state intact. Null trailer entries remain unencrypted, and unsupported
+  all-content crops retain the whole page rather than silently clipping hidden layers.
 - **2026-10-23** · PDF layer visibility variants retain catalog/configuration entries and full
   object references; bounded incremental updates replace the existing catalog. Synthetic
   regression tests cover metadata, output-intent references, nonzero generations and
@@ -47,7 +50,7 @@ DesignCraft aims at full Adobe InDesign parity — and to be better: faster, ope
 - Graphics backend chosen before the window exists (DirectX 12 on Windows, Vulkan on Linux, Metal on macOS, OpenGL as the fallback; `WGPU_BACKEND` overrides) with a start-up fallback: a backend whose start never showed a frame is skipped at the next start and the status bar says so (`gpu.json`). Found on an AMD hybrid-graphics laptop whose Vulkan driver faulted at the first present.
 - Edit › Paste Into (copied objects become a frame's content, clipped by it; rendered, PDF and IDML both ways — verified in InDesign 2026); Polygon Settings (sides, star inset; double-click the Polygon tool).
 - Color panel (fill/stroke proxy, CMYK/RGB/Lab sliders with channel ramps, tint slider for swatches, spectrum ramp, Add to Swatches) and Color Picker (double-click the proxy); mixed colours are unnamed (not listed in Swatches until added); `object.color`, `swatch.addToSwatches`, `swatch.addUnnamed`.
-- Place text files: Word (.docx: styles by name with their attributes, bold/italic/underline/size/font, footnotes, tables, tabs, breaks), RTF and plain text, into the insertion point, the selected frame or a new frame; autoflow adds pages and threaded frames until the text fits; Remove Styles option (`designcraft-textimport`).
+- Place text files: Word (.docx: styles by name with their attributes, bold/italic/underline/size/font, footnotes, tables, tabs, breaks), RTF and plain text, into the insertion point, the selected frame or a new frame; autoflow threads frames on the pages that follow, then adds pages at the end of the document until the text fits; Remove Styles option (`designcraft-textimport`).
 - Gradient Feather (⇧G tool, `object.gradientFeather`): objects fade along a linear or radial opacity gradient, on screen and as a soft mask in PDF.
 - Script Label (`object.label`, `object.findByLabel`), alt text (`object.altText`), Isolate Blending / Knockout Group (`object.transparencyGroup`; on screen, PDF isolates), Table ▸ Sort (`table.sortRows`, numeric-aware, header/footer fixed).
 - File ▸ Export Text (`file.exportText`): a story as Text Only or RTF (fonts, styles, alignment, indents, tables as tab-separated rows); Export EPUB now asks for a path in the UI.
@@ -306,6 +309,8 @@ measured); Ready estimated.
 ## Languages
 
 Interface strings translated, of 1,724 measured. Detail: [docs/localization-parity.md](docs/localization-parity.md).
+A string without a translation shows in English and fails no check; `cargo xtask i18n-report`
+(also a `cargo xtask ci` step) lists the missing strings per language.
 
 | Language | Code | Status | Translated |
 |---|---|---|---|
@@ -353,12 +358,22 @@ list) · [roadmap.md](docs/roadmap.md) (milestones, plan) · [parity-checklist.m
 
 Newest first.
 
+- **2026-10-24** · Custom-positioned anchored objects honour Relative to Spine (`anchored.options {spineRelative}`, IDML `SpineRelative`): the settings describe a left-hand page and mirror on a right-hand page, so marginal notes stay in the outside margin on both pages of a spread. On right-hand pages they took the left-hand placement and landed in the inside margin, across the spine or over the body text. No readiness percentage change.
+- **2026-10-23** · Save and export dialogs (Save As, Save a Copy, Export PDF and the other exports, Package, libraries and books) start in the active document's folder once it has been saved, and for a document never saved in the folder of the last file saved or exported, remembered across sessions (#1653). A folder deleted since falls back to the system's choice. No readiness percentage change.
+- **2026-10-22** · Autoflow (Shift-click with the loaded text cursor, autoflow on Place, `text.thread {autoflow}`) fills the pages that follow before it adds any, as InDesign does: one frame per column on each following page, whatever else the page holds, then new pages at the end of the document. It inserted pages right after the story's last frame, in front of the document's own pages. Frames it set past the end of the text go again; a page the document had stays, and a page autoflow added only for such a frame goes with it. Smart Text Reflow of the primary text frame is unchanged. No readiness percentage change.
 - **2026-10-16** · Edit › Keyboard Shortcuts imports a set saved by InDesign's Show Set (.txt, Windows or Mac key names, UTF-8 or UTF-16): matched commands take its Default shortcuts or lose theirs, other commands give up keys it takes, and a report lists what it changed and the items it could not match (`window.importShortcuts`, #1180). Tool keys stay fixed. No readiness percentage change.
+- **2026-10-23** · Translations: a missing string shows in English and fails no test; `cargo xtask i18n-report`, run by `cargo xtask ci`, prints the missing strings per language. Tests keep duplicate-key and placeholder checks and the language mechanics (lookup, context captions, plural captions, right-to-left). No readiness percentage change.
 - **2026-10-22** · A ruler guide dragged with the Selection tools, out of a ruler, on its own or with other selected guides, snaps along its axis as objects do (#1221): to other ruler guides, margins, columns, bleed, page and object edges and centers (with the smart-guide mark) and the document grid, within the snap zone and following Snap to Guides and Smart Guides. Shift snaps to the ruler's ticks and Cmd suspends snapping. The preview line, the position readout and the drop use the same snapped position. No readiness percentage change.
 - **2026-10-22** · macOS: the app menu has a Language submenu after Settings… with each interface language in its own name and the current one checked, as in the suite's other apps; Preferences › General › Interface Language stays. No readiness percentage change.
 - **2026-10-22** · macOS menu bar: the menus keep working after the interface language or Show CJK Features changes (a rebuilt menu bar lost every click, Quit included), and its key equivalents are the shortcuts in effect, so a shortcut moved in the Keyboard Shortcuts editor leaves its old menu item. No readiness percentage change.
 - **2026-10-22** · Paragraph rules: Rule Above's offset is measured from the first line's baseline to the rule's bottom edge, as in InDesign. Rules sat one ascent too high and crossed the previous paragraph's text (reported from an imported INDD document). No readiness percentage change.
 - **2026-10-21** · Ruler guides are selected like objects (#1282): a click with the Selection tools selects a guide (also where it crosses an object), Shift-click adds or removes one, a new guide from the rulers is selected, a marquee that touches no object selects the guides it crosses, and Edit › Select All Guides (⌥⌘G, `guide.selectAll`) selects every unlocked guide on the spread. Selected guides draw thicker in their layer's color, drag together (all of them shown moving), nudge with the arrow keys and go with Delete, each as one undo step (`guide.select`, `guide.deselect`, `guide.moveBy`, `guide.delete {}`). With one guide selected the Control bar's X (vertical guide) or Y (horizontal guide) field and Properties › Transform show where it is, as the rulers measure, and typing a value moves it there. No readiness percentage change.
+- **2026-10-17** · PDF/X-4 export warns about fonts drawing visible text without an embedded
+  font program, including placed PDF forms; `validate-pdf` reports the font and page (#909).
+  Invisible OCR text is exempt. Detection only: fonts are not embedded or outlined automatically.
+  Repeated forms reuse context-aware font findings; a document-wide operation limit and a form-nesting depth limit
+  report incomplete checks instead of allowing excessive nested-form traversal.
+  No readiness percentage change.
 - **2026-10-16** · Selection: drag a column guide to move its gutter, as in InDesign (#1096). Both guides of the gutter move together and keep its width, stop at the neighbouring guides and the margins, and snap to the document grid, guides and objects, or with Shift to the ruler's tick marks; Escape cancels and the drag is one undo step. Locked column guides (the default) are not picked. A document page takes the result as its own columns; on a parent page it passes to the pages that follow it. `layout.moveColumnGuide` does the same over the control channel and MCP. No readiness percentage change.
 - **2026-10-16** · Layout: autoflow, inserted pages and new parents follow dragged column guides (#1096). Autoflow sets one frame per dragged column and counts the pages it adds from them; Insert Pages and New Parent keep the custom positions with the column count and gutter; a page that moves to the other side of the spine (inserted, deleted or moved pages, Duplicate Spread, a new parent's other page) has them mirrored across its margin box, as InDesign does; `document.inspect` reports each page's gutter, column rects and whether its columns are custom. No readiness percentage change.
 - **2026-10-16** · Layout: Margins and Columns keeps dragged column guides unless the column count or gutter changes (#1096). The dialog sends every field on OK, so a margin-only change re-divided the columns evenly. Margin changes keep the positions; the columns follow them only while they fit the margin box. No readiness percentage change.
diff --git a/apps/designcraft-cli/src/main.rs b/apps/designcraft-cli/src/main.rs
index 71e05a48..0c0a1526 100644
--- a/apps/designcraft-cli/src/main.rs
+++ b/apps/designcraft-cli/src/main.rs
@@ -39,7 +39,7 @@ use designcraft_engine::Session;
 use serde_json::{Value, json};
 
 /// The usage block. Shared by `--help` (stdout, success) and an unknown command (stderr, failure).
-const USAGE: &str = "usage: designcraft-cli run [--in FILE | --sample] [--cmd ID[=JSON]]... [--page N] [--scale S] [--pdf-options JSON] [--export OUT] [--all-pages DIR]\n         (--page, --scale and --pdf-options apply to the exports that follow them)\n       designcraft-cli commands [FILTER]\n       designcraft-cli describe COMMAND\n       designcraft-cli script [FILE|-] [--in FILE | --sample] [--connect PORT] [--save OUT] [--export OUT] [--keep-going]\n       designcraft-cli app [--port PORT] COMMAND [JSON] | --method METHOD [JSON]\n       designcraft-cli mcp [--connect PORT] [--sample] [--automation-read-root DIR] [--automation-write-root DIR]\n         the two roots confine every file the agent's commands read (open, placed images, data sources, libraries) and\n         write (save, export, package) to those folders, links followed. A root left out grants none of its access.\n         They run the in-process server, so they conflict with --connect (a running app is not confined by them).\n       designcraft-cli perf [--pages N] [--runs N] [--strict]\n       designcraft-cli bench FILE [--runs N]\n       designcraft-cli links\n       designcraft-cli --version";
+const USAGE: &str = "usage: designcraft-cli run [--in FILE | --sample] [--cmd ID[=JSON]]... [--page N] [--scale S] [--pdf-options JSON] [--export OUT] [--all-pages DIR]\n         (--page, --scale and --pdf-options apply to the exports that follow them)\n       designcraft-cli commands [FILTER]\n       designcraft-cli describe COMMAND\n       designcraft-cli script [FILE|-] [--in FILE | --sample] [--connect PORT] [--save OUT] [--export OUT] [--keep-going]\n       designcraft-cli app [--port PORT] COMMAND [JSON] | --method METHOD [JSON]\n       designcraft-cli mcp [--connect PORT] [--sample] [--automation-read-root DIR] [--automation-write-root DIR]\n         the two roots confine every file the agent's commands read (open, placed images, data sources, libraries) and\n         write (save, export, package) to those folders, links followed. A root left out grants none of its access.\n         They run the in-process server, so they conflict with --connect (a running app is not confined by them).\n       designcraft-cli perf [--pages N] [--runs N] [--strict]\n       designcraft-cli bench FILE [--runs N]\n       designcraft-cli validate-pdf FILE.pdf  # built-in PDF/X-4 checks (including visible unembedded fonts)\n       designcraft-cli links\n       designcraft-cli --version";
 
 /// `script --help`: the script syntax, otherwise only in `describe script.run` and docs/agents.md.
 const SCRIPT_HELP: &str = r#"usage: designcraft-cli script [FILE|-] [--in FILE | --sample] [--connect PORT] [--save OUT] [--export OUT] [--keep-going]
diff --git a/apps/designcraft/src/gpu/backend.rs b/apps/designcraft/src/gpu/backend.rs
index 0a3cda61..6aa250dd 100644
--- a/apps/designcraft/src/gpu/backend.rs
+++ b/apps/designcraft/src/gpu/backend.rs
@@ -231,7 +231,21 @@ impl Fallback {
                 choice.backend.name(),
                 choice.record.failed
             ),
-            None => log::info!("graphics: {} (WGPU_BACKEND overrides)", choice.backend.name()),
+            // Not a switch from an unfinished start. `begin` has already returned when
+            // `WGPU_BACKEND` names a backend, so wgpu is not being told which to use here -- an
+            // empty or unrecognised value is no choice and reaches this line like an unset one.
+            // The message used to say the environment had been asked, which reads in a log as
+            // though the user had chosen the backend (#1343). What this start did choose is
+            // either the first candidate or the first one that has not failed before, so it says
+            // which of the two it is rather than claiming the first choice.
+            None if choice.record.failed.is_empty() => {
+                log::info!("graphics: {} (nothing has failed before; set WGPU_BACKEND to choose another)", choice.backend.name())
+            }
+            None => log::info!(
+                "graphics: {} (the first that hasn't failed before, after {:?}; set WGPU_BACKEND to choose another)",
+                choice.backend.name(),
+                choice.record.failed
+            ),
         }
         let instance = instance_backends(choice.backend, &choice.record.failed);
         Some(Fallback { backend: choice.backend, switched_from: choice.switched_from, instance, path, record: choice.record })
diff --git a/apps/designcraft/src/main.rs b/apps/designcraft/src/main.rs
index 13416e4e..e694fe84 100644
--- a/apps/designcraft/src/main.rs
+++ b/apps/designcraft/src/main.rs
@@ -277,12 +277,27 @@ fn picked_save_path(picked: std::path::PathBuf, ext: Option<&str>) -> std::path:
     s.into()
 }
 
+/// The folder a save dialog starts in and the name it suggests. A suggestion with a folder in
+/// front (the document's, or the last one used) starts there while that folder still exists;
+/// otherwise the system picks, as it did before.
+fn save_dialog_start(suggested: &str) -> (Option<std::path::PathBuf>, String) {
+    let path = std::path::Path::new(suggested);
+    let name = path.file_name().map_or_else(|| suggested.to_string(), |n| n.to_string_lossy().to_string());
+    let folder = path.parent().filter(|f| !f.as_os_str().is_empty() && f.is_dir()).map(std::path::Path::to_path_buf);
+    (folder, name)
+}
+
 /// The save dialog: the suggested name's extension as its filter, and the extension added to a
 /// name typed without it. Adding it names another file than the one the dialog checked, so
 /// replacing an existing one asks again.
-fn pick_save(name: &str) -> Option<String> {
+fn pick_save(suggested: &str) -> Option<String> {
+    let (folder, name) = save_dialog_start(suggested);
+    let name = name.as_str();
     let ext = suggested_extension(name);
     let mut dialog = rfd::FileDialog::new().set_file_name(name);
+    if let Some(folder) = folder {
+        dialog = dialog.set_directory(folder);
+    }
     if let Some(ext) = ext {
         dialog = dialog.add_filter(ext.to_ascii_uppercase(), &[ext]);
     }
@@ -606,6 +621,17 @@ mod tests {
         assert_eq!(save("/d/Brochure.txt", "Untitled.rtf"), PathBuf::from("/d/Brochure.txt"), "another export format is kept");
         assert_eq!(save("/d/Package", "Untitled 1.2 Folder"), PathBuf::from("/d/Package"), "a folder has no extension");
     }
+
+    /// #1653: the save dialog opens in the folder the suggestion names, unless it is gone.
+    #[test]
+    fn save_dialog_starts_in_the_suggested_folder_while_it_exists() {
+        let folder = std::env::temp_dir();
+        let suggested = folder.join("Brochure.pdf");
+        assert_eq!(super::save_dialog_start(&suggested.to_string_lossy()), (Some(folder.clone()), "Brochure.pdf".to_string()));
+        let gone = folder.join(format!("designcraft-gone-{}", std::process::id())).join("Brochure.pdf");
+        assert_eq!(super::save_dialog_start(&gone.to_string_lossy()), (None, "Brochure.pdf".to_string()), "a folder deleted since: the system's own");
+        assert_eq!(super::save_dialog_start("Untitled 1.2 Folder"), (None, "Untitled 1.2 Folder".to_string()), "a bare name: the system's own");
+    }
 }
 
 #[cfg(all(test, unix))]
diff --git a/crates/color/src/ase.rs b/crates/color/src/ase.rs
index 6cfd7203..f44e3dba 100644
--- a/crates/color/src/ase.rs
+++ b/crates/color/src/ase.rs
@@ -128,8 +128,14 @@ pub fn write(swatches: &[Swatch]) -> Vec<u8> {
             continue;
         }
         let mut b = Vec::new();
-        let units: Vec<u16> = s.name.encode_utf16().chain(std::iter::once(0)).collect();
-        b.extend((units.len() as u16).to_be_bytes());
+        // The length field is a u16 that counts the terminating NUL: truncate longer names.
+        let mut units: Vec<u16> = s.name.encode_utf16().take(usize::from(u16::MAX) - 1).collect();
+        // Do not leave half of a surrogate pair at the cut.
+        if units.last().is_some_and(|u| (0xD800..0xDC00).contains(u)) {
+            units.pop();
+        }
+        units.push(0);
+        b.extend(u16::try_from(units.len()).unwrap_or(u16::MAX).to_be_bytes());
         for u in units {
             b.extend(u.to_be_bytes());
         }
@@ -233,6 +239,21 @@ mod tests {
         assert_eq!(read(&write(&sw[1..])).map(|w| w.len()), Ok(MAX_COLORS), "up to the limit");
     }
 
+    #[test]
+    fn over_long_name_is_truncated_to_fit() {
+        let sw = vec![Swatch {
+            name: "x".repeat(70_000),
+            value: SwatchValue::Color { color: Color::Gray { k: 0.5 }, color_type: ColorType::Process },
+            locked: false,
+            named: true,
+            hidden: false,
+        }];
+        let back = read(&write(&sw)).unwrap();
+        assert_eq!(back.len(), 1, "the swatch must survive the round trip");
+        assert_eq!(back[0].name, "x".repeat(usize::from(u16::MAX) - 1));
+        assert_eq!(back[0].value, sw[0].value);
+    }
+
     #[test]
     fn out_of_range_components_are_clamped() {
         let mut f = Vec::new();
diff --git a/crates/compose/src/lib.rs b/crates/compose/src/lib.rs
index 89ea89bd..a3fac1ea 100644
--- a/crates/compose/src/lib.rs
+++ b/crates/compose/src/lib.rs
@@ -165,6 +165,20 @@ pub struct PlacedGlyph {
 }
 
 impl PlacedGlyph {
+    /// Whether an underline or a strikethrough runs across this glyph.
+    ///
+    /// A tab is not drawn, but it is a character with an advance, and the rule runs across its
+    /// whole width as InDesign draws it: forms rule their fill-in lines with underlined tabs, and
+    /// without this they lost every writing line (#1466). The spaces a line break trimmed off the
+    /// end, the break characters themselves and the markers' carriers are not part of the line's
+    /// text and are not spanned.
+    pub fn spans_rules(&self) -> bool {
+        if self.visible {
+            return true;
+        }
+        self.adv > 0.0 && matches!(self.rendered_char, '\t' | designcraft_doc::story::RIGHT_INDENT_TAB)
+    }
+
     /// In a vertical frame, the turn that sets this glyph upright, applied after drawing it at `x`
     /// on `baseline`: it hangs from its vertical origin ([`designcraft_fonts::FontFace::v_origin`],
     /// centred across) at `x` on the line's centre, the middle of the font's em box; a tate-chu-yoko
@@ -569,6 +583,9 @@ pub struct FrameSpec {
     pub grid: Option<(f64, f64)>,
     /// The frame is on a left page (for towards/away-from-spine alignment).
     pub left_page: bool,
+    /// The frame is on a right page of a facing spread (spine-relative anchored objects mirror
+    /// there; a single page has no spine).
+    pub right_page: bool,
     /// The page and its margins in the frame's inner space (custom anchored objects).
     pub page_rect: Option<(Rect, Rect)>,
 }
@@ -648,7 +665,10 @@ pub fn frame_specs(doc: &Document, sid: StoryId) -> Vec<FrameSpec> {
         let loc = doc.find(fid);
         let Some(item) = loc.as_ref().and_then(|l| doc.item_at(l)).or_else(|| doc.anchored_item(fid)) else { continue };
         let Some(tf) = item.text_frame() else { continue };
-        let xf = loc.as_ref().map(|l| doc.parent_xf(l)).unwrap_or(designcraft_geom::Affine::IDENTITY) * item.xf;
+        let parent = loc.as_ref().map(|l| doc.parent_xf(l)).unwrap_or(designcraft_geom::Affine::IDENTITY);
+        let xf = parent * item.xf;
+        // Where the frame is on the spread (a group's transform included), to find its page.
+        let center_x = parent.transform_rect_bbox(item.bounds()).center().x;
         let inv = xf.inverse();
         let mut exclusions = Vec::new();
         let spread_ref = loc.as_ref().map(|l| l.spread);
@@ -672,25 +692,27 @@ pub fn frame_specs(doc: &Document, sid: StoryId) -> Vec<FrameSpec> {
                 r.is_finite() && r.x0 < a.x1 && r.x1 > a.x0 && r.y0 < a.y1 && r.y1 > a.y0
             });
         }
-        let (page_name, page, left_page) = match (spread_ref, spread) {
+        let (page_name, page, side) = match (spread_ref, spread) {
             (Some(designcraft_doc::SpreadRef::Doc(si)), Some(sp)) => {
-                let c = item.bounds().center();
-                let pi = sp.page_at_x(c.x).unwrap_or(0);
+                let pi = sp.page_at_x(center_x).unwrap_or(0);
                 let abs = doc.first_page_of_spread(si) + pi;
-                (Some(doc.page_name(abs)), Some(abs), sp.pages.get(pi).is_some_and(|p| p.side == designcraft_doc::PageSide::Left))
+                (Some(doc.page_name(abs)), Some(abs), sp.pages.get(pi).map(|p| p.side))
             }
-            (Some(designcraft_doc::SpreadRef::Parent(pi)), Some(sp)) => {
+            (Some(designcraft_doc::SpreadRef::Parent(_)), Some(sp)) => {
                 let prefix = sp.parent.as_ref().map(|p| p.prefix.clone()).unwrap_or_else(|| "A".into());
-                let _ = pi;
-                (Some(prefix), None, false)
+                // The side of the parent page under the frame, so a folio there aligns to the spine of its own page.
+                let under = sp.page_at_x(center_x).and_then(|pi| sp.pages.get(pi));
+                (Some(prefix), None, under.map(|p| p.side))
             }
-            _ => (None, None, false),
+            _ => (None, None, None),
         };
+        let left_page = side == Some(designcraft_doc::PageSide::Left);
+        let right_page = side == Some(designcraft_doc::PageSide::Right);
         let section_marker = page.map(|abs| section_marker(doc, abs));
         // The page under the frame and its margins, in inner space (bounding boxes).
         let page_rect = match (spread_ref, spread) {
             (_, Some(sp)) => sp
-                .page_at_x(item.bounds().center().x)
+                .page_at_x(center_x)
                 .and_then(|pi| sp.pages.get(pi))
                 .map(|pg| (inv.transform_rect_bbox(pg.bounds()), inv.transform_rect_bbox(pg.margin_rect()))),
             _ => None,
@@ -757,6 +779,7 @@ pub fn frame_specs(doc: &Document, sid: StoryId) -> Vec<FrameSpec> {
             page,
             grid,
             left_page,
+            right_page,
             page_rect,
         });
     }
@@ -1674,10 +1697,16 @@ fn compose_with_db(doc: &Document, story: &Story, frames: &[FrameSpec], opts: &C
                 }
                 // A drop cap sits at the start-side indent; the first-line indent doesn't move it.
                 let beside = drop_cap.as_ref().filter(|dc| line_no < dc.lines && col_first_line == 0).map(DropCap::indent);
+                let first_line = if line_no == 0 { pp.first_line_indent } else { 0.0 };
                 let (ind_l, ind_r) = match beside {
                     Some(w) if rtl => (pp.left_indent, pp.right_indent + w),
                     Some(w) => (pp.left_indent + w, pp.right_indent),
-                    None => (pp.left_indent + if line_no == 0 { pp.first_line_indent } else { 0.0 }, pp.right_indent),
+                    // The first-line indent is at the paragraph's start side, which is the right
+                    // one in a right-to-left paragraph: applied on the left it moved the line the
+                    // wrong way, out of the frame for the hanging indent a numbered list uses
+                    // (#1448).
+                    None if rtl => (pp.left_indent, pp.right_indent + first_line),
+                    None => (pp.left_indent + first_line, pp.right_indent),
                 };
                 let lx0 = x0 + ind_l;
                 let lx1 = x1 - ind_r;
@@ -1982,6 +2011,7 @@ fn compose_with_db(doc: &Document, story: &Story, frames: &[FrameSpec], opts: &C
                         object_point,
                         ref_point,
                         keep_within_column,
+                        spine_relative,
                     } => {
                         use designcraft_doc::anchored::AnchorRelative as R;
                         let col = ft.columns.get(l.column as usize).copied().unwrap_or(f.area);
@@ -1993,15 +2023,21 @@ fn compose_with_db(doc: &Document, story: &Story, frames: &[FrameSpec], opts: &C
                             R::PageEdge => Some(f.page_rect.map_or(f.area, |p| p.0)),
                         };
                         let frac = |i: u8| ([0.0, 0.5, 1.0][(i % 3) as usize], [0.0, 0.5, 1.0][(i / 3).min(2) as usize]);
-                        let (rfx, rfy) = frac(*ref_point);
-                        let (ofx, ofy) = frac(*object_point);
+                        let (mut rfx, rfy) = frac(*ref_point);
+                        let (mut ofx, ofy) = frac(*object_point);
+                        let mut dx = *x_offset;
+                        // The settings describe a left-hand page; a right-hand page mirrors them
+                        // across the spine.
+                        if *spine_relative && f.right_page {
+                            (rfx, ofx, dx) = (1.0 - rfx, 1.0 - ofx, -dx);
+                        }
                         let rx = area(*x_relative).map_or(o.x, |a| a.x0 + a.width() * rfx);
                         let ry = area(*y_relative).map_or(l.baseline, |a| a.y0 + a.height() * rfy);
                         let mut y = ry + y_offset - h * ofy;
                         if *keep_within_column {
                             y = y.clamp(col.y0, (col.y1 - h).max(col.y0));
                         }
-                        Point::new(rx + x_offset - w * ofx, y)
+                        Point::new(rx + dx - w * ofx, y)
                     }
                 };
             }
@@ -4627,6 +4663,7 @@ mod column_allocation_safety_tests {
             page: None,
             grid: None,
             left_page: false,
+            right_page: false,
             page_rect: None,
             outline: None,
         }
diff --git a/crates/compose/src/notes.rs b/crates/compose/src/notes.rs
index e72ecde0..2a465fbf 100644
--- a/crates/compose/src/notes.rs
+++ b/crates/compose/src/notes.rs
@@ -72,7 +72,7 @@ pub(crate) struct Notes {
     pub key: Option<usize>,
     pub placed: Vec<Placed>,
     /// Composed footnote text by (index, label, width).
-    cache: HashMap<(usize, String, u64), (Arc<ComposedStory>, NoteMetrics)>,
+    cache: HashMap<(usize, String, u64, bool, bool), (Arc<ComposedStory>, NoteMetrics)>,
     notes: Vec<Arc<designcraft_doc::Footnote>>,
     /// Footnotes span the columns of their frame.
     span: bool,
@@ -153,7 +153,8 @@ impl Notes {
     fn compose(&mut self, doc: &Document, k: usize, w: f64, f: &FrameSpec, opts: &ComposeOptions) -> (Arc<ComposedStory>, NoteMetrics) {
         let o = &doc.footnote_options;
         let label = format!("{}{}", o.label(self.numbers[k], true), o.separator);
-        let key = (k, label.clone(), w.to_bits());
+        // The page side sets towards/away-from-spine alignment and spine-relative anchored objects.
+        let key = (k, label.clone(), w.to_bits(), f.left_page, f.right_page);
         if let Some(c) = self.cache.get(&key) {
             return c.clone();
         }
@@ -169,6 +170,7 @@ impl Notes {
             page: f.page,
             grid: None,
             left_page: f.left_page,
+            right_page: f.right_page,
             page_rect: None,
         };
         let nopts = ComposeOptions {
diff --git a/crates/compose/src/table.rs b/crates/compose/src/table.rs
index 940e0aa7..39219e43 100644
--- a/crates/compose/src/table.rs
+++ b/crates/compose/src/table.rs
@@ -121,7 +121,7 @@ impl CellLineExtent {
 }
 
 /// Compose a cell story at width `w` (content space, top-left at the origin).
-fn compose_cell(doc: &Document, cell: &Cell, w: f64, opts: &ComposeOptions, left_page: bool) -> CellLayout {
+fn compose_cell(doc: &Document, cell: &Cell, w: f64, opts: &ComposeOptions, (left_page, right_page): (bool, bool)) -> CellLayout {
     let spec = FrameSpec {
         id: ItemId(0),
         area: Rect::new(0.0, 0.0, w.max(1.0), 1.0e6),
@@ -134,6 +134,7 @@ fn compose_cell(doc: &Document, cell: &Cell, w: f64, opts: &ComposeOptions, left
         page: opts.page,
         grid: None,
         left_page,
+        right_page,
         page_rect: None,
     };
     let cs = crate::compose(doc, &cell.text, std::slice::from_ref(&spec), opts);
@@ -200,7 +201,7 @@ pub(crate) fn place_table(
     let (nr, nc) = (table.nrows(), table.ncols());
     let owners = table.owners();
     let is_owner = |r: usize, c: usize| owners[r * nc + c] == (r, c);
-    let left_page = frames[cur.fi].left_page;
+    let side = (frames[cur.fi].left_page, frames[cur.fi].right_page);
     // Compose every owner cell.
     let mut layouts: Vec<Option<CellLayout>> = Vec::with_capacity(nr * nc);
     for r in 0..nr {
@@ -212,7 +213,7 @@ pub(crate) fn place_table(
             let cell = &table.cells[r * nc + c];
             let cs = (cell.col_span.max(1) as usize).min(nc - c);
             let w = colx[c + cs] - colx[c] - cell.insets[1] - cell.insets[3];
-            layouts.push(Some(compose_cell(doc, cell, w, opts, left_page)));
+            layouts.push(Some(compose_cell(doc, cell, w, opts, side)));
         }
     }
     // Row heights.
@@ -813,7 +814,7 @@ mod height_tests {
     }
 
     fn measure(cell: &Cell, width: f64) -> CellLayout {
-        compose_cell(&Document::new(&NewDocument::default()), cell, width, &ComposeOptions::default(), false)
+        compose_cell(&Document::new(&NewDocument::default()), cell, width, &ComposeOptions::default(), (false, false))
     }
 
     fn compose_table(table: Table, height: f64) -> ComposedStory {
@@ -1061,6 +1062,7 @@ mod height_tests {
                 object_point: 0,
                 ref_point: 0,
                 keep_within_column: false,
+                spine_relative: false,
             }),
         );
         assert!((measure(&cell, 92.0).content_h - original).abs() < 1e-6);
diff --git a/crates/compose/src/tests.rs b/crates/compose/src/tests.rs
index 15c412ad..f9e8ba0f 100644
--- a/crates/compose/src/tests.rs
+++ b/crates/compose/src/tests.rs
@@ -2752,6 +2752,7 @@ fn custom_anchors_do_not_change_bottom_baseline_fitting() {
         object_point: 0,
         ref_point: 0,
         keep_within_column: false,
+        spine_relative: false,
     };
     d.story_mut(sid).unwrap().insert_object(0, designcraft_doc::AnchoredObject::new(it, pos));
     let cs = compose_story(&d, sid, &ComposeOptions::default());
@@ -6740,6 +6741,7 @@ fn anchor_box(d: &mut Document, sid: StoryId, at: usize, x: f64, y: f64, y_rel:
         object_point: 0,
         ref_point: 0,
         keep_within_column: false,
+        spine_relative: false,
     };
     d.story_mut(sid).unwrap().insert_object(at, designcraft_doc::AnchoredObject::new(it, position));
 }
@@ -6808,6 +6810,7 @@ fn anchored_object_wraps_with_its_contour_and_side() {
         object_point: 0,
         ref_point: 0,
         keep_within_column: false,
+        spine_relative: false,
     };
     d.story_mut(a).unwrap().insert_object(0, designcraft_doc::AnchoredObject::new(it, position));
     let cs = compose_story(&d, b, &ComposeOptions::default());
@@ -6821,6 +6824,70 @@ fn anchored_object_wraps_with_its_contour_and_side() {
     assert!(top > mid + 5.0, "top {top}, middle {mid}");
 }
 
+/// Relative to Spine: a marginal note set up for a left-hand page (its right edge 12 pt left of
+/// the column) mirrors on the right-hand page (its left edge 12 pt right of the column), so the
+/// notes of a story that runs across a spread all sit in the outside margin. Placed as on a
+/// left-hand page, the right page's note sat in the inside margin and reached across the spine.
+#[test]
+fn spine_relative_anchored_notes_stay_in_the_outside_margin_on_both_pages() {
+    use designcraft_doc::anchored::AnchorRelative as R;
+    let compose_spread = |spine_relative: bool| {
+        let mut d = Document::new(&NewDocument { pages: 3, ..Default::default() });
+        let lid = d.default_layer();
+        let sp = &d.spreads[1];
+        let (l, r) = (sp.pages[0].clone(), sp.pages[1].clone());
+        assert_eq!((l.side, r.side), (designcraft_doc::PageSide::Left, designcraft_doc::PageSide::Right));
+        // Body frames leave a 120 pt outside margin for the notes.
+        let left_rect = Rect::new(l.x + 120.0, 36.0, l.x + l.width - 36.0, 120.0);
+        let right_rect = Rect::new(r.x + 36.0, 36.0, r.x + r.width - 120.0, 600.0);
+        let text = [LOREM; 3].join(" ");
+        let (lf, sid) = d.add_text_frame(SpreadRef::Doc(1), left_rect, lid, &text, ParaFormat::default()).unwrap();
+        let (rf, _) = d.add_text_frame(SpreadRef::Doc(1), right_rect, lid, "", ParaFormat::default()).unwrap();
+        d.thread(lf, rf).unwrap();
+        let plain = compose_story(&d, sid, &ComposeOptions::default());
+        let second_line = |fid| plain.frame(fid).unwrap().lines[1].range.start;
+        let (at_left, at_right) = (second_line(lf), second_line(rf));
+        // Top-right corner of the note 12 pt left of the column's top-left, on the anchor's baseline.
+        let position = designcraft_doc::AnchorPosition::Custom {
+            x_relative: R::ColumnEdge,
+            y_relative: R::Anchor,
+            x_offset: -12.0,
+            y_offset: 0.0,
+            object_point: 2,
+            ref_point: 0,
+            keep_within_column: false,
+            spine_relative,
+        };
+        for at in [at_right, at_left] {
+            let note = designcraft_doc::Item::new(
+                ItemId(d.alloc()),
+                lid,
+                designcraft_doc::Shape::Rectangle,
+                designcraft_geom::shapes::rectangle(Rect::new(0.0, 0.0, 72.0, 40.0)),
+            );
+            d.story_mut(sid).unwrap().insert_object(at, designcraft_doc::AnchoredObject::new(note, position.clone()));
+        }
+        let cs = compose_story(&d, sid, &ComposeOptions::default());
+        // Per page: the note's left and right edges, the column, and the page's left and right edges.
+        let placed = |fid, page: &designcraft_doc::Page| {
+            let ft = cs.frame(fid).unwrap();
+            assert_eq!(ft.objects.len(), 1);
+            let o = &ft.objects[0];
+            ((o.origin.x, o.origin.x + o.size.0), ft.columns[0], (page.x, page.x + page.width))
+        };
+        (placed(lf, &l), placed(rf, &r))
+    };
+    let near = |a: f64, b: f64| (a - b).abs() < 1e-6;
+
+    let (((lx0, lx1), lcol, (lp0, _)), ((rx0, rx1), rcol, (_, rp1))) = compose_spread(true);
+    assert!(near(lx1, lcol.x0 - 12.0) && lx0 >= lp0, "left page: note {lx0}..{lx1}, column {lcol:?}");
+    assert!(near(rx0, rcol.x1 + 12.0) && rx1 <= rp1, "right page: note {rx0}..{rx1}, column {rcol:?}");
+
+    // Without Relative to Spine both pages take the settings as written.
+    let (_, ((rx0, rx1), rcol, _)) = compose_spread(false);
+    assert!(near(rx1, rcol.x0 - 12.0), "right page as written: note {rx0}..{rx1}, column {rcol:?}");
+}
+
 const OBJECT_LEN: usize = designcraft_doc::OBJECT_MARK.len_utf8();
 
 #[test]
@@ -7310,3 +7377,77 @@ fn rule_above_offset_is_measured_from_the_baseline() {
     assert!((rule.height() - 1.5).abs() < 1e-6);
     assert!(rule.y0 > first.baseline, "the rule stays below the row above: {rule:?}, its baseline {}", first.baseline);
 }
+
+#[test]
+fn parent_page_frames_know_which_side_of_the_spine_they_are_on() {
+    // Folios on a facing-pages parent: towards/away from spine must differ between its left and right page.
+    let mut d = Document::new(&NewDocument::default());
+    let lid = d.default_layer();
+    let w = d.parents[0].pages[0].width;
+    let para = ParaFormat { para: ParaAttrs { align: Some(Align::TowardsSpine), ..Default::default() }, ..Default::default() };
+    let (_, left_story) = d.add_text_frame(SpreadRef::Parent(0), Rect::new(36.0, 700.0, w - 36.0, 730.0), lid, "7", para.clone()).unwrap();
+    let (_, right_story) = d.add_text_frame(SpreadRef::Parent(0), Rect::new(w + 36.0, 700.0, 2.0 * w - 36.0, 730.0), lid, "8", para).unwrap();
+    assert!(frame_specs(&d, left_story)[0].left_page);
+    assert!(!frame_specs(&d, right_story)[0].left_page);
+}
+
+#[test]
+fn a_grouped_frame_takes_the_side_of_the_page_its_group_moves_it_to() {
+    let mut d = Document::new(&NewDocument { pages: 3, ..Default::default() });
+    let lid = d.default_layer();
+    let (l, r) = (d.spreads[1].pages[0].clone(), d.spreads[1].pages[1].clone());
+    let rect = Rect::new(l.x + 36.0, 36.0, l.x + l.width - 36.0, 300.0);
+    let (fid, sid) = d.add_text_frame(SpreadRef::Doc(1), rect, lid, "Text", ParaFormat::default()).unwrap();
+    // The frame's own coordinates are on the left page; its group's transform puts it on the right one.
+    let mut g = designcraft_doc::Item::new(ItemId(d.alloc()), lid, designcraft_doc::Shape::Group, designcraft_geom::PathData::default());
+    g.xf = designcraft_geom::Affine::translate((r.x - l.x, 0.0));
+    let sp = Arc::make_mut(&mut d.spreads[1]);
+    let at = sp.items.iter().position(|it| it.id == fid).unwrap();
+    g.content = designcraft_doc::Content::Group { items: vec![sp.items.remove(at)] };
+    sp.items.push(Arc::new(g));
+    let spec = &frame_specs(&d, sid)[0];
+    assert!(spec.right_page && !spec.left_page);
+    assert_eq!(spec.page, Some(2));
+}
+
+/// A right-to-left paragraph's first-line indent belongs at its start side, the right. Applied on
+/// the left it moved the first line the wrong way — out of the frame for the hanging indent a
+/// numbered list uses (right indent 10 mm, first line −10 mm), while the wrapped lines sat where
+/// the first line should have been (#1448).
+#[test]
+fn an_rtl_first_line_indent_is_at_the_right_edge() {
+    const MM: f64 = 72.0 / 25.4;
+    // Latin text in a right-to-left paragraph: the direction is the paragraph's, and it is the
+    // placement that is being measured, so no Arabic font has to be present.
+    let text = LOREM;
+    let rect = Rect::new(0.0, 0.0, 200.0, 300.0);
+    let para = |dir, align, first, left, right| ParaAttrs {
+        direction: Some(dir),
+        align: Some(align),
+        first_line_indent: Some(first),
+        left_indent: Some(left),
+        right_indent: Some(right),
+        ..Default::default()
+    };
+    // The hanging indent of a numbered list, right to left.
+    let (d, sid, _) = doc_with(text, rect, para(designcraft_doc::TextDirection::RightToLeft, Align::Right, -10.0 * MM, 0.0, 10.0 * MM));
+    let cs = compose_story(&d, sid, &ComposeOptions::default());
+    let lines = all_lines(&cs);
+    assert!(lines.len() >= 2, "the text wraps: {}", lines.len());
+    let right_edge = |l: &Line| l.glyphs.iter().filter(|g| g.visible).map(|g| g.x + g.adv).fold(f64::MIN, f64::max);
+    let left_edge = |l: &Line| l.glyphs.iter().filter(|g| g.visible).map(|g| g.x).fold(f64::MAX, f64::min);
+    // The first line reaches the frame's right edge; the wrapped lines stop 10 mm short of it.
+    assert!((right_edge(lines[0]) - rect.x1).abs() < 1.0, "first line at the edge: {}", right_edge(lines[0]));
+    assert!((right_edge(lines[1]) - (rect.x1 - 10.0 * MM)).abs() < 1.0, "wrapped line indented: {}", right_edge(lines[1]));
+    // And nothing leaves the frame on the left, which is where the first line used to go.
+    for (i, l) in lines.iter().enumerate() {
+        assert!(left_edge(l) >= rect.x0 - 0.01, "line {i} starts inside the frame: {}", left_edge(l));
+    }
+
+    // The same paragraph left to right is unchanged: the first line hangs on the left.
+    let (d, sid, _) = doc_with(text, rect, para(designcraft_doc::TextDirection::LeftToRight, Align::Left, -10.0 * MM, 10.0 * MM, 0.0));
+    let cs = compose_story(&d, sid, &ComposeOptions::default());
+    let lines = all_lines(&cs);
+    assert!((left_edge(lines[0]) - rect.x0).abs() < 1.0, "left to right, first line at the edge: {}", left_edge(lines[0]));
+    assert!((left_edge(lines[1]) - (rect.x0 + 10.0 * MM)).abs() < 1.0, "left to right, wrapped line indented: {}", left_edge(lines[1]));
+}
diff --git a/crates/doc/src/anchored.rs b/crates/doc/src/anchored.rs
index c1392f31..74fc8818 100644
--- a/crates/doc/src/anchored.rs
+++ b/crates/doc/src/anchored.rs
@@ -60,6 +60,11 @@ pub enum AnchorPosition {
         /// Keep Within Top/Bottom Column Boundaries.
         #[serde(default)]
         keep_within_column: bool,
+        /// Relative to Spine: the settings describe a left-hand page, and on a right-hand page
+        /// the reference point, the object point and the X offset mirror horizontally, so an
+        /// object in the outside margin stays in the outside margin.
+        #[serde(default)]
+        spine_relative: bool,
     },
 }
 
diff --git a/crates/engine/src/cmd/anchored.rs b/crates/engine/src/cmd/anchored.rs
index 6d09f89d..1e00585c 100644
--- a/crates/engine/src/cmd/anchored.rs
+++ b/crates/engine/src/cmd/anchored.rs
@@ -18,7 +18,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Insert Anchored Object…",
             ["Object", "Anchored Object"],
             None,
-            "{ids, story?, pos? (default: the text insertion point), position?: inline|aboveLine|custom, yOffset?, align?: left|center|right, spaceBefore?, spaceAfter?, xRelative? | yRelative?: anchor|textFrame|columnEdge|pageMargin|pageEdge, xOffset?, objectPoint? | refPoint?: 0..8, keepWithinColumn?} — moves the items into the text",
+            "{ids, story?, pos? (default: the text insertion point), position?: inline|aboveLine|custom, yOffset?, align?: left|center|right, spaceBefore?, spaceAfter?, xRelative? | yRelative?: anchor|textFrame|columnEdge|pageMargin|pageEdge, xOffset?, objectPoint? | refPoint?: 0..8, keepWithinColumn?, spineRelative? (custom: the settings describe a left-hand page and mirror on a right-hand page)} — moves the items into the text",
             has_doc,
             insert
         ),
@@ -27,7 +27,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Anchored Object Options…",
             ["Object", "Anchored Object"],
             None,
-            "{story?, index? (default: the object at the insertion point), position?: inline|aboveLine|custom, yOffset?, align?: left|center|right, spaceBefore?, spaceAfter?, xRelative? | yRelative?: anchor|textFrame|columnEdge|pageMargin|pageEdge, xOffset?, objectPoint? | refPoint?: 0..8, keepWithinColumn?}",
+            "{story?, index? (default: the object at the insertion point), position?: inline|aboveLine|custom, yOffset?, align?: left|center|right, spaceBefore?, spaceAfter?, xRelative? | yRelative?: anchor|textFrame|columnEdge|pageMargin|pageEdge, xOffset?, objectPoint? | refPoint?: 0..8, keepWithinColumn?, spineRelative? (custom: the settings describe a left-hand page and mirror on a right-hand page)}",
             has_doc,
             options
         ),
@@ -80,11 +80,18 @@ fn position_param(p: &Value, base: &AnchorPosition) -> Result<AnchorPosition> {
         }
         ("custom", b) => {
             use designcraft_doc::anchored::AnchorRelative as R;
-            let (xr0, yr0, xo0, yo0, op0, rp0, k0) = match b {
-                AnchorPosition::Custom { x_relative, y_relative, x_offset, y_offset, object_point, ref_point, keep_within_column } => {
-                    (*x_relative, *y_relative, *x_offset, *y_offset, *object_point, *ref_point, *keep_within_column)
-                }
-                _ => (R::TextFrame, R::Anchor, 0.0, 0.0, 0, 0, false),
+            let (xr0, yr0, xo0, yo0, op0, rp0, k0, sr0) = match b {
+                AnchorPosition::Custom {
+                    x_relative,
+                    y_relative,
+                    x_offset,
+                    y_offset,
+                    object_point,
+                    ref_point,
+                    keep_within_column,
+                    spine_relative,
+                } => (*x_relative, *y_relative, *x_offset, *y_offset, *object_point, *ref_point, *keep_within_column, *spine_relative),
+                _ => (R::TextFrame, R::Anchor, 0.0, 0.0, 0, 0, false, false),
             };
             let rel = |k: &str, d: R| -> Result<R> {
                 match p.get(k) {
@@ -102,6 +109,7 @@ fn position_param(p: &Value, base: &AnchorPosition) -> Result<AnchorPosition> {
                 object_point: pt("objectPoint", op0),
                 ref_point: pt("refPoint", rp0),
                 keep_within_column: p.get("keepWithinColumn").and_then(Value::as_bool).unwrap_or(k0),
+                spine_relative: p.get("spineRelative").and_then(Value::as_bool).unwrap_or(sr0),
             }
         }
         (o, _) => return Err(bad("anchored", format!("unknown position `{o}`"))),
@@ -316,5 +324,12 @@ mod custom_tests {
             matches!(obj.position, designcraft_doc::AnchorPosition::Custom { x_offset, object_point: 2, .. } if x_offset == -6.0),
             "IDML Anchored position"
         );
+        // Relative to Spine keeps the other custom settings.
+        s.execute("anchored.options", &json!({"story": sid.0, "index": 0, "spineRelative": true})).unwrap();
+        let st = s.doc().unwrap().doc.story(sid).unwrap().clone();
+        assert!(matches!(
+            st.objects[0].position,
+            designcraft_doc::AnchorPosition::Custom { spine_relative: true, x_offset, object_point: 2, .. } if x_offset == -6.0
+        ));
     }
 }
diff --git a/crates/engine/src/cmd/edit.rs b/crates/engine/src/cmd/edit.rs
index fb8848a9..a10e9ae2 100644
--- a/crates/engine/src/cmd/edit.rs
+++ b/crates/engine/src/cmd/edit.rs
@@ -262,12 +262,29 @@ pub fn specs() -> Vec<CommandSpec> {
             st.selection.cells = None;
             if let Some(i) = st.selection.items.iter().position(|x| *x == id) {
                 st.selection.items.remove(i);
+                // A key object needs another object to align to it.
+                if st.selection.key == Some(id) || st.selection.items.len() < 2 {
+                    st.selection.key = None;
+                }
             } else {
                 st.selection.items.push(id);
             }
             st.bump_revision();
             ok()
         }),
+        cmd!(noundo "selection.key", "Key Object", [], None, "{id} — make a selected item the key object for Align; the current key object drops the key", has_doc, |s, p| {
+            let id = super::id_param(p, "id").ok_or_else(|| super::bad("selection.key", "missing id"))?;
+            let st = s.doc_mut()?;
+            if !st.selection.items.contains(&id) {
+                return Err(super::bad("selection.key", "the key object must be selected"));
+            }
+            if st.selection.items.len() < 2 {
+                return Err(super::bad("selection.key", "a key object needs at least two selected objects"));
+            }
+            st.selection.key = if st.selection.key == Some(id) { None } else { Some(id) };
+            st.bump_revision();
+            ok()
+        }),
         cmd!(noundo "edit.selectAll", "Select All", ["Edit"], Some("Cmd+A"), "{} — all items on the active spreads, or all text in the story", has_doc, |s, _| {
             let st = s.doc_mut()?;
             if let Some(t) = st.selection.text {
diff --git a/crates/engine/src/cmd/export.rs b/crates/engine/src/cmd/export.rs
index 36fd3d52..551dd748 100644
--- a/crates/engine/src/cmd/export.rs
+++ b/crates/engine/src/cmd/export.rs
@@ -10,7 +10,7 @@ use crate::{EngineError, Result, Session};
 pub fn specs() -> Vec<CommandSpec> {
     vec![
         cmd!(noundo "file.exportPdf", "Export PDF…", ["File"], None,
-        "{path?, pages?: \"1-3,5\" | [1,3] (1-based positions; default all), flatten?: high|medium|low|ppi (Transparency Flattener: spreads with transparency are rasterised), spreads?: bool, fullScreen?: bool, bookmarksPanel?: bool, pageLayout?: single|continuous|twoUp|twoUpCover|twoUpContinuous, view?: fitPage|fitWidth|actual, advanceSeconds?: number (interactive PDF), bleed?: bool (document bleed), marks?: bool | {crop?, bleed?, pageInfo?, weight?, offset?}, standard?: \"none\"|\"x4\"|\"a2b\", compressImages?: bool, tagged?: bool (structure tree: stories as paragraphs, figures with alt text), media?: bool (interactive: embed placed video and sound), title?, author?} → {path, bytes, pages, warnings} (no path: {base64, …})",
+        "{path?, pages?: \"1-3,5\" | [1,3] (1-based positions; default all), flatten?: high|medium|low|ppi (Transparency Flattener: spreads with transparency are rasterised), spreads?: bool, fullScreen?: bool, bookmarksPanel?: bool, pageLayout?: single|continuous|twoUp|twoUpCover|twoUpContinuous, view?: fitPage|fitWidth|actual, advanceSeconds?: number (interactive PDF), bleed?: bool (document bleed), marks?: bool | {crop?, bleed?, pageInfo?, weight?, offset?}, standard?: \"none\"|\"x4\"|\"a2b\", compressImages?: bool, tagged?: bool (structure tree: stories as paragraphs, figures with alt text), media?: bool (interactive: embed placed video and sound), title?, author?, created?: int (creation date in Unix seconds; default now, for reproducible files)} → {path, bytes, pages, warnings} (no path: {base64, …})",
         has_doc, export_pdf),
         cmd!(noundo "file.exportEpub", "Export EPUB (Reflowable)…", ["File"], None,
         "{path?, title?, author?, language?: \"en\", identifier?: str (dc:identifier; a stable urn:uuid by default), coverImage?: path (a PNG or JPEG as the cover), tocTitle?: str (the table of contents' title; from the language by default), cover?: bool (the first page as the cover image), embedFonts?: bool (package the stylesheet's fonts whose licence allows it, whole files), fixedLayout?: bool (pre-paginated: each page as an image with its text)} → {path, bytes, warnings} (no path: {base64, bytes, warnings}); warnings name images without alt text, exported as decorative, and fonts that could not be embedded",
@@ -331,7 +331,12 @@ fn pages_param(id: &str, p: &Value, page_count: usize) -> Result<Option<Vec<usiz
                     .and_then(|n| usize::try_from(n).ok())
                     .filter(|n| *n >= 1 && *n <= page_count)
                     .ok_or_else(|| bad(id, format!("bad page {x}")))?;
-                v.push(n - 1);
+                // A page named twice is one page, as `"2,2"` already is: the list says which
+                // pages to export, not how many times. `[2, 2]` exported two copies of page 2
+                // while `"2,2"` exported one.
+                if !v.contains(&(n - 1)) {
+                    v.push(n - 1);
+                }
             }
             Some(v)
         }
@@ -371,6 +376,10 @@ pub(crate) fn options(p: &Value, page_count: usize) -> Result<PdfOptions> {
         Some(s) => Standard::parse(s).ok_or_else(|| bad(ID, format!("unknown standard `{s}` (none, x4, a2b)")))?,
         None => Standard::None,
     };
+    let created = match p.get("created") {
+        None | Some(Value::Null) => None,
+        Some(v) => Some(v.as_i64().ok_or_else(|| bad(ID, "`created`: Unix seconds, an integer"))?),
+    };
     Ok(PdfOptions {
         pages,
         spreads,
@@ -382,6 +391,7 @@ pub(crate) fn options(p: &Value, page_count: usize) -> Result<PdfOptions> {
         author: str_param(p, "author").map(str::to_string),
         tagged: p.get("tagged").and_then(Value::as_bool).unwrap_or(false),
         media: p.get("media").and_then(Value::as_bool).unwrap_or(false),
+        created,
         ..PdfOptions::default()
     })
 }
@@ -1326,3 +1336,52 @@ mod pptx_tests {
         assert!(x.contains("<p:pic>") && !x.contains("prst=\"ellipse\""), "{x}");
     }
 }
+
+#[cfg(test)]
+mod page_list_tests {
+    use serde_json::{Value, json};
+
+    use crate::Session;
+
+    fn doc(pages: u64) -> Session {
+        let mut s = Session::new();
+        s.execute("file.new", &json!({"width": 200, "height": 200, "pages": pages, "facingPages": false, "margins": 0})).unwrap();
+        s
+    }
+
+    /// The same selection written two ways exported different files: `"2,2"` is one page, because
+    /// `parse_page_range` keeps the first of a repeat, while `[2, 2]` was two copies of page 2.
+    /// The list says which pages to export, not how many times.
+    #[test]
+    fn a_page_named_twice_is_exported_once_either_way() {
+        let mut s = doc(4);
+        for (pages, want) in [
+            (json!("2,2"), 1),
+            (json!([2, 2]), 1),
+            (json!([2, 2, 2]), 1),
+            (json!("2-2,2"), 1),
+            (json!([1, 2, 1]), 2),
+            (json!("1,2,1"), 2),
+            (json!([4, 1]), 2),
+            (json!("4,1"), 2),
+            (json!("all"), 4),
+        ] {
+            let r = s.execute("file.exportPdf", &json!({"pages": pages.clone()})).unwrap();
+            assert_eq!(r["pages"].as_u64(), Some(want), "pdf {pages}");
+            let r = s.execute("file.exportPptx", &json!({"pages": pages.clone()})).unwrap();
+            assert_eq!(r["slides"].as_u64(), Some(want), "pptx {pages}");
+        }
+        // The two forms now agree byte for byte, and the pages come out in the document's order
+        // whichever order the list names them in (which is how the export already behaved).
+        let mut file = |pages: Value| {
+            let r = s.execute("file.exportPdf", &json!({"pages": pages})).unwrap();
+            r["base64"].as_str().unwrap_or_default().to_string()
+        };
+        assert_eq!(file(json!([4, 1])), file(json!("4,1")), "the array and the string agree");
+        assert_eq!(file(json!([4, 1])), file(json!([1, 4])), "pages 1 and 4, in the document's order");
+        assert_eq!(file(json!([2, 2])), file(json!("2")), "a repeat is the single page");
+        // A page that does not exist is still refused, and an empty list still exports nothing.
+        assert!(s.execute("file.exportPdf", &json!({"pages": [5]})).is_err());
+        assert!(s.execute("file.exportPdf", &json!({"pages": []})).is_err());
+    }
+}
diff --git a/crates/engine/src/cmd/find.rs b/crates/engine/src/cmd/find.rs
index 3ba6970a..a40e8da5 100644
--- a/crates/engine/src/cmd/find.rs
+++ b/crates/engine/src/cmd/find.rs
@@ -6,7 +6,7 @@ use std::sync::{Arc, Weak};
 
 use designcraft_compose::grep::{Grep, GrepOptions, translate_replacement};
 use designcraft_doc::story::floor_char_boundary;
-use designcraft_doc::{Document, Selection, StoryId, TextSel};
+use designcraft_doc::{CellAddr, Document, Selection, StoryId, TextSel};
 use serde_json::{Value, json};
 
 use super::{CommandSpec, bad, bool_or, cmd, has_doc, str_param};
@@ -61,7 +61,7 @@ pub fn specs() -> Vec<CommandSpec> {
             }
         ),
         cmd!(query "find.find", "Find", ["Edit", "Find/Change"], None,
-            "{find, grep?: bool, caseSensitive?: bool, wholeWord?: bool, scope?: document|story|selection, story?, change?|first?|attrs?: ignored (find.change takes them; one request serves all three Find/Change commands)} → matches [{story, start, end, text}]",
+            "{find, grep?: bool, caseSensitive?: bool, wholeWord?: bool, scope?: document|story|selection, story?, change?|first?|attrs?: ignored (find.change takes them; one request serves all three Find/Change commands)} → matches [{story, start, end, text, cell?: {table, row, col}}] (document scope also searches table cells; start/end then index the cell's text)",
             has_doc, find),
         cmd!(
             "find.change",
@@ -153,6 +153,9 @@ impl Matcher {
     }
 }
 
+/// A searched text: a story, or one table cell of it, and the byte range inside.
+type Target = (StoryId, Option<CellAddr>, Range<usize>);
+
 /// A search owns its original domain, not the selection used to paint the latest hit.
 /// Weak identity avoids retaining an old document merely for this transient cache.
 #[derive(Clone)]
@@ -163,7 +166,7 @@ pub(crate) struct FindContext {
     selection: Selection,
     domain: Domain,
     matcher: Matcher,
-    targets: Vec<(StoryId, Range<usize>)>,
+    targets: Vec<Target>,
     order: Vec<usize>,
     target: usize,
     offset: usize,
@@ -184,21 +187,25 @@ impl FindContext {
         self.target = 0;
         self.last_match_end = None;
         self.order = (0..self.targets.len()).collect();
-        let caret = st.selection.text.filter(|t| t.cell.is_none() && st.selection.cells.is_none());
-        if self.domain == Domain::Document
-            && let Some(t) = st.selection.text
-            && let Some(i) = self.targets.iter().position(|(sid, _)| *sid == t.story)
-        {
+        let caret = st.selection.text.filter(|_| st.selection.cells.is_none());
+        // A caret in a searched cell starts there; one in a footnote starts at its story.
+        let start = st.selection.text.and_then(|t| {
+            let at = |want: Option<CellAddr>| self.targets.iter().position(|(sid, cell, _)| *sid == t.story && *cell == want);
+            at(t.cell).or_else(|| at(None))
+        });
+        if let Some(i) = start.filter(|_| self.domain == Domain::Document) {
             self.order.rotate_left(i);
         }
         let first = self.order.first().and_then(|i| self.targets.get(*i));
         self.offset = match first {
-            Some((sid, r)) if self.domain != Domain::Selection => caret.filter(|t| t.story == *sid).map_or(r.start, |t| t.range().end.min(r.end)),
-            Some((_, r)) => r.start,
+            Some((sid, cell, r)) if self.domain != Domain::Selection => {
+                caret.filter(|t| t.story == *sid && t.cell == *cell).map_or(r.start, |t| t.range().end.min(r.end))
+            }
+            Some((_, _, r)) => r.start,
             None => 0,
         };
-        if let Some((sid, r)) = first {
-            let text = target_text(&st.doc, *sid, r)?;
+        if let Some((sid, cell, r)) = first {
+            let text = target_text(&st.doc, *sid, *cell, r)?;
             if text.get(self.offset.saturating_sub(r.start)..).is_none() {
                 return Err(bad("find", "invalid UTF-8 search cursor"));
             }
@@ -209,7 +216,7 @@ impl FindContext {
     fn advance_target(&mut self) {
         self.target = self.target.saturating_add(1);
         self.last_match_end = None;
-        self.offset = self.order.get(self.target).and_then(|i| self.targets.get(*i)).map_or(0, |(_, r)| r.start);
+        self.offset = self.order.get(self.target).and_then(|i| self.targets.get(*i)).map_or(0, |(_, _, r)| r.start);
     }
 
     fn advance_empty(&mut self, text: &str, relative_end: usize, end: usize) {
@@ -222,8 +229,8 @@ impl FindContext {
     }
 }
 
-fn target_text<'a>(d: &'a Document, sid: StoryId, r: &Range<usize>) -> Result<&'a str> {
-    d.story(sid)
+fn target_text<'a>(d: &'a Document, sid: StoryId, cell: Option<CellAddr>, r: &Range<usize>) -> Result<&'a str> {
+    d.text_story(sid, cell)
         .ok_or_else(|| bad("find", "no such story"))?
         .text
         .get(r.clone())
@@ -246,7 +253,7 @@ fn scope(s: &Session, p: &Value) -> Result<FindContext> {
     let targets = match domain {
         Domain::Explicit(sid) => {
             let len = d.story(sid).ok_or_else(|| bad("find", "no such story"))?.len();
-            vec![(sid, 0..len)]
+            vec![(sid, None, 0..len)]
         }
         Domain::Story | Domain::Selection => {
             if st.selection.cells.is_some() || st.selection.text.is_some_and(|t| t.cell.is_some()) {
@@ -255,10 +262,21 @@ fn scope(s: &Session, p: &Value) -> Result<FindContext> {
             let t = st.selection.text.ok_or_else(|| bad("find", "no text selected"))?;
             let story = d.story(t.story).ok_or_else(|| bad("find", "no such story"))?;
             let r = if domain == Domain::Selection { t.range() } else { 0..story.len() };
-            target_text(d, t.story, &r)?;
-            vec![(t.story, r)]
+            target_text(d, t.story, None, &r)?;
+            vec![(t.story, None, r)]
         }
-        Domain::Document => d.stories.values().map(|x| (x.id, 0..x.len())).collect(),
+        // Table cells hold their own text outside `stories`; search them right after the story that anchors the table.
+        Domain::Document => d
+            .stories
+            .values()
+            .flat_map(|x| {
+                let cells = x.tables.iter().flat_map(move |(id, t)| {
+                    let cols = t.ncols().max(1);
+                    t.cells.iter().enumerate().map(move |(i, c)| (x.id, Some(CellAddr { table: *id, row: i / cols, col: i % cols }), 0..c.text.len()))
+                });
+                std::iter::once((x.id, None, 0..x.len())).chain(cells)
+            })
+            .collect(),
     };
     let mut context = FindContext {
         document: Arc::downgrade(d),
@@ -285,10 +303,14 @@ fn find(s: &mut Session, p: &Value) -> Result<Value> {
     let context = scope(s, p)?;
     let st = s.doc()?;
     let mut out = Vec::new();
-    for (sid, r) in &context.targets {
-        let text = target_text(&st.doc, *sid, r)?;
+    for (sid, cell, r) in &context.targets {
+        let text = target_text(&st.doc, *sid, *cell, r)?;
         for m in re.find_all(text, MAX_MATCHES.saturating_sub(out.len())).map_err(|e| bad("find", e))? {
-            out.push(json!({"story": sid.0, "start": r.start + m.start, "end": r.start + m.end, "text": text.get(m)}));
+            let mut hit = json!({"story": sid.0, "start": r.start + m.start, "end": r.start + m.end, "text": text.get(m)});
+            if let Some(c) = cell {
+                hit["cell"] = json!({"table": c.table, "row": c.row, "col": c.col});
+            }
+            out.push(hit);
         }
     }
     s.find_context = Some(context);
@@ -317,8 +339,8 @@ fn change(s: &mut Session, p: &Value) -> Result<Value> {
     let targets = scope(s, p)?.targets;
     s.edit(|d, sel| {
         let mut count = 0usize;
-        for (sid, r) in targets {
-            let Some(story) = d.story(sid) else { continue };
+        for (sid, cell, r) in targets {
+            let Some(story) = d.text_story(sid, cell) else { continue };
             // Collect matches first (positions refer to the original text), apply back to front.
             let text = story.text.get(r.clone()).ok_or_else(|| bad("find", "invalid selection bounds or UTF-8 boundary"))?;
             let edits: Vec<(std::ops::Range<usize>, String)> = if grep {
@@ -330,7 +352,7 @@ fn change(s: &mut Session, p: &Value) -> Result<Value> {
             .into_iter()
             .map(|(m, out)| (r.start + m.start..r.start + m.end, out))
             .collect();
-            let Some(st) = d.story_mut(sid) else { continue };
+            let Some(st) = d.text_story_mut(sid, cell) else { continue };
             for (range, new) in edits.iter().rev() {
                 st.replace(range.clone(), new);
                 if !over.is_empty() && !new.is_empty() {
@@ -338,7 +360,7 @@ fn change(s: &mut Session, p: &Value) -> Result<Value> {
                 }
                 count += 1;
             }
-            if let Some(t) = sel.text.as_mut().filter(|t| t.story == sid && t.cell.is_none()) {
+            if let Some(t) = sel.text.as_mut().filter(|t| t.story == sid && t.cell == cell) {
                 // Repair byte validity once against the final story, without remapping valid offsets.
                 let range = t.range();
                 let start = floor_char_boundary(&st.text, range.start);
@@ -365,8 +387,8 @@ fn find_next(s: &mut Session, p: &Value) -> Result<Value> {
     let mut context = scope(s, p)?;
     let st = s.doc()?;
     let mut hit = None;
-    while let Some((sid, r)) = context.order.get(context.target).and_then(|i| context.targets.get(*i)).cloned() {
-        let text = target_text(&st.doc, sid, &r)?;
+    while let Some((sid, cell, r)) = context.order.get(context.target).and_then(|i| context.targets.get(*i)).cloned() {
+        let text = target_text(&st.doc, sid, cell, &r)?;
         let from = context.offset.checked_sub(r.start).ok_or_else(|| bad("find", "invalid search cursor"))?;
         if text.get(from..).is_none() {
             return Err(bad("find", "invalid UTF-8 search cursor"));
@@ -379,7 +401,7 @@ fn find_next(s: &mut Session, p: &Value) -> Result<Value> {
                 context.advance_empty(text, m.end, b);
                 continue;
             }
-            hit = Some((sid, a, b));
+            hit = Some((sid, cell, a, b));
             context.last_match_end = Some(b);
             if m.is_empty() {
                 context.advance_empty(text, m.end, b);
@@ -390,17 +412,22 @@ fn find_next(s: &mut Session, p: &Value) -> Result<Value> {
         }
         context.advance_target();
     }
-    let Some((sid, a, b)) = hit else {
+    let Some((sid, cell, a, b)) = hit else {
         s.find_context = Some(context);
         return Ok(Value::Null);
     };
     let frame = st.doc.story(sid).and_then(|x| x.frames.first().copied());
+    let cell_json = cell.map(|c| json!({"table": c.table, "row": c.row, "col": c.col}));
     let stm = s.doc_mut()?;
-    stm.selection = Selection::text(TextSel { story: sid, anchor: a, focus: b, frame, cell: None });
+    stm.selection = Selection::text(TextSel { story: sid, anchor: a, focus: b, frame, cell });
     stm.bump_revision();
     context.acknowledge(stm);
     s.find_context = Some(context);
-    Ok(json!({"story": sid.0, "start": a, "end": b}))
+    let mut out = json!({"story": sid.0, "start": a, "end": b});
+    if let Some(c) = cell_json {
+        out["cell"] = c;
+    }
+    Ok(out)
 }
 
 #[cfg(test)]
@@ -1007,6 +1034,31 @@ mod tests {
         assert_eq!(s.doc().unwrap().history.undo.len(), history);
     }
 
+    #[test]
+    fn document_scope_searches_and_changes_table_cells() {
+        let (mut s, sid) = scope_session("Ore 12.15 here");
+        scope_select(&mut s, sid, 0, 0);
+        let table = s.execute("table.insert", &json!({"rows": 1, "cols": 2})).unwrap()["table"].as_u64().unwrap();
+        s.execute("table.setCell", &json!({"row": 0, "col": 1, "text": "Ore 12.15"})).unwrap();
+        // The caret sits in the first cell, so Find Next goes to the second cell, then the story.
+        let p = json!({"find": "Ore 12.15", "scope": "document"});
+        let cell = designcraft_doc::CellAddr { table, row: 0, col: 1 };
+        assert_eq!(s.execute("find.next", &p).unwrap(), json!({"story": sid.0, "start": 0, "end": 9, "cell": {"table": table, "row": 0, "col": 1}}));
+        assert_eq!(s.doc().unwrap().selection.text.map(|t| (t.story, t.range(), t.cell)), Some((sid, 0..9, Some(cell))));
+        let next = s.execute("find.next", &p).unwrap();
+        assert!(next.get("start").is_some() && next.get("cell").is_none(), "{next}");
+        let hits = s.execute("find.find", &p).unwrap();
+        let hits = hits.as_array().unwrap();
+        assert_eq!(hits.len(), 2);
+        let in_cell: Vec<_> = hits.iter().filter(|h| h.get("cell").is_some()).collect();
+        assert_eq!(in_cell.len(), 1);
+        assert_eq!((in_cell[0]["cell"]["row"].as_u64(), in_cell[0]["cell"]["col"].as_u64()), (Some(0), Some(1)));
+        let n = s.execute("find.change", &json!({"find": "Ore 12.15", "change": "Ore 13.00", "scope": "document"})).unwrap();
+        assert_eq!(n["count"], 2);
+        assert!(s.execute("find.find", &json!({"find": "12.15", "scope": "document"})).unwrap().as_array().unwrap().is_empty());
+        assert_eq!(s.execute("find.find", &json!({"find": "13.00", "scope": "document"})).unwrap().as_array().unwrap().len(), 2);
+    }
+
     fn child_scope_session(note: bool, child: &str) -> (Session, designcraft_doc::StoryId, designcraft_doc::TextSel) {
         let (mut s, sid) = scope_session("red");
         scope_select(&mut s, sid, 3, 3);
@@ -1051,12 +1103,15 @@ mod tests {
                         p["story"] = json!(sid.0);
                         p["scope"] = json!("selection");
                     }
+                    // Document scope also covers table cells (#1624); an explicit story and footnotes stay top-level.
+                    let in_cell = if explicit || note { 0 } else { child.matches("red").count() };
+                    let changed = if in_cell > 0 { child.replace("red", "blue") } else { child.to_string() };
                     s.doc_mut().unwrap().selection = selection.clone();
-                    assert_eq!(s.execute("find.find", &p).unwrap().as_array().unwrap().len(), 1);
+                    assert_eq!(s.execute("find.find", &p).unwrap().as_array().unwrap().len(), 1 + in_cell);
                     scope_hit(&mut s, &p, sid, 0, 3);
                     s.doc_mut().unwrap().selection = selection.clone();
-                    assert_eq!(s.execute("find.change", &p).unwrap()["count"], 1);
-                    assert_eq!(s.doc().unwrap().doc.text_story(sid, selected.cell).unwrap().text, child);
+                    assert_eq!(s.execute("find.change", &p).unwrap()["count"], 1 + in_cell);
+                    assert_eq!(s.doc().unwrap().doc.text_story(sid, selected.cell).unwrap().text, changed);
                     assert_eq!(s.doc().unwrap().selection, selection, "parent replacement does not clamp child offsets");
                     p["find"] = json!("blue");
                     p["change"] = json!("red");
diff --git a/crates/engine/src/cmd/index.rs b/crates/engine/src/cmd/index.rs
index bb6f0991..38a6bc49 100644
--- a/crates/engine/src/cmd/index.rs
+++ b/crates/engine/src/cmd/index.rs
@@ -72,7 +72,9 @@ fn add_reference(s: &mut Session, p: &Value) -> Result<Value> {
         "currentPage" => IndexRange::CurrentPage,
         "toEndOfStory" => IndexRange::ToEndOfStory,
         "suppressPageRange" => IndexRange::SuppressPageRange,
-        "nextParagraphs" => IndexRange::NextParagraphs(p.get("paragraphs").and_then(Value::as_u64).unwrap_or(1) as u32),
+        "nextParagraphs" => {
+            IndexRange::NextParagraphs(p.get("paragraphs").and_then(Value::as_u64).map_or(1, |x| u32::try_from(x).unwrap_or(u32::MAX)))
+        }
         "see" => IndexRange::See(target()),
         "seeAlso" => IndexRange::SeeAlso(target()),
         r => return Err(bad("index.addReference", format!("unknown range `{r}`"))),
@@ -103,8 +105,9 @@ fn resolve(s: &Session, d: &Document, skip: Option<StoryId>) -> Vec<(StoryId, us
                 IndexRange::ToEndOfStory => page(st.len().saturating_sub(1)),
                 IndexRange::NextParagraphs(n) => {
                     let ranges = st.para_ranges();
-                    let pi = (st.para_at(pos) + *n as usize).min(ranges.len() - 1);
-                    page(ranges[pi].end.saturating_sub(1).max(ranges[pi].start))
+                    let n = usize::try_from(*n).unwrap_or(usize::MAX);
+                    let pi = st.para_at(pos).saturating_add(n).min(ranges.len().saturating_sub(1));
+                    ranges.get(pi).and_then(|r| page(r.end.saturating_sub(1).max(r.start)))
                 }
                 _ => start,
             };
diff --git a/crates/engine/src/cmd/layout.rs b/crates/engine/src/cmd/layout.rs
index 047bd90b..d67f469f 100644
--- a/crates/engine/src/cmd/layout.rs
+++ b/crates/engine/src/cmd/layout.rs
@@ -161,14 +161,25 @@ pub fn specs() -> Vec<CommandSpec> {
             "Insert Pages…",
             ["Layout", "Pages"],
             Some("Cmd+Shift+P"),
-            "{count?: 1, after?: page index (default: last), parent?: id|\"A-Parent\"|\"A\"|null}",
+            "{count?: 1 (1 to 9999), after?: 0-based page index (default: the last page), parent?: id|\"A-Parent\"|\"A\"|null}",
             has_doc,
             |s, p| {
-                let count = p.get("count").and_then(Value::as_u64).unwrap_or(1).clamp(1, 9999) as usize;
+                const ID: &str = "layout.pages.insert";
+                // A count that is given but is not a number of pages used to insert one page:
+                // `0`, `-1` and `1.5` all came out as 1, and 10000 was quietly capped.
+                let count = match p.get("count").filter(|v| !v.is_null()) {
+                    None => 1,
+                    Some(v) => match v.as_u64().filter(|n| (1..=9999).contains(n)).map(|n| n as usize) {
+                        Some(n) => n,
+                        None => return Err(bad(ID, format!("count {v}: 1 to 9999 pages"))),
+                    },
+                };
                 let st = s.doc()?;
                 let n = st.doc.page_count();
+                // An `after` past the last page appends, which `insert_after_u64_max_appends_at_the_end`
+                // pins deliberately.
                 let after = p.get("after").and_then(Value::as_u64).map(|v| usize::try_from(v).unwrap_or(usize::MAX)).unwrap_or(n.saturating_sub(1));
-                let parent = parent_ref("layout.pages.insert", &st.doc, p.get("parent"))?.unwrap_or_else(|| st.doc.parents.first().map(|x| x.id));
+                let parent = parent_ref(ID, &st.doc, p.get("parent"))?.unwrap_or_else(|| st.doc.parents.first().map(|x| x.id));
                 s.edit(|d, _| {
                     let ids = d.insert_pages(Some(after), count, parent)?;
                     Ok(json!({"pages": ids.len(), "total": d.page_count()}))
@@ -2497,3 +2508,34 @@ mod parent_base_tests {
 #[cfg(test)]
 #[path = "parent_delete_tests.rs"]
 mod parent_delete_tests;
+
+#[cfg(test)]
+mod insert_count_tests {
+    use serde_json::json;
+
+    use crate::Session;
+
+    /// A count that is given but is not a number of pages used to insert one page anyway:
+    /// `{"count": 0}` added a page, `-1` and `1.5` added one each, and `10000` was quietly capped
+    /// to 9999. A position past the last page appends, which is deliberate.
+    #[test]
+    fn a_page_count_insert_pages_cannot_mean_is_refused() {
+        let mut s = Session::new();
+        s.execute("file.new", &json!({"pages": 2, "facingPages": false})).unwrap();
+        let total = |s: &mut Session| s.execute("layout.pages.insert", &json!({"count": 1})).unwrap()["total"].as_u64().unwrap();
+        assert_eq!(total(&mut s), 3, "one page added");
+
+        for params in [json!({"count": 0}), json!({"count": -1}), json!({"count": 1.5}), json!({"count": 10000}), json!({"count": "two"})] {
+            let e = s.execute("layout.pages.insert", &params).expect_err("refused").to_string();
+            assert!(e.contains("1 to 9999 pages"), "{params}: {e}");
+        }
+        // Nothing was inserted by any of those.
+        assert_eq!(s.doc().unwrap().doc.page_count(), 3);
+        // A position past the last page still appends, which `insert_pages_bounds.rs` pins.
+        let r = s.execute("layout.pages.insert", &json!({"after": 99})).unwrap();
+        assert_eq!((r["pages"].as_u64(), r["total"].as_u64()), (Some(1), Some(4)));
+        // The positions it does have still work: after the first page of three.
+        let r = s.execute("layout.pages.insert", &json!({"count": 2, "after": 0})).unwrap();
+        assert_eq!((r["pages"].as_u64(), r["total"].as_u64()), (Some(2), Some(6)));
+    }
+}
diff --git a/crates/engine/src/cmd/links.rs b/crates/engine/src/cmd/links.rs
index 6623b6cb..b2cb88fd 100644
--- a/crates/engine/src/cmd/links.rs
+++ b/crates/engine/src/cmd/links.rs
@@ -144,7 +144,7 @@ pub fn link_missing(a: &designcraft_doc::Asset, document: Option<&Path>) -> bool
     let Some(link) = &a.link else { return false };
     #[cfg(not(target_arch = "wasm32"))]
     {
-        crate::io::document_path(link, document).map_or(true, |path| !crate::io::exists(path))
+        !crate::io::document_path(link, document).is_ok_and(crate::io::exists)
     }
     #[cfg(target_arch = "wasm32")]
     {
@@ -490,8 +490,18 @@ fn relink_folder(s: &mut Session, p: &Value) -> Result<Value> {
             Some(dir) => Some(dir.clone()),
             None => a.link.as_deref().and_then(|l| crate::io::document_path(l, document).ok()).and_then(|p| p.parent().map(Path::to_path_buf)),
         };
-        let plain_name = name.to_str().is_some_and(|n| !n.contains(['/', '\\']) && craft_docpath::is_local(n));
-        let cand = folder.filter(|_| plain_name).map(|f| f.join(&name));
+        let plain_name = name.to_str().filter(|n| !n.contains(['/', '\\']));
+        // A name that resolves to another file name (a `file:` URL such as `file:%2Ftmp%2Fx.png`,
+        // a drive-relative `C:x.png`) or a folder the stored-path rules read differently (`a\b`
+        // on Unix, `alias/..` through a symlink) could lead outside the folder, so only the name
+        // itself, directly in the folder as the file system resolves it, counts. The link keeps
+        // the folder as given.
+        let cand = folder.zip(plain_name).and_then(|(f, n)| {
+            let c = crate::io::folder_path(n, &f).ok()?;
+            let real = |p: &Path| crate::io::canonicalize(p).ok();
+            let same_folder = c.parent().and_then(real).is_some_and(|p| real(&f) == Some(p));
+            (c.file_name().is_some_and(|c| c == n) && same_folder).then_some(c)
+        });
         if let Some(cand) = cand.filter(|c| crate::io::exists(c)) {
             todo.push((a.id, cand));
         } else {
diff --git a/crates/engine/src/cmd/object.rs b/crates/engine/src/cmd/object.rs
index 4ccb5c82..87f60160 100644
--- a/crates/engine/src/cmd/object.rs
+++ b/crates/engine/src/cmd/object.rs
@@ -686,7 +686,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Align",
             ["Window", "Object & Layout", "Align"],
             None,
-            "{edge: left|hcenter|right|top|vcenter|bottom, to?: selection|keyObject|margins|page|spread, ids?}",
+            "{edge: left|hcenter|right|top|vcenter|bottom, to?: selection|keyObject|margins|page|spread (default: keyObject while a key object is set), ids?}",
             has_selection,
             align
         ),
@@ -708,7 +708,7 @@ pub fn specs() -> Vec<CommandSpec> {
             super::always,
             |s, p| {
                 if let Some(n) = p.get("sides").and_then(Value::as_u64) {
-                    s.prefs.polygon_sides = (n as u32).clamp(3, 100);
+                    s.prefs.polygon_sides = n.clamp(3, 100) as u32;
                 }
                 if let Some(v) = p.get("starInset").and_then(Value::as_f64) {
                     s.prefs.star_inset = (v / 100.0).clamp(0.0, 1.0);
@@ -972,7 +972,7 @@ fn frame_create(s: &mut Session, p: &Value) -> Result<Value> {
     let text = super::text_param(p, "text");
     let caret = bool_or(p, "caret", content == "text");
     let vertical = bool_or(p, "vertical", false);
-    let sides = p.get("sides").and_then(Value::as_u64).map_or(s.prefs.polygon_sides, |v| v as u32).clamp(3, 100);
+    let sides = p.get("sides").and_then(Value::as_u64).unwrap_or(u64::from(s.prefs.polygon_sides)).clamp(3, 100) as u32;
     let inset = p.get("starInset").and_then(Value::as_f64).map_or(s.prefs.star_inset, |v| v / 100.0).clamp(0.0, 1.0);
     let rect = Rect::new(rect.x0, rect.y0, rect.x1.max(rect.x0 + 0.5), rect.y1.max(rect.y0 + 0.5));
     s.edit(|d, sel| {
@@ -2517,7 +2517,7 @@ fn text_frame_options(s: &mut Session, p: &Value) -> Result<Value> {
             let Some(tf) = d.item_mut(*id).and_then(Item::text_frame_mut) else { continue };
             let o = &mut tf.options;
             if let Some(v) = p.get("columns").and_then(Value::as_u64) {
-                o.columns = (v as u32).clamp(1, 40);
+                o.columns = v.clamp(1, 40) as u32;
             }
             if let Some(v) = p.get("gutter").and_then(Value::as_f64) {
                 o.gutter = v.max(0.0);
@@ -3074,8 +3074,18 @@ fn align_reference(d: &Document, ids: &[ItemId], to: &str, key: Option<ItemId>)
 fn align(s: &mut Session, p: &Value) -> Result<Value> {
     let ids = targets(s, p)?;
     let edge = str_param(p, "edge").unwrap_or("left").to_string();
-    let to = str_param(p, "to").map(str::to_string).unwrap_or_else(|| if ids.len() > 1 { "selection".into() } else { "page".into() });
-    let key = s.doc()?.selection.key;
+    // A key object counts only while it is one of several items aligned. With one, InDesign's
+    // Align To switches to Key Object, so it is also the default target.
+    let key = s.doc()?.selection.key.filter(|k| ids.len() > 1 && ids.contains(k));
+    let to = str_param(p, "to").map(str::to_string).unwrap_or_else(|| {
+        if key.is_some() {
+            "keyObject".into()
+        } else if ids.len() > 1 {
+            "selection".into()
+        } else {
+            "page".into()
+        }
+    });
     s.edit(|d, _| {
         let r = align_reference(d, &ids, &to, key).ok_or_else(|| bad("object.align", "nothing to align"))?;
         for id in &ids {
@@ -3788,6 +3798,21 @@ mod polygon_tests {
             .unwrap();
         assert_eq!(s.doc().unwrap().doc.item(ItemId(id)).unwrap().path.subpaths[0].anchors.len(), 3);
     }
+
+    #[test]
+    fn polygon_sides_clamp_before_narrowing() {
+        let mut s = Session::new();
+        s.execute("file.new", &json!({})).unwrap();
+        let r = s.execute("tool.polygonSettings", &json!({"sides": 4294967301u64})).unwrap();
+        assert_eq!(r["sides"], 100);
+        let r = s.execute("tool.polygonSettings", &json!({"sides": 4294967297u64})).unwrap();
+        assert_eq!(r["sides"], 100);
+        let id =
+            s.execute("frame.create", &json!({"rect": [0, 0, 50, 50], "shape": "polygon", "sides": 4294967301u64, "starInset": 0})).unwrap()["id"]
+                .as_u64()
+                .unwrap();
+        assert_eq!(s.doc().unwrap().doc.item(ItemId(id)).unwrap().path.subpaths[0].anchors.len(), 100);
+    }
 }
 
 #[cfg(test)]
@@ -4498,6 +4523,21 @@ mod column_rule_tests {
         s.execute("edit.undo", &json!({})).unwrap();
         assert_eq!(opts(&s), before);
     }
+
+    /// A column count past `u32::MAX` was cast to `u32` before the clamp, so
+    /// 2^32 + 1 wrapped to 1 column instead of clamping to the maximum, 40.
+    #[test]
+    fn huge_column_count_clamps_to_the_maximum() {
+        let mut s = Session::new();
+        s.execute("file.new", &json!({})).unwrap();
+        let r = s.execute("frame.create", &json!({"rect": [36, 36, 300, 300], "content": "text"})).unwrap();
+        let id = ItemId(r["id"].as_u64().unwrap());
+        let columns = |s: &Session| s.doc().unwrap().doc.item(id).unwrap().text_frame().unwrap().options.columns;
+        for (given, want) in [(4_294_967_297_u64, 40), (u64::MAX, 40), (0, 1)] {
+            s.execute("object.textFrameOptions", &json!({"ids": [id.0], "columns": given})).unwrap();
+            assert_eq!(columns(&s), want, "columns {given}");
+        }
+    }
 }
 
 #[cfg(test)]
diff --git a/crates/engine/src/cmd/pdflayers.rs b/crates/engine/src/cmd/pdflayers.rs
index 9ef69761..e5cca382 100644
--- a/crates/engine/src/cmd/pdflayers.rs
+++ b/crates/engine/src/cmd/pdflayers.rs
@@ -42,6 +42,22 @@ pub fn specs() -> Vec<CommandSpec> {
                 if ids.iter().all(|id| placed_pdf(s, *id).is_none()) {
                     return Err(bad("object.layerOptions", "select a placed PDF"));
                 }
+                // Validate every selected PDF before editing any item or recording undo.
+                // Repeated placements of the same source need only one rewrite check.
+                if !hidden.is_empty() {
+                    let mut checked = std::collections::HashSet::new();
+                    for id in &ids {
+                        if let Some(data) = placed_pdf(s, *id)
+                            && checked.insert(std::sync::Arc::as_ptr(&data))
+                            && designcraft_render::pdf_hide_layers(&data, &hidden).is_none()
+                        {
+                            return Err(bad(
+                                "object.layerOptions",
+                                "the selected PDF layers could not be hidden; use the file defaults or replace the unsupported PDF",
+                            ));
+                        }
+                    }
+                }
                 s.edit(|d, _| {
                     for id in &ids {
                         if let Some(it) = d.item_mut(*id) {
@@ -67,9 +83,15 @@ pub(crate) mod tests {
     }
 
     fn two_layer_pdf_generation(generation: i32) -> Vec<u8> {
+        two_layer_pdf_options(generation, "", "")
+    }
+
+    fn two_layer_pdf_options(generation: i32, config: &str, trailer: &str) -> Vec<u8> {
         let content = "/OC /a BDC 0 0 1 rg 0 0 50 100 re f EMC /OC /b BDC 1 0 0 rg 50 0 50 100 re f EMC";
         let objs = [
-            "<</Type/Catalog/Lang(en-GB)/Metadata 7 0 R/OutputIntents[8 0 R]/Pages 2 0 R/OCProperties<</OCGs[5 0 R 6 0 R]/D<</Order[5 0 R 6 0 R]/Name(Default)/Locked[5 0 R]>>>>>>".to_string(),
+            format!(
+                "<</Type/Catalog/Lang(en-GB)/Metadata 7 0 R/OutputIntents[8 0 R]/Pages 2 0 R/OCProperties<</OCGs[5 0 R 6 0 R]/D<</Order[5 0 R 6 0 R]/Name(Default)/Locked[5 0 R]{config}>>>>>>"
+            ),
             "<</Type/Pages/Kids[3 0 R]/Count 1>>".to_string(),
             "<</Type/Page/Parent 2 0 R/MediaBox[0 0 100 100]/Resources<</Properties<</a 5 0 R/b 6 0 R>>>>/Contents 4 0 R>>".to_string(),
             format!("<</Length {}>>\nstream\n{content}\nendstream", content.len()),
@@ -89,7 +111,7 @@ pub(crate) mod tests {
         for o in offs {
             t.push_str(&format!("{o:010} {generation:05} n\r\n"));
         }
-        t.push_str(&format!("trailer\n<</Size {}/Root 1 {generation} R>>\nstartxref\n{x}\n%%EOF\n", objs.len() + 1));
+        t.push_str(&format!("trailer\n<</Size {}/Root 1 {generation} R{trailer}>>\nstartxref\n{x}\n%%EOF\n", objs.len() + 1));
         out.extend_from_slice(t.as_bytes());
         out
     }
@@ -135,7 +157,7 @@ pub(crate) mod tests {
         stream_pdf.extend_from_slice(format!("\nendstream\nendobj\nstartxref\n{offset}\n%%EOF\n").as_bytes());
         let updated = designcraft_render::pdf_hide_layers(&stream_pdf, &["Red".into()]).unwrap();
         assert_eq!(designcraft_render::pdf_layers(&updated), vec![("Blue".into(), true), ("Red".into(), false)]);
-        for unsupported in ["/Encrypt null", "/XRefStm 0"] {
+        for unsupported in ["/Encrypt 7 0 R", "/Encrypt << /Filter /Standard >>", "/XRefStm 0"] {
             let altered = text.replace("/Size 9", &format!("{unsupported}/Size 9"));
             assert!(designcraft_render::pdf_hide_layers(altered.as_bytes(), &["Red".into()]).is_none());
         }
@@ -161,6 +183,151 @@ pub(crate) mod tests {
         assert!(designcraft_render::pdf_hide_layers(&cyclic, &[]).is_none());
     }
 
+    fn add_pdf_revision(bytes: &mut Vec<u8>) {
+        let text = std::str::from_utf8(bytes).unwrap();
+        let prev: usize = text.rsplit_once("startxref").unwrap().1.split_whitespace().next().unwrap().parse().unwrap();
+        let xref = bytes.len();
+        bytes.extend_from_slice(
+            format!("xref\n0 1\n0000000000 65535 f\r\ntrailer\n<</Size 9/Root 1 0 R/Prev {prev}>>\nstartxref\n{xref}\n%%EOF\n").as_bytes(),
+        );
+    }
+
+    fn place(s: &mut Session, bytes: &[u8], x: f64) -> serde_json::Value {
+        s.execute("file.place", &json!({"base64": super::super::file::base64_encode(bytes), "name": "layers.pdf", "x": x, "y": 0, "width": 100}))
+            .unwrap()["id"]
+            .clone()
+    }
+
+    fn pixel(s: &Session, x: u32) -> [u8; 4] {
+        let mut renderer = designcraft_render::Renderer::new();
+        renderer.threads = 0;
+        renderer.render_page(&s.doc().unwrap().doc, &s.cache, 0, 1.0, false, &Default::default()).unwrap().pixel(x, 50)
+    }
+
+    #[test]
+    fn null_encryption_entry_keeps_layer_editing_rendering_and_export_working() {
+        for generation in [0, 1] {
+            let bytes = two_layer_pdf_options(generation, "", "/Encrypt null");
+            let mut s = Session::new();
+            s.execute("file.new", &json!({"width": 100, "height": 100, "pages": 1})).unwrap();
+            let id = place(&mut s, &bytes, 0.0);
+            s.execute("object.layerOptions", &json!({"ids": [id], "hidden": ["Red"]})).unwrap();
+            assert_eq!(s.execute("object.pdfLayers", &json!({"id": id})).unwrap()[1]["visible"], false);
+            assert_eq!(pixel(&s, 25), [0, 0, 255, 255]);
+            assert_eq!(pixel(&s, 75), [255, 255, 255, 255]);
+            s.execute("file.exportPdf", &json!({})).unwrap();
+            s.execute("edit.undo", &json!({})).unwrap();
+            assert_eq!(pixel(&s, 75), [255, 0, 0, 255]);
+            s.execute("edit.redo", &json!({})).unwrap();
+            assert_eq!(pixel(&s, 75), [255, 255, 255, 255]);
+        }
+    }
+
+    #[test]
+    fn unrewritable_layer_choices_are_rejected_atomically_without_an_undo_step() {
+        let mut unsupported = two_layer_pdf();
+        for _ in 0..32 {
+            add_pdf_revision(&mut unsupported);
+        }
+        assert_eq!(designcraft_render::pdf_layers(&unsupported).len(), 2);
+        assert!(designcraft_render::pdf_hide_layers(&unsupported, &["Red".into()]).is_none());
+        let mut s = Session::new();
+        s.execute("file.new", &json!({"width": 200, "height": 100, "pages": 1})).unwrap();
+        let good = place(&mut s, &two_layer_pdf(), 0.0);
+        let bad = place(&mut s, &unsupported, 100.0);
+        s.execute("object.layerOptions", &json!({"ids": [good], "hidden": ["Blue"]})).unwrap();
+        s.execute("edit.undo", &json!({})).unwrap();
+        assert!(!s.doc().unwrap().history.redo.is_empty());
+        let before = s.execute("file.serialize", &json!({})).unwrap();
+        let undo = s.doc().unwrap().history.undo.len();
+        let redo = s.doc().unwrap().history.redo.len();
+        for ids in [json!([good, bad]), json!([bad, good])] {
+            let err = s.execute("object.layerOptions", &json!({"ids": ids, "hidden": ["Red"]})).unwrap_err();
+            assert!(err.to_string().contains("could not be hidden"));
+            assert_eq!(s.execute("file.serialize", &json!({})).unwrap(), before);
+            assert_eq!(s.doc().unwrap().history.undo.len(), undo);
+            assert_eq!(s.doc().unwrap().history.redo.len(), redo);
+            for id in [&good, &bad] {
+                assert_eq!(s.execute("object.pdfLayers", &json!({"id": id})).unwrap()[1]["visible"], true);
+            }
+        }
+        assert_eq!(pixel(&s, 75), [255, 0, 0, 255]);
+        assert_eq!(pixel(&s, 175), [255, 0, 0, 255]);
+        // A persisted/relinked choice can be unrewritable. Reset must still work.
+        let bad_id = serde_json::from_value(bad.clone()).unwrap();
+        std::sync::Arc::make_mut(&mut s.doc_mut().unwrap().doc).item_mut(bad_id).unwrap().pdf_hidden_layers = vec!["Red".into()];
+        assert_eq!(pixel(&s, 175), [255, 255, 255, 255], "stale hidden content must not reappear on canvas");
+        assert!(s.execute("file.exportPdf", &json!({})).is_err());
+        s.execute("object.layerOptions", &json!({"ids": [good, bad], "hidden": []})).unwrap();
+        assert_eq!(s.execute("object.pdfLayers", &json!({"id": bad})).unwrap()[1]["visible"], true);
+        s.execute("file.exportPdf", &json!({})).unwrap();
+    }
+
+    #[test]
+    fn fake_null_trailer_cannot_bypass_hybrid_rejection() {
+        for real_guard in ["", "/XRefStm 0"] {
+            let bytes = two_layer_pdf_options(0, "", real_guard);
+            let text = std::str::from_utf8(&bytes).unwrap();
+            for fake in ["/Encrypt null", ""] {
+                let comment = format!("% trailer <</Size 9/Root 1 0 R{fake}>>\n");
+                let inside = text.replacen("xref\n", &format!("xref\n{comment}"), 1);
+                assert!(inside.contains(&format!("xref\n{comment}")));
+                // Repair-only comments inside a table are always refused, guard or not.
+                assert_eq!(designcraft_render::pdf_layers(inside.as_bytes()).len(), 2);
+                assert!(designcraft_render::pdf_hide_layers(inside.as_bytes(), &["Red".into()]).is_none());
+                // Before xref or after the dictionary, the real trailer decides.
+                let leading = text.replacen("xref\n", &format!("{comment}xref\n"), 1);
+                let trailing = text.replacen("startxref\n", &format!("{comment}startxref\n"), 1);
+                for source in [leading, trailing] {
+                    assert_eq!(designcraft_render::pdf_layers(source.as_bytes()).len(), 2);
+                    assert_eq!(designcraft_render::pdf_hide_layers(source.as_bytes(), &["Red".into()]).is_some(), real_guard.is_empty());
+                }
+            }
+        }
+    }
+
+    #[test]
+    fn content_all_still_measures_layerless_and_stub_properties() {
+        use designcraft_doc::PdfCrop;
+        for props in ["", "/OCProperties null", "/OCProperties<<>>", "/OCProperties<</OCGs[]/D<<>>>>"] {
+            let content = "0 0 1 rg 0 0 50 100 re f";
+            let objs = [
+                format!("<</Type/Catalog/Pages 2 0 R{props}>>"),
+                "<</Type/Pages/Kids[3 0 R]/Count 1>>".into(),
+                "<</Type/Page/Parent 2 0 R/MediaBox[0 0 100 100]/Contents 4 0 R>>".into(),
+                format!("<</Length {}>>\nstream\n{content}\nendstream", content.len()),
+            ];
+            let mut bytes = b"%PDF-1.7\n".to_vec();
+            let mut offsets = Vec::new();
+            for (i, body) in objs.iter().enumerate() {
+                offsets.push(bytes.len());
+                bytes.extend_from_slice(format!("{} 0 obj\n{body}\nendobj\n", i + 1).as_bytes());
+            }
+            let xref = bytes.len();
+            bytes.extend_from_slice(b"xref\n0 5\n0000000000 65535 f\r\n");
+            for at in offsets {
+                bytes.extend_from_slice(format!("{at:010} 00000 n\r\n").as_bytes());
+            }
+            bytes.extend_from_slice(format!("trailer\n<</Size 5/Root 1 0 R>>\nstartxref\n{xref}\n%%EOF\n").as_bytes());
+            assert!(designcraft_render::pdf_layers(&bytes).is_empty());
+            assert_eq!(designcraft_render::pdf_crop_box(&bytes, 0, PdfCrop::ContentAll).unwrap().1, (50.0, 100.0), "{props}");
+        }
+    }
+
+    #[test]
+    fn content_all_keeps_the_whole_page_when_layer_rewriting_is_unsupported() {
+        use designcraft_doc::PdfCrop;
+        let mut bytes = two_layer_pdf_options(0, "/BaseState/OFF/ON[5 0 R]", "");
+        assert_eq!(designcraft_render::pdf_crop_box(&bytes, 0, PdfCrop::ContentVisible).unwrap().1, (50.0, 100.0));
+        assert_eq!(designcraft_render::pdf_crop_box(&bytes, 0, PdfCrop::ContentAll).unwrap().1, (100.0, 100.0));
+        for _ in 0..32 {
+            add_pdf_revision(&mut bytes);
+        }
+        assert!(designcraft_render::pdf_hide_layers(&bytes, &[]).is_none());
+        assert_eq!(designcraft_render::pdf_crop_box(&bytes, 0, PdfCrop::ContentVisible).unwrap().1, (50.0, 100.0));
+        assert_eq!(designcraft_render::pdf_crop_box(&bytes, 0, PdfCrop::ContentAll).unwrap(), ([0.0, 0.0, 1.0, 1.0], (100.0, 100.0)));
+    }
+
     #[test]
     fn placed_pdf_layers_hide() {
         let mut s = Session::new();
diff --git a/crates/engine/src/cmd/place_text.rs b/crates/engine/src/cmd/place_text.rs
index c54b5508..1053fafc 100644
--- a/crates/engine/src/cmd/place_text.rs
+++ b/crates/engine/src/cmd/place_text.rs
@@ -233,11 +233,12 @@ fn same_rect(a: Rect, b: Rect) -> bool {
 }
 
 /// Thread new frames until the story fits: first into the columns after the last frame's column
-/// on its page (when it sits in one), then one frame per column on each page it adds. With
-/// `primary` (Smart Text Reflow of the primary text frame), each added page gets one frame on the
-/// live area with the page's columns instead. Empty frames it made at the end of the thread are
-/// removed again, except the first on a page it didn't add; a page it added that holds only such
-/// a frame goes with it. Returns pages added.
+/// on its page (when it sits in one), then one frame per column on each page that follows it,
+/// whatever else the page holds, and on each page it adds at the end of the document, as InDesign
+/// does. With `primary` (Smart Text Reflow of the primary text frame), pages are added right after
+/// the last frame's page, each with one frame on the live area with the page's columns instead.
+/// Empty frames it made at the end of the thread are removed again; a page it added that holds
+/// only such a frame goes with it. Returns pages added.
 /// A story on a parent spread doesn't autoflow: its frames thread only on that parent. Errors
 /// name `cmd`, the command that autoflows.
 pub(crate) fn autoflow(d: &mut Document, sid: StoryId, max_pages: usize, cmd: &str, primary: bool) -> Result<usize> {
@@ -252,6 +253,8 @@ pub(crate) fn autoflow(d: &mut Document, sid: StoryId, max_pages: usize, cmd: &s
     let mut made = Vec::new();
     let mut new_pages = Vec::new();
     let mut first = true;
+    // The next page of the document autoflow may set frames on; it only moves forward.
+    let mut following = 0;
     loop {
         let (overset, held, full) = fit(d, sid);
         let Some(at) = overset else { break };
@@ -267,16 +270,33 @@ pub(crate) fn autoflow(d: &mut Document, sid: StoryId, max_pages: usize, cmd: &s
             let rects = flow_rects(d, dir, vertical, page);
             let next = d.item(last).and_then(|it| rects.iter().position(|r| same_rect(*r, it.bounds()))).map_or(rects.len(), |k| k + 1);
             if let (Some(rest), Some((si, _))) = (rects.get(next..).filter(|r| !r.is_empty()), d.page_loc(page)) {
-                for r in rest.iter().take(want) {
+                // Whole pages: an estimate that stops inside one would leave its later columns out
+                // of the thread for good. The cleanup below takes the frames the text doesn't reach.
+                for r in rest {
                     prev = add_flow_frame(d, si, *r, layer, prev)?;
                     made.push(prev);
                 }
                 continue;
             }
         }
+        following = following.max(page + 1);
+        if !primary && following < d.page_count() {
+            let mut left = want;
+            while left > 0 && following < d.page_count() {
+                let Some((si, _)) = d.page_loc(following) else { break };
+                for r in flow_rects(d, dir, vertical, following) {
+                    prev = add_flow_frame(d, si, r, layer, prev)?;
+                    made.push(prev);
+                    left = left.saturating_sub(1);
+                }
+                following += 1;
+            }
+            continue;
+        }
         if added >= max_pages {
             return Err(bad(cmd, format!("autoflow stopped after {max_pages} pages")));
         }
+        // Past the following pages, `page` is the document's last: autoflow adds pages at its end.
         let per_page = if vertical { 1 } else { d.page(page).map_or(1, |p| p.column_rects().len().max(1)) };
         let pages = want.div_ceil(per_page).clamp(1, max_pages - added);
         let parent = d.page_loc(page).and_then(|(si, pi)| d.spreads[si].pages[pi].parent);
@@ -304,16 +324,23 @@ pub(crate) fn autoflow(d: &mut Document, sid: StoryId, max_pages: usize, cmd: &s
         }
         let page = d.page_of_item(f);
         if d.page_of_item(*before) != page {
-            // The first frame on its page: the estimate added more pages than the text needs.
-            // Drop the page too when autoflow added it and the frame is all it holds.
-            let Some(pg) = page.filter(|pg| d.page(*pg).is_some_and(|p| new_pages.contains(&p.id))) else { break };
-            let alone = d.spreads.iter().flat_map(|sp| sp.items.iter()).all(|it| it.id == f || d.page_of_item(it.id) != Some(pg));
-            if !alone {
-                break;
+            // The first frame on its page: the estimate asked for more pages than the text needs.
+            // Drop the page too when autoflow added it and the frame is all it holds; a page the
+            // document had keeps whatever else is on it.
+            match page.filter(|pg| d.page(*pg).is_some_and(|p| new_pages.contains(&p.id))) {
+                Some(pg) => {
+                    let alone = d.spreads.iter().flat_map(|sp| sp.items.iter()).all(|it| it.id == f || d.page_of_item(it.id) != Some(pg));
+                    if !alone {
+                        break;
+                    }
+                    d.remove_item(f)?;
+                    d.delete_pages(&[pg])?;
+                    added = added.saturating_sub(1);
+                }
+                None => {
+                    d.remove_item(f)?;
+                }
             }
-            d.remove_item(f)?;
-            d.delete_pages(&[pg])?;
-            added = added.saturating_sub(1);
         } else {
             d.remove_item(f)?;
         }
@@ -568,6 +595,141 @@ mod tests {
         let _ = std::fs::remove_dir_all(&dir);
     }
 
+    /// A facing-pages document with two columns, its inside margin wider than the outside one, so
+    /// left and right pages have their columns in different places. A graphic frame sits on the
+    /// page `marker` (0-based). Returns the session and the marker's id.
+    fn facing_document(pages: usize, marker: usize) -> (Session, u64) {
+        let mut s = Session::new();
+        let margins = json!({"top": 54, "bottom": 54, "inside": 72, "outside": 36});
+        s.execute("file.new", &json!({"preset": "Letter", "pages": pages, "facingPages": true, "columns": 2, "gutter": 18, "margins": margins}))
+            .unwrap();
+        let d = &s.doc().unwrap().doc;
+        let (si, _) = d.page_loc(marker).unwrap();
+        let m = d.page(marker).unwrap().margin_rect();
+        let rect = [m.x0 + 20.0, m.y0 + 20.0, m.x0 + 120.0, m.y0 + 120.0];
+        let id = s.execute("frame.create", &json!({"rect": rect, "spread": si, "content": "unassigned"})).unwrap()["id"].as_u64().unwrap();
+        // Selected, an empty frame would take the placed text.
+        s.execute("edit.deselectAll", &json!({})).unwrap();
+        (s, id)
+    }
+
+    /// Every frame of the story on the column of its page, the story running through the pages in
+    /// order, two frames a page.
+    fn assert_frames_in_columns(d: &Document, frames: &[designcraft_doc::ItemId]) {
+        for (i, f) in frames.iter().enumerate() {
+            let page = d.page_of_item(*f).unwrap();
+            assert_eq!(page, i / 2, "frame {i}");
+            assert_eq!(d.item(*f).unwrap().bounds(), d.page(page).unwrap().column_rects()[i % 2], "frame {i}");
+        }
+    }
+
+    #[test]
+    fn autoflow_fills_the_pages_that_follow_before_adding_any() {
+        // Gap 26: autoflow inserted pages after the first frame's page, in front of the empty
+        // pages the document already had. InDesign threads frames on those first.
+        let dir = std::env::temp_dir().join(format!("dc-place-following-{}", std::process::id()));
+        std::fs::create_dir_all(&dir).unwrap();
+        let path = dir.join("long.txt");
+        std::fs::write(&path, vec!["Lorem ipsum dolor sit amet, consectetur adipiscing elit. ".repeat(12); 24].join("\n")).unwrap();
+        let (mut s, marker) = facing_document(6, 2);
+        let ids: Vec<_> = (0..6).map(|i| s.doc().unwrap().doc.page(i).unwrap().id).collect();
+        let r = s.execute("file.place", &json!({"path": path.to_string_lossy(), "page": 1, "autoflow": true})).unwrap();
+        assert_eq!(r["overset"], false, "{r}");
+        assert_eq!(r["pagesAdded"], 0, "{r}");
+        let d = &s.doc().unwrap().doc;
+        assert_eq!((0..d.page_count()).map(|i| d.page(i).unwrap().id).collect::<Vec<_>>(), ids);
+        let sid = StoryId(r["story"].as_u64().unwrap());
+        let frames = d.story(sid).unwrap().frames.clone();
+        // Past page 3, which holds the marker: frames go on a page whatever else it holds.
+        assert!(d.page_of_item(*frames.last().unwrap()).unwrap() > 2, "{} frames", frames.len());
+        assert_frames_in_columns(d, &frames);
+        // The text ends before the document does: no empty frame after it.
+        let cs = designcraft_compose::compose_story(d, sid, &Default::default());
+        assert!(frames.iter().all(|f| cs.frame(*f).is_some_and(|ft| !ft.range.is_empty())));
+        assert!(d.page_of_item(*frames.last().unwrap()).unwrap() < 5);
+        assert_eq!(d.page_of_item(designcraft_doc::ItemId(marker)), Some(2));
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
+    #[test]
+    fn autoflow_adds_pages_at_the_end_of_the_document() {
+        let dir = std::env::temp_dir().join(format!("dc-place-end-{}", std::process::id()));
+        std::fs::create_dir_all(&dir).unwrap();
+        let path = dir.join("long.txt");
+        std::fs::write(&path, vec!["Lorem ipsum dolor sit amet, consectetur adipiscing elit. ".repeat(12); 60].join("\n")).unwrap();
+        let (mut s, marker) = facing_document(3, 2);
+        let ids: Vec<_> = (0..3).map(|i| s.doc().unwrap().doc.page(i).unwrap().id).collect();
+        let r = s.execute("file.place", &json!({"path": path.to_string_lossy(), "page": 1, "autoflow": true})).unwrap();
+        assert_eq!(r["overset"], false, "{r}");
+        let d = &s.doc().unwrap().doc;
+        assert!(d.page_count() > 4, "{r}");
+        assert_eq!(r["pagesAdded"].as_u64(), Some(d.page_count() as u64 - 3), "{r}");
+        // The document's own pages come first, the added ones after the last of them.
+        assert_eq!((0..3).map(|i| d.page(i).unwrap().id).collect::<Vec<_>>(), ids);
+        assert_eq!(d.page_of_item(designcraft_doc::ItemId(marker)), Some(2));
+        let frames = d.story(StoryId(r["story"].as_u64().unwrap())).unwrap().frames.clone();
+        assert_frames_in_columns(d, &frames);
+        assert_eq!(d.page_of_item(*frames.last().unwrap()), Some(d.page_count() - 1));
+        // One undo step takes the frames, the pages and the story away.
+        s.execute("edit.undo", &json!({})).unwrap();
+        let d = &s.doc().unwrap().doc;
+        assert_eq!((0..d.page_count()).map(|i| d.page(i).unwrap().id).collect::<Vec<_>>(), ids);
+        assert!(d.story(StoryId(r["story"].as_u64().unwrap())).is_none());
+        assert_eq!(d.spreads.iter().map(|sp| sp.items.len()).sum::<usize>(), 1);
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
+    #[test]
+    fn autoflow_fills_every_column_of_a_following_page() {
+        // A first frame across the whole live area holds twice what a column does, so autoflow
+        // asks for half the frames it needs. Asked page by page, it left the later columns of a
+        // page out of the thread and went on to the next page.
+        let dir = std::env::temp_dir().join(format!("dc-place-under-{}", std::process::id()));
+        std::fs::create_dir_all(&dir).unwrap();
+        let path = dir.join("long.txt");
+        std::fs::write(&path, vec!["Lorem ipsum dolor sit amet, consectetur adipiscing elit. ".repeat(12); 30].join("\n")).unwrap();
+        let mut s = Session::new();
+        s.execute("file.new", &json!({"preset": "Letter", "pages": 6, "facingPages": false, "columns": 2, "gutter": 18, "margins": 54})).unwrap();
+        let m = s.doc().unwrap().doc.page(0).unwrap().margin_rect();
+        let r = s.execute("file.place", &json!({"path": path.to_string_lossy(), "rect": [m.x0, m.y0, m.x1, m.y1], "autoflow": true})).unwrap();
+        assert_eq!(r["overset"], false, "{r}");
+        assert_eq!(r["pagesAdded"], 0, "{r}");
+        let d = &s.doc().unwrap().doc;
+        let frames = &d.story(StoryId(r["story"].as_u64().unwrap())).unwrap().frames;
+        assert_eq!(d.item(frames[0]).unwrap().bounds(), m);
+        assert!(d.page_of_item(*frames.last().unwrap()).unwrap() >= 3, "{} frames", frames.len());
+        for (k, f) in frames[1..].iter().enumerate() {
+            let page = d.page_of_item(*f).unwrap();
+            assert_eq!(page, 1 + k / 2, "frame {}", k + 1);
+            assert_eq!(d.item(*f).unwrap().bounds(), d.page(page).unwrap().column_rects()[k % 2], "frame {}", k + 1);
+        }
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
+    #[test]
+    fn autoflow_leaves_no_empty_frame_on_the_pages_that_follow() {
+        // A small first frame makes autoflow ask for more frames than the columns need; the ones
+        // it set on the following pages past the end of the text go again, the pages stay.
+        let dir = std::env::temp_dir().join(format!("dc-place-small-{}", std::process::id()));
+        std::fs::create_dir_all(&dir).unwrap();
+        let path = dir.join("long.txt");
+        std::fs::write(&path, vec!["Lorem ipsum dolor sit amet, consectetur adipiscing elit. ".repeat(12); 12].join("\n")).unwrap();
+        let mut s = Session::new();
+        s.execute("file.new", &json!({"preset": "Letter", "pages": 8, "facingPages": false, "margins": 54})).unwrap();
+        let r = s.execute("file.place", &json!({"path": path.to_string_lossy(), "rect": [100, 100, 200, 130], "autoflow": true})).unwrap();
+        assert_eq!(r["overset"], false, "{r}");
+        assert_eq!(r["pagesAdded"], 0, "{r}");
+        let d = &s.doc().unwrap().doc;
+        assert_eq!(d.page_count(), 8);
+        let sid = StoryId(r["story"].as_u64().unwrap());
+        let frames = &d.story(sid).unwrap().frames;
+        assert!(frames.len() >= 2, "{r}");
+        let cs = designcraft_compose::compose_story(d, sid, &Default::default());
+        assert!(frames.iter().all(|f| cs.frame(*f).is_some_and(|ft| !ft.range.is_empty())), "{} frames", frames.len());
+        assert_eq!(d.spreads.iter().map(|sp| sp.items.len()).sum::<usize>(), frames.len());
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
     #[test]
     fn autoflow_adds_only_the_pages_breaks_ask_for() {
         // Regression (#262): a frame a break ends early made autoflow take it for a frame that
diff --git a/crates/engine/src/cmd/print.rs b/crates/engine/src/cmd/print.rs
index 4f79f13a..0bb28078 100644
--- a/crates/engine/src/cmd/print.rs
+++ b/crates/engine/src/cmd/print.rs
@@ -17,7 +17,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Print…",
             ["File"],
             Some("Cmd+P"),
-            "{printer?, copies?: 1, pages?: \"1-3,5\", spreads?, marks?, bleed?, dryRun?: bool (export and preview submission without printing)} → {printer, copies, pages, command, bytes}",
+            "{printer?, copies?: 1, pages?: \"1-3,5\", spreads?, marks?, bleed?, dryRun?: bool (export and preview submission without printing), created?: int (Unix seconds, as file.exportPdf)} → {printer, copies, pages, command, bytes}",
             has_doc,
             print
         ),
@@ -95,7 +95,8 @@ mod tests {
     fn print_submits_the_selected_export_and_reports_refusal() {
         let mut s = Session::new();
         s.execute("file.new", &json!({"pages": 4})).unwrap();
-        let params = json!({"printer": "Office (east)", "copies": 2, "pages": "2-3", "marks": true, "bleed": true});
+        // A fixed creation date: both exports would otherwise take the clock's second.
+        let params = json!({"printer": "Office (east)", "copies": 2, "pages": "2-3", "marks": true, "bleed": true, "created": 1_700_000_000});
         let expected = {
             let d = &s.doc().unwrap().doc;
             let options = super::super::export::options(&params, d.page_count()).unwrap();
@@ -118,5 +119,6 @@ mod tests {
         assert!(refusal.to_string().contains("printer offline"));
         print_with(&mut s, &json!({"dryRun": true}), |_, _| panic!("dry runs must not spool")).unwrap();
         assert!(print_with(&mut s, &json!({"pages": "9"}), |_, _| panic!("invalid ranges must not spool")).is_err());
+        assert!(print_with(&mut s, &json!({"created": "today"}), |_, _| panic!("an invalid date must not spool")).is_err());
     }
 }
diff --git a/crates/engine/src/cmd/table.rs b/crates/engine/src/cmd/table.rs
index 7049c2f3..063be89a 100644
--- a/crates/engine/src/cmd/table.rs
+++ b/crates/engine/src/cmd/table.rs
@@ -297,7 +297,7 @@ fn table_specs() -> Vec<CommandSpec> {
             "Cell Options",
             [],
             None,
-            "{fill?: swatch, tint?: 0..1, insets?: n | [t,l,b,r], vj? | verticalJustification?: top|center|bottom|justify, firstBaseline?: ascent|capHeight|leading|xHeight|fixed|emboxHeight, firstBaselineMin?: pt, text?, stroke?: {weight?, color?: swatch, tint?: 0..1, type?: solid|dashed|dotted|thickThin|thinThick|thinThin|thickThick|thinThickThin|thickThinThick|wavy|hashed | {kind:…}, gapColor?: swatch, gapTint?: 0..1, edges?: name | [names] (all|outer|inner|top|left|bottom|right|innerHorizontal|innerVertical; default all)}, story?, table?, rows?: [a, b] | row?, cols?: [a, b] | col? (the target cells; default: the selection)} — top/left/bottom/right are the target range's outer sides, innerHorizontal/innerVertical the lines between its rows/columns",
+            "{fill?: swatch, tint?: 0..1, insets?: n | [t,l,b,r], vj? | verticalJustification?: top|center|bottom|justify, firstBaseline?: ascent|capHeight|leading|xHeight|fixed|emboxHeight, firstBaselineMin?: pt, rotation?: 0|90|180|270 (Cell Options › Text › Rotation; kept and written back to IDML, composed horizontally for now), text?, stroke?: {weight?, color?: swatch, tint?: 0..1, type?: solid|dashed|dotted|thickThin|thinThick|thinThin|thickThick|thinThickThin|thickThinThick|wavy|hashed | {kind:…}, gapColor?: swatch, gapTint?: 0..1, edges?: name | [names] (all|outer|inner|top|left|bottom|right|innerHorizontal|innerVertical; default all)}, story?, table?, rows?: [a, b] | row?, cols?: [a, b] | col? (the target cells; default: the selection)} — top/left/bottom/right are the target range's outer sides, innerHorizontal/innerVertical the lines between its rows/columns",
             in_table,
             set_cell
         ),
@@ -971,6 +971,15 @@ fn set_cell(s: &mut Session, p: &Value) -> Result<Value> {
         None => None,
     };
     let (first_baseline, first_baseline_min) = first_baseline_params(p, ID)?;
+    // Cell Options › Text › Rotation. The value is kept and written back to IDML; only 0 is
+    // composed so far, which the IDML import reports (#1468).
+    let rotation = match p.get("rotation").filter(|v| !v.is_null()) {
+        Some(v) => match v.as_f64().map(|d| d.rem_euclid(360.0)) {
+            Some(d) if d == 0.0 || d == 90.0 || d == 180.0 || d == 270.0 => Some(d),
+            _ => return Err(bad(ID, "rotation: 0, 90, 180 or 270 degrees")),
+        },
+        None => None,
+    };
     let text = str_param(p, "text").map(|_| super::text_param(p, "text"));
     let stroke = match p.get("stroke").filter(|v| !v.is_null()) {
         Some(sv) => Some((StrokeEdit::parse(doc, sv, ID)?, EdgeSel::parse(sv.get("edges"), ID)?)),
@@ -1021,6 +1030,9 @@ fn set_cell(s: &mut Session, p: &Value) -> Result<Value> {
             if let Some(v) = first_baseline_min {
                 cell.first_baseline_min = v;
             }
+            if let Some(v) = rotation {
+                cell.rotation = v;
+            }
             if let Some(tx) = &text {
                 let len = cell.text.len();
                 cell.text.replace(0..len, tx);
@@ -1393,14 +1405,14 @@ fn parse_alt(v: &Value) -> Option<AltFills> {
     }
     let d = AltFills::default();
     Some(AltFills {
-        first: v.get("first").and_then(Value::as_u64).map_or(d.first, |x| x as u32),
+        first: v.get("first").and_then(Value::as_u64).map_or(d.first, |x| u32::try_from(x).unwrap_or(u32::MAX)),
         first_color: color_param(v, "firstColor").unwrap_or(d.first_color),
         first_tint: v.get("firstTint").and_then(Value::as_f64).map_or(d.first_tint, |x| x as f32),
-        next: v.get("next").and_then(Value::as_u64).map_or(d.next, |x| x as u32),
+        next: v.get("next").and_then(Value::as_u64).map_or(d.next, |x| u32::try_from(x).unwrap_or(u32::MAX)),
         next_color: color_param(v, "nextColor").unwrap_or(d.next_color),
         next_tint: v.get("nextTint").and_then(Value::as_f64).map_or(d.next_tint, |x| x as f32),
-        skip_first: v.get("skipFirst").and_then(Value::as_u64).map_or(0, |x| x as u32),
-        skip_last: v.get("skipLast").and_then(Value::as_u64).map_or(0, |x| x as u32),
+        skip_first: v.get("skipFirst").and_then(Value::as_u64).map_or(0, |x| u32::try_from(x).unwrap_or(u32::MAX)),
+        skip_last: v.get("skipLast").and_then(Value::as_u64).map_or(0, |x| u32::try_from(x).unwrap_or(u32::MAX)),
     })
 }
 
@@ -1548,7 +1560,7 @@ fn get(s: &mut Session, p: &Value) -> Result<Value> {
         .filter_map(|(r, c)| {
             let cell = t.cell(r, c)?;
             Some(json!({"row": r, "col": c, "rowSpan": cell.row_span, "colSpan": cell.col_span, "text": cell.text.text, "fill": cell.fill,
-                "insets": cell.insets, "vj": cell.vj, "firstBaseline": cell.first_baseline, "firstBaselineMin": cell.first_baseline_min, "style": cell.style}))
+                "insets": cell.insets, "vj": cell.vj, "firstBaseline": cell.first_baseline, "firstBaselineMin": cell.first_baseline_min, "rotation": cell.rotation, "style": cell.style}))
         })
         .collect();
     Ok(json!({
@@ -1832,6 +1844,16 @@ mod style_tests {
         let cell = got["cells"].as_array().unwrap().iter().find(|c| c["row"] == 0 && c["col"] == 0).unwrap().clone();
         assert_eq!((cell["firstBaseline"].as_str(), cell["firstBaselineMin"].as_f64()), (Some("capHeight"), Some(3.0)));
         assert!(s.execute("table.setCell", &json!({"row": 0, "col": 0, "firstBaseline": "middle"})).is_err());
+        // Cell Options › Text › Rotation: carried and written back, composed horizontally so far,
+        // which the IDML import reports (#1468).
+        for (given, want) in [(90, 90.0), (270, 270.0), (0, 0.0), (-90, 270.0), (450, 90.0)] {
+            s.execute("table.setCell", &json!({"row": 0, "col": 0, "rotation": given})).unwrap_or_else(|e| panic!("{given}: {e}"));
+            let cell = s.execute("table.get", &json!({})).unwrap()["cells"][0].clone();
+            assert_eq!(cell["rotation"].as_f64(), Some(want), "{given}");
+        }
+        for bad in [45, 1, 100] {
+            assert!(s.execute("table.setCell", &json!({"row": 0, "col": 0, "rotation": bad})).is_err(), "{bad}");
+        }
         assert!(s.execute("table.setCell", &json!({"row": 0, "col": 0, "firstBaselineMin": -1})).is_err());
         s.execute("style.cell.create", &json!({"name": "Leading", "firstBaseline": "leading"})).unwrap();
         s.execute("style.cell.apply", &json!({"name": "Leading", "row": 1, "col": 1})).unwrap();
diff --git a/crates/engine/src/cmd/text.rs b/crates/engine/src/cmd/text.rs
index 12bd540b..dbfbcfe1 100644
--- a/crates/engine/src/cmd/text.rs
+++ b/crates/engine/src/cmd/text.rs
@@ -1502,12 +1502,29 @@ fn ruby_cmd(s: &mut Session, p: &Value) -> Result<Value> {
 
 /// A character fill must name a swatch of the document.
 pub(crate) fn validate_char_fill(document: &designcraft_doc::Document, attrs: &CharAttrs, command_id: &str) -> Result<()> {
+    validate_char_size(attrs, command_id)?;
     match &attrs.fill {
         Some(fill) => super::object::known_swatch(document, fill, command_id, "fill"),
         None => Ok(()),
     }
 }
 
+/// Type size is 0.1 to 1296 pt, the range this engine already applies to a ruby annotation's
+/// size. Nothing checked it for ordinary text, so `{"size": 0}` set type with no size, a negative
+/// size was accepted as well, and 1e9 pt asked the composer for a line a million times the page.
+pub(crate) fn validate_char_size(attrs: &CharAttrs, command_id: &str) -> Result<()> {
+    match attrs.size {
+        Some(size) if !(MIN_TYPE_SIZE..=MAX_TYPE_SIZE).contains(&size) => {
+            Err(bad(command_id, format!("size {size}: {MIN_TYPE_SIZE} to {MAX_TYPE_SIZE} pt")))
+        }
+        _ => Ok(()),
+    }
+}
+
+/// Type size limits (InDesign's, and the ones `type.ruby` already uses).
+pub(crate) const MIN_TYPE_SIZE: f64 = 0.1;
+pub(crate) const MAX_TYPE_SIZE: f64 = 1296.0;
+
 /// Byte `pos` is the hidden paragraph mark of an *empty* paragraph: the only character on that
 /// line, and so the one a line-affecting attribute like leading can land on right away instead of
 /// waiting for the next typed character (otherwise an empty line could never get its own leading).
@@ -3911,3 +3928,42 @@ mod pick_up_format_tests {
         let _ = ItemId(rect);
     }
 }
+
+#[cfg(test)]
+mod size_bounds_tests {
+    use serde_json::json;
+
+    use crate::Session;
+
+    /// Type size was not checked anywhere: `{"size": 0}` set type with no size at all, a negative
+    /// size was accepted the same way, and 1e9 pt asked the composer for a line a million times
+    /// the height of the page. The range is the one `type.ruby` already applies, 0.1 to 1296 pt.
+    #[test]
+    fn a_type_size_outside_the_range_is_refused() {
+        let mut s = Session::new();
+        s.execute("file.new", &json!({"pages": 1})).unwrap();
+        let f = s.execute("frame.create", &json!({"rect": [20, 20, 400, 300], "content": "text", "text": "Hello world"})).unwrap();
+        let select = |s: &mut Session| {
+            s.execute("text.select", &json!({"story": f["story"].clone(), "anchor": 0, "focus": 5})).unwrap();
+        };
+        for size in [0.0, -12.0, 0.05, 1297.0, 1e9] {
+            select(&mut s);
+            let e = s.execute("type.char", &json!({"size": size})).expect_err("refused").to_string();
+            assert!(e.contains("0.1 to 1296 pt"), "{size}: {e}");
+        }
+        // The sizes in range still apply, including the ends.
+        for size in [0.1, 12.0, 1296.0] {
+            select(&mut s);
+            s.execute("type.char", &json!({"size": size})).unwrap_or_else(|e| panic!("{size}: {e}"));
+            assert_eq!(s.execute("type.selectionAttrs", &json!({})).unwrap()["chars"]["size"].as_f64(), Some(size));
+        }
+        // And the styles that carry character attributes are checked the same way.
+        for (command, params) in [
+            ("style.character.create", json!({"name": "Tiny", "chars": {"size": 0}})),
+            ("style.paragraph.create", json!({"name": "Huge", "chars": {"size": 2000}})),
+        ] {
+            let e = s.execute(command, &params).expect_err("refused").to_string();
+            assert!(e.contains("0.1 to 1296 pt"), "{command}: {e}");
+        }
+    }
+}
diff --git a/crates/engine/src/cmd/thread.rs b/crates/engine/src/cmd/thread.rs
index d5056d46..51bab42d 100644
--- a/crates/engine/src/cmd/thread.rs
+++ b/crates/engine/src/cmd/thread.rs
@@ -18,7 +18,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Thread Text Frames",
             [],
             None,
-            "{from?, to?, rect?: [x0,y0,x1,y1] (spread coords), spread?, autoflow?: bool} — threads frame `to` right after frame `from` (between `from` and the frame that followed it, if any). `to` is an empty frame or a text frame nothing threads into yet; its text joins the end of the story. Give `rect` in place of `from` or `to` to thread a new text frame made there on `spread`: `{from, rect}` adds it after `from`, `{rect, to}` in front of `to`. autoflow: then add pages with threaded frames until the story fits. Selects the frame that joined the thread. → {story, from, to, overset, pagesAdded}",
+            "{from?, to?, rect?: [x0,y0,x1,y1] (spread coords), spread?, autoflow?: bool} — threads frame `to` right after frame `from` (between `from` and the frame that followed it, if any). `to` is an empty frame or a text frame nothing threads into yet; its text joins the end of the story. Give `rect` in place of `from` or `to` to thread a new text frame made there on `spread`: `{from, rect}` adds it after `from`, `{rect, to}` in front of `to`. autoflow: then thread a frame per column on the pages that follow, adding pages at the end of the document until the story fits. Selects the frame that joined the thread. → {story, from, to, overset, pagesAdded}",
             has_doc,
             thread
         ),
diff --git a/crates/engine/src/cmd/xref.rs b/crates/engine/src/cmd/xref.rs
index d462f3d1..44614809 100644
--- a/crates/engine/src/cmd/xref.rs
+++ b/crates/engine/src/cmd/xref.rs
@@ -22,7 +22,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "New Hyperlink Destination…",
             ["Type", "Hyperlinks & Cross-References"],
             None,
-            "{name} — a text anchor at the insertion point",
+            "{name} — a text anchor at the insertion point; the name is the document's, so it must not be one another anchor already has",
             in_story_text,
             create_anchor
         ),
@@ -103,6 +103,14 @@ fn insert(s: &mut Session, p: &Value) -> Result<Value> {
 
 fn create_anchor(s: &mut Session, p: &Value) -> Result<Value> {
     let name = str_param(p, "name").ok_or_else(|| bad("anchor.create", "missing name"))?.to_string();
+    if name.trim().is_empty() {
+        return Err(bad("anchor.create", "a text anchor needs a name (a cross-reference and a hyperlink find it by that name)"));
+    }
+    // Two anchors of the same name made every reference to it ambiguous: `xref.insert` and
+    // `hyperlink.create` take the first they find, and a file writes both under one name.
+    if s.doc()?.doc.stories.values().any(|st| st.anchors.iter().any(|a| a.name == name)) {
+        return Err(bad("anchor.create", format!("a text anchor named `{name}` is already in this document (anchor.list names them)")));
+    }
     s.edit(|d, sel| {
         let t = sel.text.ok_or_else(|| bad("anchor.create", "no insertion point"))?;
         let st = d.story_mut(t.story).ok_or(designcraft_doc::DocError::NoStory(t.story))?;
@@ -215,6 +223,44 @@ mod tests {
         assert_eq!(s.execute("xref.list", &json!({})).unwrap()[0]["text"], "(p. 3)");
     }
 
+    /// Two text anchors of the same name made every reference to it ambiguous: `xref.insert
+    /// {"anchor": "A"}` and `hyperlink.create {"anchor": "A"}` take the first they find, and an
+    /// exported file writes both destinations under one name.
+    #[test]
+    fn a_text_anchor_name_is_the_documents_so_it_is_not_reused() {
+        let mut s = Session::new();
+        s.execute("file.new", &json!({"pages": 2, "facingPages": false})).unwrap();
+        let a = s.execute("frame.create", &json!({"rect": [72, 72, 400, 200], "content": "text", "text": "Photo one here"})).unwrap();
+        let select = |s: &mut Session, story: serde_json::Value, from: usize| {
+            s.execute("text.select", &json!({"story": story, "anchor": from, "focus": from})).unwrap();
+        };
+        select(&mut s, a["story"].clone(), 0);
+        s.execute("anchor.create", &json!({"name": "Photo 1"})).unwrap();
+
+        // The same name again, in the same story and in another one.
+        select(&mut s, a["story"].clone(), 10);
+        let e = s.execute("anchor.create", &json!({"name": "Photo 1"})).expect_err("refused").to_string();
+        assert!(e.contains("already in this document"), "{e}");
+        let sp = s.doc().unwrap().doc.page_loc(1).unwrap().0;
+        let b = s.execute("frame.create", &json!({"spread": sp, "rect": [72, 72, 400, 200], "content": "text", "text": "Photo two"})).unwrap();
+        select(&mut s, b["story"].clone(), 0);
+        assert!(s.execute("anchor.create", &json!({"name": "Photo 1"})).is_err(), "not in another story either");
+        // A name of spaces is not a name.
+        assert!(s.execute("anchor.create", &json!({"name": "   "})).is_err());
+        assert!(s.execute("anchor.create", &json!({"name": ""})).is_err());
+
+        // One anchor, so a reference by name can only mean that one.
+        let anchors = s.execute("anchor.list", &json!({})).unwrap();
+        assert_eq!(anchors.as_array().unwrap().len(), 1, "{anchors}");
+        // Another name is fine.
+        s.execute("anchor.create", &json!({"name": "Photo 2"})).unwrap();
+        assert_eq!(s.execute("anchor.list", &json!({})).unwrap().as_array().unwrap().len(), 2);
+        // The check is on the name, not on where it is: a name that differs only in case is a
+        // different name, as it is everywhere else in the document.
+        select(&mut s, b["story"].clone(), 0);
+        s.execute("anchor.create", &json!({"name": "photo 1"})).expect("a different name");
+    }
+
     #[test]
     fn cross_reference_into_a_story_with_a_running_header_composes() {
         let mut s = Session::new();
diff --git a/crates/engine/src/io.rs b/crates/engine/src/io.rs
index 5378a411..b493edf3 100644
--- a/crates/engine/src/io.rs
+++ b/crates/engine/src/io.rs
@@ -21,8 +21,7 @@ use std::path::{Path, PathBuf};
 /// refused path is never handed to the file system; callers treat it as a missing file.
 pub fn document_path(stored: &str, document: Option<&Path>) -> Result<PathBuf, Refused> {
     let document = document.map(|d| std::path::absolute(d).unwrap_or_else(|_| d.to_path_buf()));
-    let path = craft_docpath::resolve(stored, document.as_deref())?;
-    if path.is_absolute() { Ok(path) } else { Err(Refused::Invalid) }
+    craft_docpath::resolve_absolute(stored, document.as_deref())
 }
 
 /// [`document_path`] for a path stored in a file inside `folder` (a data file's image names).
diff --git a/crates/engine/src/tests.rs b/crates/engine/src/tests.rs
index 42f57b3a..b1792485 100644
--- a/crates/engine/src/tests.rs
+++ b/crates/engine/src/tests.rs
@@ -1651,3 +1651,108 @@ fn a_line_fits_when_its_baseline_does() {
     assert!(!overset(&mut s, 78.5), "the line is set; its descenders hang below the frame");
     assert!(overset(&mut s, 50.0), "a baseline below the frame still oversets the line");
 }
+
+/// Issue #1637: with several objects selected, a click on one of them (no drag) makes it the key
+/// object, and Align to Key Object leaves it in place. A second click on it drops the key.
+#[test]
+fn a_click_in_the_selection_makes_the_key_object() {
+    use designcraft_tools::{PointerEvent, PointerKind};
+    let mut s = session();
+    let a = s.execute("frame.create", &json!({"rect": [50.0, 100.0, 100.0, 150.0], "content": "unassigned"})).unwrap()["id"].as_u64().unwrap();
+    let b = s.execute("frame.create", &json!({"rect": [200.0, 120.0, 300.0, 170.0], "content": "unassigned"})).unwrap()["id"].as_u64().unwrap();
+    s.execute("selection.set", &json!({"ids": [a, b]})).unwrap();
+    s.set_tool("selection");
+    let v = ViewInfo::at_zoom(1.0);
+    // On the part of the key object that the aligned object never covers, away from the handles.
+    let click = |s: &mut Session| {
+        s.pointer(&PointerEvent::new(PointerKind::Down, 280.0, 160.0), v).unwrap();
+        s.pointer(&PointerEvent::new(PointerKind::Up, 280.0, 160.0), v).unwrap();
+    };
+    click(&mut s);
+    assert_eq!(s.doc().unwrap().selection.items.len(), 2, "the click keeps both selected");
+    // The key is the right-hand object, so aligning left edges to the selection would move it.
+    s.execute("object.align", &json!({"edge": "left", "to": "keyObject"})).unwrap();
+    let x0 = |s: &Session, id: u64| s.doc().unwrap().doc.item(designcraft_doc::ItemId(id)).unwrap().bounds().x0;
+    assert!((x0(&s, b) - 200.0).abs() < 1e-6, "the key object moved to {}", x0(&s, b));
+    assert!((x0(&s, a) - 200.0).abs() < 1e-6, "the other object is at {}", x0(&s, a));
+    // The Align panel and the Control panel send no target: the key object is the default one.
+    s.execute("object.align", &json!({"edge": "top"})).unwrap();
+    let y0 = |s: &Session, id: u64| s.doc().unwrap().doc.item(designcraft_doc::ItemId(id)).unwrap().bounds().y0;
+    assert!((y0(&s, b) - 120.0).abs() < 1e-6, "the key object moved to {}", y0(&s, b));
+    assert!((y0(&s, a) - 120.0).abs() < 1e-6, "the other object is at {}", y0(&s, a));
+    click(&mut s);
+    assert_eq!(s.doc().unwrap().selection.key, None, "a click on the key object drops the key");
+}
+
+/// Dragging one of several selected objects moves them all and makes no key object.
+#[test]
+fn dragging_the_selection_makes_no_key_object() {
+    use designcraft_tools::{PointerEvent, PointerKind};
+    let mut s = session();
+    let a = s.execute("frame.create", &json!({"rect": [50.0, 100.0, 100.0, 150.0], "content": "unassigned"})).unwrap()["id"].as_u64().unwrap();
+    let b = s.execute("frame.create", &json!({"rect": [200.0, 100.0, 260.0, 150.0], "content": "unassigned"})).unwrap()["id"].as_u64().unwrap();
+    s.execute("selection.set", &json!({"ids": [a, b]})).unwrap();
+    s.set_tool("selection");
+    let v = ViewInfo::at_zoom(1.0);
+    s.pointer(&PointerEvent::new(PointerKind::Down, 230.0, 125.0), v).unwrap();
+    s.pointer(&PointerEvent::new(PointerKind::Drag, 250.0, 135.0), v).unwrap();
+    s.pointer(&PointerEvent::new(PointerKind::Up, 250.0, 135.0), v).unwrap();
+    assert_eq!(s.doc().unwrap().selection.key, None);
+}
+
+/// Shift-clicking the key object out of the selection drops the key.
+#[test]
+fn deselecting_the_key_object_drops_the_key() {
+    let mut s = session();
+    let a = s.execute("frame.create", &json!({"rect": [50.0, 100.0, 100.0, 150.0]})).unwrap()["id"].as_u64().unwrap();
+    let b = s.execute("frame.create", &json!({"rect": [200.0, 100.0, 260.0, 150.0]})).unwrap()["id"].as_u64().unwrap();
+    s.execute("selection.set", &json!({"ids": [a, b]})).unwrap();
+    s.execute("selection.key", &json!({"id": b})).unwrap();
+    assert_eq!(s.doc().unwrap().selection.key, Some(designcraft_doc::ItemId(b)));
+    s.execute("selection.toggle", &json!({"id": b})).unwrap();
+    assert_eq!(s.doc().unwrap().selection.key, None);
+}
+
+/// A key object needs another object to align to: with one object selected there is nothing to key
+/// against, and the stored key would turn that object into the target as soon as a second one joins.
+#[test]
+fn a_single_selected_object_cannot_be_the_key_object() {
+    let mut s = session();
+    let a = s.execute("frame.create", &json!({"rect": [50.0, 100.0, 100.0, 150.0]})).unwrap()["id"].as_u64().unwrap();
+    let b = s.execute("frame.create", &json!({"rect": [200.0, 120.0, 300.0, 170.0]})).unwrap()["id"].as_u64().unwrap();
+    s.execute("selection.set", &json!({"ids": [a]})).unwrap();
+    assert!(s.execute("selection.key", &json!({"id": a})).is_err());
+    assert_eq!(s.doc().unwrap().selection.key, None);
+    s.execute("selection.toggle", &json!({"id": b})).unwrap();
+    assert_eq!(s.doc().unwrap().selection.key, None, "the second object joining must not find a key already set");
+}
+
+/// With the selection down to the key object alone, Align no longer has a key object: a single
+/// object aligns to the page, as before.
+#[test]
+fn a_lone_key_object_aligns_to_the_page() {
+    let mut s = session();
+    let a = s.execute("frame.create", &json!({"rect": [50.0, 100.0, 100.0, 150.0]})).unwrap()["id"].as_u64().unwrap();
+    let b = s.execute("frame.create", &json!({"rect": [200.0, 120.0, 300.0, 170.0]})).unwrap()["id"].as_u64().unwrap();
+    s.execute("selection.set", &json!({"ids": [a, b]})).unwrap();
+    s.execute("selection.key", &json!({"id": b})).unwrap();
+    s.execute("selection.toggle", &json!({"id": a})).unwrap();
+    assert_eq!(s.doc().unwrap().selection.key, None);
+    s.execute("object.align", &json!({"edge": "left"})).unwrap();
+    let x0 = s.doc().unwrap().doc.item(designcraft_doc::ItemId(b)).unwrap().bounds().x0;
+    assert!(x0.abs() < 1e-6, "the object is at {x0}, not at the page's left edge");
+}
+
+/// Aligning one object alone (`ids`) while it is the key object of a larger selection also takes
+/// the page.
+#[test]
+fn aligning_the_key_object_alone_takes_the_page() {
+    let mut s = session();
+    let a = s.execute("frame.create", &json!({"rect": [50.0, 100.0, 100.0, 150.0]})).unwrap()["id"].as_u64().unwrap();
+    let b = s.execute("frame.create", &json!({"rect": [200.0, 120.0, 300.0, 170.0]})).unwrap()["id"].as_u64().unwrap();
+    s.execute("selection.set", &json!({"ids": [a, b]})).unwrap();
+    s.execute("selection.key", &json!({"id": b})).unwrap();
+    s.execute("object.align", &json!({"edge": "left", "ids": [b]})).unwrap();
+    let x0 = s.doc().unwrap().doc.item(designcraft_doc::ItemId(b)).unwrap().bounds().x0;
+    assert!(x0.abs() < 1e-6, "the object is at {x0}, not at the page's left edge");
+}
diff --git a/crates/engine/src/tests_linked_paths.rs b/crates/engine/src/tests_linked_paths.rs
index eb4c953e..448ffedb 100644
--- a/crates/engine/src/tests_linked_paths.rs
+++ b/crates/engine/src/tests_linked_paths.rs
@@ -105,3 +105,73 @@ fn a_relative_link_resolves_beside_the_document() {
     assert!(seen.iter().all(|p| p.starts_with(&dir)), "{seen:?}");
     let _ = std::fs::remove_dir_all(&dir);
 }
+
+#[test]
+fn a_relative_link_in_an_unsaved_document_is_missing() {
+    // With no document path there is nothing to resolve against; the working directory is not used.
+    let mut s = document_with_links(Path::new("doc.designcraft"), &["logo.png", "img/logo.png"]);
+    s.doc_mut().unwrap().path = None;
+    let (rows, seen) = crate::io::touched(|| s.execute("links.list", &json!({})).unwrap());
+    assert!(seen.is_empty(), "{seen:?}");
+    for row in rows.as_array().unwrap() {
+        assert_eq!(row["status"], "missing", "{row}");
+        assert_eq!(row["refused"], "the path is not valid", "{row}");
+    }
+}
+
+#[cfg(unix)]
+#[test]
+fn relink_folder_never_leaves_the_chosen_folder() {
+    // A stored name with no separator can still be a `file:` URL that decodes to a path elsewhere.
+    let dir = folder("relink-outside");
+    let chosen = dir.join("chosen");
+    std::fs::create_dir_all(&chosen).unwrap();
+    let outside = dir.join("outside.png");
+    std::fs::write(&outside, png()).unwrap();
+    let encoded = format!("file:{}", outside.to_string_lossy().replace('/', "%2F"));
+    let mut s = document_with_links(&dir.join("doc.designcraft"), &[&encoded]);
+    let (out, seen) =
+        crate::io::touched(|| s.execute("links.relinkFolder", &json!({"dir": chosen.to_string_lossy(), "missingOnly": false})).unwrap());
+    assert_eq!(out["relinked"], 0, "{out}");
+    assert!(!seen.contains(&outside), "{seen:?}");
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+#[cfg(unix)]
+#[test]
+fn relink_folder_takes_the_chosen_folder_as_one_folder() {
+    // `a\b` is one folder name on Unix; read as a stored path it would be `a/b`.
+    let dir = folder("relink-backslash");
+    let chosen = dir.join("a\\b");
+    std::fs::create_dir_all(&chosen).unwrap();
+    std::fs::create_dir_all(dir.join("a/b")).unwrap();
+    let elsewhere = dir.join("a/b/x.png");
+    std::fs::write(&elsewhere, png()).unwrap();
+    let mut s = document_with_links(&dir.join("doc.designcraft"), &["x.png"]);
+    let (out, seen) =
+        crate::io::touched(|| s.execute("links.relinkFolder", &json!({"dir": chosen.to_string_lossy(), "missingOnly": false})).unwrap());
+    assert_eq!(out["relinked"], 0, "{out}");
+    assert!(!seen.contains(&elsewhere), "{seen:?}");
+
+    // A folder given with `..` is still that folder.
+    let real = dir.join("real");
+    std::fs::create_dir_all(&real).unwrap();
+    std::fs::write(real.join("x.png"), png()).unwrap();
+    let roundabout = real.join("..").join("real");
+    let out = s.execute("links.relinkFolder", &json!({"dir": roundabout.to_string_lossy(), "missingOnly": false})).unwrap();
+    assert_eq!(out["relinked"], 1, "{out}");
+
+    // Through a symlink, `alias/..` is the link target's parent, not the folder holding `alias`.
+    let inner = dir.join("inner");
+    std::fs::create_dir_all(inner.join("sub")).unwrap();
+    std::os::unix::fs::symlink(inner.join("sub"), dir.join("alias")).unwrap();
+    let beside_alias = dir.join("x.png");
+    std::fs::write(&beside_alias, png()).unwrap();
+    let mut s = document_with_links(&dir.join("doc.designcraft"), &["x.png"]);
+    let (out, seen) = crate::io::touched(|| {
+        s.execute("links.relinkFolder", &json!({"dir": dir.join("alias").join("..").to_string_lossy(), "missingOnly": false})).unwrap()
+    });
+    assert_eq!(out["relinked"], 0, "{out}");
+    assert!(!seen.contains(&beside_alias), "{seen:?}");
+    let _ = std::fs::remove_dir_all(&dir);
+}
diff --git a/crates/engine/src/tests_table.rs b/crates/engine/src/tests_table.rs
index 59d2f267..2fc4fd33 100644
--- a/crates/engine/src/tests_table.rs
+++ b/crates/engine/src/tests_table.rs
@@ -1097,3 +1097,26 @@ fn convert_rows_keeps_merged_cells_on_one_side() {
     assert!(!convert_enabled(&s, "Body"));
     check(&s);
 }
+
+#[test]
+fn alternating_fill_counts_saturate_instead_of_wrapping() {
+    let (mut s, _, _) = session_with_frame();
+    s.execute("table.insert", &json!({"rows": 3, "cols": 2})).unwrap();
+    s.execute("table.options", &json!({"altRows": {"first": 4294967297u64, "next": 1, "skipFirst": 4294967296u64, "skipLast": 9999999999u64}}))
+        .unwrap();
+    let t = s.execute("table.get", &json!({})).unwrap();
+    let a = &t["options"]["altRows"];
+    assert_eq!(a["first"], u32::MAX);
+    assert_eq!(a["skipFirst"], u32::MAX);
+    assert_eq!(a["skipLast"], u32::MAX);
+    assert_eq!(a["next"], 1);
+}
+
+#[test]
+fn index_next_paragraphs_saturates_instead_of_wrapping() {
+    let (mut s, _, _) = session_with_frame();
+    s.execute("index.addReference", &json!({"topic": "Intro", "range": "nextParagraphs", "paragraphs": 4294967296u64})).unwrap();
+    let l = s.execute("index.list", &json!({})).unwrap();
+    assert_eq!(l[0]["range"]["type"], "nextParagraphs");
+    assert_eq!(l[0]["range"]["value"], u32::MAX);
+}
diff --git a/crates/engine/tests/it/pdf_backend.rs b/crates/engine/tests/it/pdf_backend.rs
index 6b4f9308..5344dc6f 100644
--- a/crates/engine/tests/it/pdf_backend.rs
+++ b/crates/engine/tests/it/pdf_backend.rs
@@ -207,7 +207,9 @@ fn failed_layer_rewrite_aborts_export_instead_of_revealing_hidden_content() {
     session.execute("file.new", &json!({"width": 100, "height": 100, "pages": 1})).unwrap();
     let placed =
         session.execute("file.place", &json!({"base64": base64_encode(&bytes), "name": "missing-layers.pdf", "x": 0, "y": 0, "width": 100})).unwrap();
-    session.execute("object.layerOptions", &json!({"ids": [placed["id"]], "hidden": ["Red"]})).unwrap();
+    // Commands now reject unrewritable choices. Simulate stale persisted state after relinking.
+    let id: designcraft_doc::ItemId = serde_json::from_value(placed["id"].clone()).unwrap();
+    std::sync::Arc::make_mut(&mut session.doc_mut().unwrap().doc).item_mut(id).unwrap().pdf_hidden_layers = vec!["Red".into()];
     let before = session.execute("file.serialize", &json!({})).unwrap();
     let result = session.execute("file.exportPdf", &json!({}));
     assert!(result.is_err(), "failed layer hiding must not export the original visible layers");
diff --git a/crates/fonts/build.rs b/crates/fonts/build.rs
index 651fed19..497c41f8 100644
--- a/crates/fonts/build.rs
+++ b/crates/fonts/build.rs
@@ -1,7 +1,7 @@
 //! Optional craft-fonts build input (https://github.com/storytold/craft-fonts, recipe from its
 //! `docs/integration.md`). With `CRAFT_FONTS_DIR=<checkout>` the fonts in its
 //! `fonts/manifest.txt` are embedded as `CRAFT_FONTS`; unset, `CRAFT_FONTS` is empty. Web
-//! (wasm32) builds embed only the UI face, BIZ UDPGothic Regular, to stay within the web size
+//! (wasm32) builds embed only the UI faces, BIZ UDPGothic Regular and Noto Sans Georgian Regular, to stay within the web size
 //! budget. It only reads the local checkout: no network.
 use std::fmt::Write as _;
 use std::path::PathBuf;
@@ -38,7 +38,7 @@ fn craft_fonts(dir: &std::path::Path) -> Result<String, String> {
         let [family, style, file, scripts, ..] = f.as_slice() else {
             return Err(format!("malformed manifest line: {line}"));
         };
-        if wasm && !(*family == "BIZ UDPGothic" && *style == "Regular") {
+        if wasm && !matches!((*family, *style), ("BIZ UDPGothic" | "Noto Sans Georgian", "Regular")) {
             continue;
         }
         let path = dir.join(file).canonicalize().map_err(|e| format!("{file}: {e}"))?;
diff --git a/crates/geom/src/units.rs b/crates/geom/src/units.rs
index da1676d4..f1077ffc 100644
--- a/crates/geom/src/units.rs
+++ b/crates/geom/src/units.rs
@@ -286,6 +286,8 @@ pub fn format_measure_prec(pt: f64, unit: Unit, decimals: usize) -> String {
                 whole += 1.0;
                 rest = 0.0;
             }
+            // Decide the sign from the rounded value so float noise doesn't print "-0p0".
+            let neg = neg && (whole > 0.0 || rest > 0.0);
             let sep = if unit == Unit::Picas { 'p' } else { 'c' };
             format!("{}{}{}{}", if neg { "-" } else { "" }, whole as i64, sep, trim(rest))
         }
@@ -304,6 +306,14 @@ mod tests {
         (a - b).abs() < 1e-6
     }
 
+    /// Tiny negatives that round to zero must not print a sign.
+    #[test]
+    fn tiny_negative_picas_ciceros_have_no_sign() {
+        assert_eq!(format_measure(-0.0004, Unit::Picas), "0p0");
+        assert_eq!(format_measure(-0.0004, Unit::Ciceros), "0c0");
+        assert_eq!(format_measure(-12.0, Unit::Picas), "-1p0");
+    }
+
     /// Inches show four decimals, as InDesign's fields do; other units three.
     #[test]
     fn inches_show_four_decimals() {
diff --git a/crates/idml/src/export.rs b/crates/idml/src/export.rs
index 99dcb383..d3587c94 100644
--- a/crates/idml/src/export.rs
+++ b/crates/idml/src/export.rs
@@ -2414,6 +2414,7 @@ impl<'a> Ex<'a> {
                                     object_point,
                                     ref_point,
                                     keep_within_column,
+                                    spine_relative,
                                 } => El::new("AnchoredObjectSetting")
                                     .attr("AnchoredPosition", "Anchored")
                                     .attr("AnchorPoint", names::anchor_out(*object_point))
@@ -2424,7 +2425,8 @@ impl<'a> Ex<'a> {
                                     // IDML measures a left-aligned object's X offset leftwards.
                                     .attr("AnchorXoffset", num(if *ref_point % 3 == 0 { 0.0 - *x_offset } else { *x_offset }))
                                     .attr("AnchorYoffset", num(*y_offset))
-                                    .attr("PinPosition", bool_s(*keep_within_column)),
+                                    .attr("PinPosition", bool_s(*keep_within_column))
+                                    .attr("SpineRelative", bool_s(*spine_relative)),
                             };
                             e.push(setting);
                             out.push(Node::El(e));
@@ -2797,7 +2799,25 @@ impl<'a> Ex<'a> {
                         ce.set(&format!("{side}StrokePriority"), priority);
                     }
                 }
-                for psr in self.story_paras(&cell.text) {
+                let mut paras = self.story_paras(&cell.text);
+                // A graphic cell holds its image as an inline object in the cell's first paragraph.
+                if let Some(g) = &cell.graphic
+                    && let Some(object) = self.cell_graphic_el(g)
+                {
+                    // The cell clips its graphic on screen and in PDF; IDML does so only when asked.
+                    ce.set("ClipContentToCell", bool_s(true));
+                    let mut range = self.csr_el(&CharFormat::default());
+                    range.push(object);
+                    match paras.first_mut() {
+                        Some(first) => first.push(range),
+                        None => {
+                            let mut psr = self.psr_el(&ParaFormat::default());
+                            psr.push(range);
+                            paras.push(psr);
+                        }
+                    }
+                }
+                for psr in paras {
                     ce.push(psr);
                 }
                 el.push(ce);
@@ -2806,6 +2826,20 @@ impl<'a> Ex<'a> {
         el
     }
 
+    /// The frame of a table cell's graphic: an inline `Rectangle` around the shown image, or `None`
+    /// when the graphic's asset is missing.
+    fn cell_graphic_el(&mut self, g: &designcraft_doc::Graphic) -> Option<El> {
+        self.d.assets.get(&g.asset)?;
+        let shown = g.xf.transform_rect_bbox(designcraft_geom::Rect::new(0.0, 0.0, g.size.0, g.size.1));
+        let layer = self.d.layers.first().map(|l| l.id).unwrap_or(designcraft_doc::ids::LayerId(0));
+        let mut item = Item::new(designcraft_doc::ids::ItemId(0), layer, Shape::Rectangle, designcraft_geom::shapes::rectangle(shown));
+        item.content = Content::Graphic(g.clone());
+        let mut el = self.item_el(&item, Affine::IDENTITY);
+        el.set("Self", self.fresh());
+        el.push(El::new("AnchoredObjectSetting").attr("AnchoredPosition", "InlinePosition").attr("AnchorYoffset", "0"));
+        Some(el)
+    }
+
     fn psr_el(&mut self, pf: &ParaFormat) -> El {
         let mut el = El::new("ParagraphStyleRange").attr("AppliedParagraphStyle", names::style_self("ParagraphStyle", PARA_BUILTINS, &pf.style));
         let mut props = Vec::new();
diff --git a/crates/idml/src/import.rs b/crates/idml/src/import.rs
index ef504065..039d1e56 100644
--- a/crates/idml/src/import.rs
+++ b/crates/idml/src/import.rs
@@ -295,6 +295,10 @@ struct Importer<'r> {
     parents: Vec<Spread>,
     /// Things read but not kept as they were, for the import report.
     warnings: Vec<String>,
+    /// Cells whose text is rotated (Cell Options › Text › Rotation): the angle is kept and
+    /// written back, but only 0 is composed, so a narrow header column of vertical labels comes
+    /// in horizontal and wraps mid-word (#1468).
+    rotated_cells: usize,
     parent_ids: HashMap<String, SpreadId>,
     spreads: Vec<Spread>,
     page_index: HashMap<String, usize>,
@@ -387,13 +391,10 @@ fn mojikumi_row(e: &El) -> Result<designcraft_doc::cjk::MojikumiAki> {
     Ok(row)
 }
 
+/// The numbers in a whitespace-separated list; empty when any number is NaN or infinite (JSON
+/// can't store them, and dropping just those would shift the rest).
 fn nums(s: &str) -> Vec<f64> {
-    s.split_whitespace().filter_map(|v| v.parse().ok()).collect()
-}
-
-/// Like [`nums`], but empty when any number is NaN or infinite.
-fn finite_nums(s: &str) -> Vec<f64> {
-    let v = nums(s);
+    let v: Vec<f64> = s.split_whitespace().filter_map(|v| v.parse().ok()).collect();
     if v.iter().all(|x| x.is_finite()) { v } else { Vec::new() }
 }
 
@@ -536,6 +537,7 @@ impl<'r> Importer<'r> {
             story_ids: HashMap::new(),
             parents: Vec::new(),
             warnings: Vec::new(),
+            rotated_cells: 0,
             parent_ids: HashMap::new(),
             spreads: Vec::new(),
             page_index: HashMap::new(),
@@ -791,6 +793,12 @@ impl<'r> Importer<'r> {
                 include_prefix: e.get("IncludeSectionPrefix") == Some("true"),
             });
         }
+        if self.rotated_cells > 0 {
+            let n = self.rotated_cells;
+            self.warnings.push(format!(
+                "{n} table cell(s) have rotated text (Cell Options › Text › Rotation): the angle is kept and written back, but the text is composed horizontally"
+            ));
+        }
         self.sections.sort_by_key(|s| s.start);
         self.sections.dedup_by_key(|s| s.start);
         if self.sections.first().is_none_or(|s| s.start != 0) {
@@ -895,6 +903,15 @@ impl<'r> Importer<'r> {
             _ if v.len() >= 4 => Color::cmyk((v[0] / 100.0) as f32, (v[1] / 100.0) as f32, (v[2] / 100.0) as f32, (v[3] / 100.0) as f32),
             _ => return None,
         };
+        // Huge values (1e300) overflow `f32` to infinity.
+        let parts = match c {
+            Color::Rgb { r, g, b } => [r, g, b, 0.0],
+            Color::Cmyk { c, m, y, k } => [c, m, y, k],
+            Color::Gray { k } => [k, 0.0, 0.0, 0.0],
+        };
+        if !parts.iter().all(|v| v.is_finite()) {
+            return None;
+        }
         let ty = if e.get("Model") == Some("Spot") { ColorType::Spot } else { ColorType::Process };
         Some((c, ty))
     }
@@ -947,14 +964,14 @@ impl<'r> Importer<'r> {
             let (Some(id), Some(name)) = (e.get("Self"), e.get("Name")) else { continue };
             let kind = match e.local() {
                 "StripedStrokeStyle" => designcraft_doc::StrokeType::Stripes {
-                    bands: finite_nums(e.get("StripeArray").unwrap_or(""))
+                    bands: nums(e.get("StripeArray").unwrap_or(""))
                         .as_chunks::<2>()
                         .0
                         .iter()
                         .map(|c| (c[0] / 100.0, (c[1] - c[0]) / 100.0))
                         .collect(),
                 },
-                "DashedStrokeStyle" => designcraft_doc::StrokeType::Dashed { pattern: finite_nums(e.get("DashArray").unwrap_or("")) },
+                "DashedStrokeStyle" => designcraft_doc::StrokeType::Dashed { pattern: nums(e.get("DashArray").unwrap_or("")) },
                 _ => designcraft_doc::StrokeType::Dotted,
             };
             let _ = id;
@@ -2170,9 +2187,12 @@ impl<'r> Importer<'r> {
         }
         // Table-local options override the named table style. Cell styles are already
         // materialized independently, so their edges retain their higher precedence.
+        let mut border_unset = style.border.is_none() && style.borders.iter().all(|b| b.is_empty());
         let mut borders = std::array::from_fn::<_, 4, _>(|i| t.options.border_for(i).clone());
         for (side, border) in ["TopBorder", "LeftBorder", "BottomBorder", "RightBorder"].iter().zip(&mut borders) {
-            self.cell_stroke_attrs(e, side).apply_to(border);
+            let attrs = self.cell_stroke_attrs(e, side);
+            border_unset &= attrs.is_empty();
+            attrs.apply_to(border);
         }
         t.options.border = borders[0].clone();
         t.options.borders = borders.map(Some);
@@ -2235,6 +2255,9 @@ impl<'r> Importer<'r> {
                 cell.first_baseline_min = min.clamp(0.0, 8640.0);
             }
             cell.rotation = ce.num("RotationAngle").unwrap_or(cell.rotation);
+            if cell.rotation != 0.0 {
+                self.rotated_cells += 1;
+            }
             for (i, side) in ["TopEdge", "LeftEdge", "BottomEdge", "RightEdge"].iter().enumerate() {
                 let attrs = self.cell_stroke_attrs(ce, side);
                 attrs.apply_to(&mut cell.strokes[i]);
@@ -2243,6 +2266,10 @@ impl<'r> Importer<'r> {
                 cell.stroke_priorities[i] = priority;
                 // Preserve style-defined edges and #102's positive-priority local overrides.
                 cell.border_overrides[i] |= priority > 0;
+                // No table or table style border is given anywhere, so the built-in 1 pt default must not
+                // draw over an outer edge the cell explicitly hides (weight 0 or the None swatch), as InDesign draws nothing.
+                let hidden = attrs.weight == Some(0.0) || attrs.color.as_deref() == Some(swatch::NONE);
+                cell.border_overrides[i] |= border_unset && hidden;
             }
             if let Some(slot) = t.cell_mut(r, c) {
                 *slot = cell;
@@ -2422,6 +2449,7 @@ impl<'r> Importer<'r> {
                                         object_point: names::anchor_in(s("AnchorPoint")),
                                         ref_point: row * 3 + col,
                                         keep_within_column: s("PinPosition") == "true",
+                                        spine_relative: s("SpineRelative") == "true",
                                     }
                                 }
                                 _ => designcraft_doc::AnchorPosition::Inline { y_offset: get("AnchorYoffset") },
@@ -2856,7 +2884,7 @@ impl<'r> Importer<'r> {
             {
                 it.fill.gradient_angle = Some(a);
             }
-            let start: Option<Vec<f64>> = e.prop("GradientFillStart").map(|s| finite_nums(&s));
+            let start: Option<Vec<f64>> = e.prop("GradientFillStart").map(|s| nums(&s));
             if let (Some([x, y]), Some(len)) = (start.as_deref().and_then(|v| <[f64; 2]>::try_from(v).ok()), e.num("GradientFillLength"))
                 && len > 0.0
             {
@@ -2874,7 +2902,7 @@ impl<'r> Importer<'r> {
             {
                 it.stroke.gradient_angle = Some(a);
             }
-            let start: Option<Vec<f64>> = e.prop("GradientStrokeStart").map(|s| finite_nums(&s));
+            let start: Option<Vec<f64>> = e.prop("GradientStrokeStart").map(|s| nums(&s));
             if let (Some([x, y]), Some(len)) = (start.as_deref().and_then(|v| <[f64; 2]>::try_from(v).ok()), e.num("GradientStrokeLength"))
                 && len > 0.0
             {
@@ -3702,6 +3730,11 @@ fn path_capped(pg: &El, max: usize) -> PathData {
         let closed = g.get("PathOpen") != Some("true");
         let mut anchors = Vec::new();
         if let Some(arr) = g.find("PathPointArray") {
+            // A NaN or infinite point drops its subpath (JSON can't store it).
+            let non_finite = |s: Option<&str>| s.is_some_and(|s| s.split_whitespace().any(|v| v.parse::<f64>().is_ok_and(|x| !x.is_finite())));
+            if arr.find_all("PathPointType").take(left).any(|p| ["Anchor", "LeftDirection", "RightDirection"].iter().any(|k| non_finite(p.get(k)))) {
+                continue;
+            }
             for p in arr.find_all("PathPointType").take(left) {
                 let Some(a) = parse_point(p.get("Anchor")) else { continue };
                 let hin = parse_point(p.get("LeftDirection")).unwrap_or(a);
diff --git a/crates/idml/src/names.rs b/crates/idml/src/names.rs
index 56924447..b9102c9a 100644
--- a/crates/idml/src/names.rs
+++ b/crates/idml/src/names.rs
@@ -144,16 +144,37 @@ pub const TABLE_BUILTINS: &[(&str, &str)] = &[("[Basic Table]", "$ID/[Basic Tabl
 pub const OBJECT_BUILTINS: &[(&str, &str)] =
     &[("[None]", "$ID/[None]"), ("[Basic Graphics Frame]", "$ID/[Normal Graphics Frame]"), ("[Basic Text Frame]", "$ID/[Normal Text Frame]")];
 
-/// Our style name → IDML `Name` (groups: `A/B` → `A:B`).
+/// Our style name → IDML `Name` (groups: `A/B` → `A:B`; a literal `:` or `\` is escaped as `\:`
+/// or `\\`, so it is not read back as a group separator).
 pub fn style_name_out(builtins: &[(&str, &str)], name: &str) -> String {
-    builtins.iter().find(|(o, _)| *o == name).map(|(_, i)| i.to_string()).unwrap_or_else(|| name.replace('/', ":"))
+    builtins
+        .iter()
+        .find(|(o, _)| *o == name)
+        .map(|(_, i)| i.to_string())
+        .unwrap_or_else(|| name.replace('\\', "\\\\").replace(':', "\\:").replace('/', ":"))
 }
 /// IDML `Name` → our style name.
 pub fn style_name_in(builtins: &[(&str, &str)], name: &str) -> String {
     if let Some((o, _)) = builtins.iter().find(|(_, i)| *i == name) {
         return o.to_string();
     }
-    name.strip_prefix("$ID/").unwrap_or(name).replace(':', "/")
+    let name = name.strip_prefix("$ID/").unwrap_or(name);
+    let mut out = String::with_capacity(name.len());
+    let mut chars = name.chars();
+    while let Some(c) = chars.next() {
+        match c {
+            '\\' => match chars.clone().next() {
+                Some(next @ ('\\' | ':')) => {
+                    out.push(next);
+                    chars.next();
+                }
+                _ => out.push('\\'),
+            },
+            ':' => out.push('/'),
+            _ => out.push(c),
+        }
+    }
+    out
 }
 /// `ParagraphStyle/…` Self id for one of our names.
 pub fn style_self(kind: &str, builtins: &[(&str, &str)], name: &str) -> String {
diff --git a/crates/idml/src/tests.rs b/crates/idml/src/tests.rs
index 37fb2af5..b72ba1c8 100644
--- a/crates/idml/src/tests.rs
+++ b/crates/idml/src/tests.rs
@@ -1100,6 +1100,35 @@ fn imports_and_round_trips_explicit_cell_border_overrides() {
     assert_eq!(roundtrip.cell(0, 1).unwrap().border_overrides, [false; 4]);
 }
 
+#[test]
+fn explicitly_hidden_cell_edges_hide_the_default_table_border() {
+    // No table border or table style is given, and every cell edge is explicitly hidden (issue #1623):
+    // the first cell by weight 0, the second by the None swatch.
+    let cell = |name: &str, attr: &str, value: &str| {
+        format!(
+            r#"<Cell Name="{name}" LeftEdge{attr}="{value}" RightEdge{attr}="{value}" TopEdge{attr}="{value}" BottomEdge{attr}="{value}">
+    <ParagraphStyleRange><CharacterStyleRange><Content>X</Content></CharacterStyleRange></ParagraphStyleRange></Cell>"#
+        )
+    };
+    let story = format!(
+        r#"<idPkg:Story xmlns:idPkg="http://ns.adobe.com/AdobeInDesign/idml/1.0/packaging">
+<Story Self="s1"><ParagraphStyleRange><CharacterStyleRange>
+<Table HeaderRowCount="0" FooterRowCount="0">
+  <Row Name="0" MinimumHeight="24"/>
+  <Column Name="0" SingleColumnWidth="60"/><Column Name="1" SingleColumnWidth="60"/>
+  {}{}
+</Table></CharacterStyleRange></ParagraphStyleRange></Story></idPkg:Story>"#,
+        cell("0:0", "StrokeWeight", "0"),
+        cell("1:0", "StrokeColor", "Swatch/None")
+    );
+    let d = import_idml(&fixture_with_story(&story)).unwrap();
+    d.check().unwrap();
+    let table = d.stories.values().flat_map(|s| s.tables.values()).next().unwrap();
+    for c in 0..2 {
+        assert_eq!(table.cell(0, c).unwrap().border_overrides, [true; 4], "cell {c} suppresses the table border");
+    }
+}
+
 #[test]
 fn round_trips_footnotes_and_options() {
     let mut d = Document::new(&NewDocument::default());
@@ -1325,6 +1354,7 @@ fn anchored_objects_take_unset_settings_from_object_styles() {
         object_point,
         ref_point: 6,
         keep_within_column,
+        spine_relative: false,
     };
     let positions: Vec<_> = s.objects.iter().map(|o| o.position.clone()).collect();
     assert_eq!(
@@ -1337,6 +1367,44 @@ fn anchored_objects_take_unset_settings_from_object_styles() {
     );
 }
 
+/// Relative to Spine comes from the object style chain like the other anchored settings, an
+/// item's own setting wins, and export writes it back.
+#[test]
+fn anchored_spine_relative_comes_from_object_styles_and_round_trips() {
+    use designcraft_doc::AnchorPosition;
+    let styles = STYLES.replace(
+        r#"<ObjectStyle Self="ObjectStyle/$ID/[None]" Name="$ID/[None]"/>"#,
+        r#"<ObjectStyle Self="ObjectStyle/$ID/[None]" Name="$ID/[None]"/>
+        <ObjectStyle Self="ObjectStyle/Side" Name="Side"><AnchoredObjectSetting SpineRelative="true"/></ObjectStyle>
+        <ObjectStyle Self="ObjectStyle/Note" Name="Note"><Properties><BasedOn type="object">ObjectStyle/Side</BasedOn></Properties></ObjectStyle>"#,
+    );
+    let rect = |style: &str, setting: &str| {
+        format!(
+            r#"<Rectangle Self="r{style}" AppliedObjectStyle="ObjectStyle/{style}" ItemTransform="1 0 0 1 0 0">
+              <Properties><PathGeometry><GeometryPathType PathOpen="false"><PathPointArray>
+                <PathPointType Anchor="0 0"/><PathPointType Anchor="0 10"/><PathPointType Anchor="10 10"/><PathPointType Anchor="10 0"/>
+              </PathPointArray></GeometryPathType></PathGeometry></Properties>
+              <AnchoredObjectSetting AnchoredPosition="Anchored" {setting}/>
+            </Rectangle>"#
+        )
+    };
+    let story = format!(
+        r#"<idPkg:Story xmlns:idPkg="http://ns.adobe.com/AdobeInDesign/idml/1.0/packaging"><Story Self="s1">
+          <ParagraphStyleRange><CharacterStyleRange><Content>a</Content>{}{}{}</CharacterStyleRange></ParagraphStyleRange>
+        </Story></idPkg:Story>"#,
+        rect("Note", ""),
+        rect("Note", r#"SpineRelative="false""#),
+        rect("$ID/[None]", ""),
+    );
+    let spine = |d: &Document| -> Vec<bool> {
+        let s = d.stories.values().find(|s| !s.objects.is_empty()).unwrap();
+        s.objects.iter().map(|o| matches!(o.position, AnchorPosition::Custom { spine_relative: true, .. })).collect()
+    };
+    let d = import_idml(&fixture_with_table_styles(&styles, &story)).unwrap();
+    assert_eq!(spine(&d), [true, false, false]);
+    assert_eq!(spine(&import_idml(&export_idml(&d)).unwrap()), [true, false, false]);
+}
+
 /// IDML measures a left-aligned anchored object's X offset leftwards; the document model and
 /// composition measure every X offset rightwards.
 #[test]
@@ -4368,3 +4436,144 @@ fn cell_first_baseline_comes_from_cell_styles_table_regions_and_cells_and_round_
     let s2 = back.styles.cell.iter().find(|c| c.name == "Cap").unwrap();
     assert_eq!(s2.first_baseline, Some(FirstBaseline::CapHeight));
 }
+
+/// A graphic placed in a table cell is written into the cell, not dropped.
+#[test]
+fn exports_graphic_in_table_cell() {
+    let mut d = Document::new(&NewDocument::default());
+    let lid = d.default_layer();
+    let (_, sid) = d.add_text_frame(SpreadRef::Doc(0), Rect::new(40.0, 40.0, 400.0, 400.0), lid, "Intro", ParaFormat::default()).unwrap();
+    let asset = designcraft_doc::AssetId(d.alloc());
+    let id = d.add_asset(designcraft_doc::Asset {
+        id: asset,
+        name: "tick.png".into(),
+        mime: "image/png".into(),
+        data: std::sync::Arc::new(vec![1, 2, 3]),
+        ..Default::default()
+    });
+    let mut t = designcraft_doc::Table::new(d.alloc(), 2, 2, 0, 0, 200.0);
+    t.cell_mut(1, 0).unwrap().graphic = Some(designcraft_doc::Graphic {
+        asset: id,
+        size: (24.0, 24.0),
+        xf: designcraft_geom::Affine::IDENTITY,
+        clip: None,
+        auto_fit: Default::default(),
+        fit_align: 4,
+        crop: [0.0; 4],
+        wrap: Default::default(),
+        fill: Default::default(),
+    });
+    d.story_mut(sid).unwrap().insert_table(5, t);
+    let story = zip_text(&export_idml(&d), "Stories/");
+    let cell = story.split("<Cell ").nth(3).unwrap_or_default();
+    let cell = cell.split("</Cell>").next().unwrap_or_default();
+    assert!(cell.contains("<Image "), "{story}");
+    assert!(cell.contains("ClipContentToCell=\"true\""), "{story}");
+}
+
+/// Non-finite numbers in colour values, page bounds and item transforms (NaN, infinities and
+/// values like 1e300 that overflow `f32`) never reach the model: JSON would write them as null.
+#[test]
+fn non_finite_number_lists_never_reach_the_model() {
+    let graphic = GRAPHIC.replace(r#"ColorValue="255 0 0""#, r#"ColorValue="NaN 1e300 inf""#);
+    let spread = SPREAD
+        .replace(r#"Self="p2" AppliedMaster="m1" GeometricBounds="0 0 700 500""#, r#"Self="p2" AppliedMaster="m1" GeometricBounds="0 0 NaN 500""#)
+        .replace(r#"ItemTransform="1 0 0 1 50 -300""#, r#"ItemTransform="1 0 0 1 inf -300""#);
+    let bytes = zip_files(&[
+        ("designmap.xml", DESIGNMAP),
+        ("Resources/Graphic.xml", &graphic),
+        ("Resources/Styles.xml", STYLES),
+        ("Resources/Preferences.xml", PREFS),
+        ("MasterSpreads/MasterSpread_m1.xml", MASTER),
+        ("Spreads/Spread_sp1.xml", &spread),
+        ("Stories/Story_s1.xml", STORY),
+    ]);
+    let doc = import_idml(&bytes).unwrap();
+    for s in &doc.swatches {
+        if let SwatchValue::Color { color, .. } | SwatchValue::Paper { color } = &s.value {
+            let parts: Vec<f32> = match *color {
+                Color::Rgb { r, g, b } => vec![r, g, b],
+                Color::Cmyk { c, m, y, k } => vec![c, m, y, k],
+                Color::Gray { k } => vec![k],
+            };
+            assert!(parts.iter().all(|v| v.is_finite()), "swatch {} is not finite: {color:?}", s.name);
+        }
+    }
+    for sp in doc.spreads.iter().chain(&doc.parents) {
+        for p in &sp.pages {
+            assert!(p.width.is_finite() && p.height.is_finite() && p.x.is_finite(), "page {p:?}");
+        }
+    }
+    assert_eq!(doc.non_finite_item(), None);
+}
+
+/// Cell Options › Text › Rotation: the angle survives the round trip, and the import says it is
+/// not composed — narrow header columns of vertical labels come in horizontal and wrap mid-word,
+/// and nothing said so (#1468).
+#[test]
+fn rotated_cell_text_round_trips_and_the_import_says_it_is_not_composed() {
+    let mut d = Document::new(&NewDocument::default());
+    let (_, sid) = d.add_text_frame(SpreadRef::Doc(0), Rect::new(0.0, 0.0, 300.0, 300.0), d.default_layer(), "", ParaFormat::default()).unwrap();
+    let mut t = designcraft_doc::Table::new(7, 1, 3, 0, 0, 300.0);
+    t.cell_mut(0, 0).unwrap().rotation = 90.0;
+    t.cell_mut(0, 1).unwrap().rotation = 270.0;
+    d.story_mut(sid).unwrap().insert_table(0, t);
+    let bytes = export_idml(&d);
+    let story = zip_text(&bytes, "Stories/");
+    assert!(story.contains(r#"RotationAngle="90""#) && story.contains(r#"RotationAngle="270""#), "{story}");
+
+    let back = import_idml_report(&bytes, &|_| None).unwrap();
+    let t = back.document.stories.values().find(|st| !st.tables.is_empty()).unwrap().tables.values().next().unwrap().clone();
+    assert_eq!((t.cell(0, 0).unwrap().rotation, t.cell(0, 1).unwrap().rotation, t.cell(0, 2).unwrap().rotation), (90.0, 270.0, 0.0));
+    let about: Vec<&String> = back.warnings.iter().filter(|w| w.contains("rotated text")).collect();
+    assert_eq!(about.len(), 1, "one line for the file, not one per cell: {:?}", back.warnings);
+    assert!(about[0].starts_with("2 table cell(s)"), "{}", about[0]);
+    assert!(about[0].contains("composed horizontally"), "{}", about[0]);
+
+    // A file with no rotated cell says nothing.
+    let mut plain = Document::new(&NewDocument::default());
+    let (_, sid) =
+        plain.add_text_frame(SpreadRef::Doc(0), Rect::new(0.0, 0.0, 300.0, 300.0), plain.default_layer(), "", ParaFormat::default()).unwrap();
+    plain.story_mut(sid).unwrap().insert_table(0, designcraft_doc::Table::new(8, 1, 2, 0, 0, 200.0));
+    let quiet = import_idml_report(&export_idml(&plain), &|_| None).unwrap();
+    assert!(quiet.warnings.iter().all(|w| !w.contains("rotated text")), "{:?}", quiet.warnings);
+}
+
+#[test]
+fn style_names_with_a_literal_colon_survive_a_round_trip() {
+    use designcraft_doc::styles::{CellStyle, CharacterStyle, ObjectStyle, ParagraphStyle, TableStyle};
+    let names = ["Title: Big", "Group/Child: X", "Back\\slash: \\:"];
+    let mut d = small_doc();
+    for n in names {
+        let st = d.styles_mut();
+        st.paragraph.push(ParagraphStyle {
+            name: n.into(),
+            based_on: None,
+            next_style: None,
+            para: Default::default(),
+            chars: Default::default(),
+            shortcut: String::new(),
+        });
+        st.character.push(CharacterStyle { name: n.into(), based_on: None, chars: Default::default(), shortcut: String::new() });
+        st.cell.push(CellStyle { name: n.into(), ..Default::default() });
+        st.table.push(TableStyle { name: n.into(), ..Default::default() });
+        st.object.push(ObjectStyle { name: n.into(), ..Default::default() });
+    }
+    let back = import_idml(&export_idml(&d)).unwrap();
+    for n in names {
+        assert!(
+            back.styles.paragraph.iter().any(|s| s.name == n),
+            "paragraph {n:?}: {:?}",
+            back.styles.paragraph.iter().map(|s| &s.name).collect::<Vec<_>>()
+        );
+        assert!(back.styles.character.iter().any(|s| s.name == n), "character {n:?}");
+        assert!(back.styles.cell.iter().any(|s| s.name == n), "cell {n:?}");
+        assert!(back.styles.table.iter().any(|s| s.name == n), "table {n:?}");
+        assert!(back.styles.object.iter().any(|s| s.name == n), "object {n:?}");
+    }
+    // A group is still written as an IDML `:` group path.
+    assert_eq!(names::style_name_out(names::PARA_BUILTINS, "Group/Child"), "Group:Child");
+    for n in names {
+        assert_eq!(names::style_name_in(names::PARA_BUILTINS, &names::style_name_out(names::PARA_BUILTINS, n)), n);
+    }
+}
diff --git a/crates/pdf/src/export.rs b/crates/pdf/src/export.rs
index 3abcdb52..34934b91 100644
--- a/crates/pdf/src/export.rs
+++ b/crates/pdf/src/export.rs
@@ -1629,6 +1629,21 @@ fn is_rgb_icc(icc: &[u8]) -> bool {
     icc.get(16..20) == Some(b"RGB ".as_slice())
 }
 
+/// Whether an ICC profile describes grey.
+fn is_grey_icc(icc: &[u8]) -> bool {
+    icc.get(16..20) == Some(b"GRAY".as_slice())
+}
+
+/// Whether `data` decodes to grey (with or without alpha), read from its header.
+fn is_grey(data: &[u8]) -> bool {
+    use image::ImageDecoder;
+    image::ImageReader::new(std::io::Cursor::new(data))
+        .with_guessed_format()
+        .ok()
+        .and_then(|r| r.into_decoder().ok())
+        .is_some_and(|dec| !dec.color_type().has_color())
+}
+
 /// A JPEG, passed through. With `tag_rgb`, a JPEG keeps its own profile, and one without gets
 /// sRGB. krilla uses a profile only when its channels match the JPEG's, so a grey or CMYK JPEG
 /// without a profile stays DeviceGray or DeviceCMYK.
@@ -1668,6 +1683,10 @@ fn lossless(data: &Arc<Vec<u8>>, fmt: Option<image::ImageFormat>, mode: RasterMo
         _ => None,
     };
     direct.or_else(|| {
+        // A grey TIFF, BMP… stays DeviceGray, as a grey PNG or JPEG does (#1426).
+        if let Some(grey) = GreyImage::new(data) {
+            return Image::from_custom(grey, i).ok();
+        }
         // TIFF, BMP, PSD composites… and, with `tag_rgb`, untagged RGB.
         if mode.tag_rgb {
             return SrgbImage::new(rgba).and_then(|img| Image::from_custom(img, i).ok());
@@ -1722,6 +1741,61 @@ impl krilla::image::CustomImage for SrgbImage {
     }
 }
 
+/// A grey raster as a DeviceGray image (ICCBased when the file has a grey profile of its own), so
+/// a page that only holds black prints as black, not as RGB.
+#[derive(Clone, Hash)]
+struct GreyImage {
+    grey: Arc<Vec<u8>>,
+    /// Only when some pixel is not opaque.
+    alpha: Option<Arc<Vec<u8>>>,
+    size: (u32, u32),
+    icc: Option<Arc<Vec<u8>>>,
+}
+
+impl GreyImage {
+    /// `None` when `data` isn't grey or can't be decoded.
+    fn new(data: &[u8]) -> Option<Self> {
+        if !is_grey(data) {
+            return None;
+        }
+        let img = image::load_from_memory(data).ok()?.to_luma_alpha8();
+        let size = img.dimensions();
+        let pixels = usize::try_from(size.0).ok()?.checked_mul(usize::try_from(size.1).ok()?)?;
+        if pixels == 0 {
+            return None;
+        }
+        let (mut grey, mut alpha) = (Vec::with_capacity(pixels), Vec::with_capacity(pixels));
+        for p in img.pixels() {
+            grey.push(p.0[0]);
+            alpha.push(p.0[1]);
+        }
+        let alpha = alpha.iter().any(|a| *a < 255).then(|| Arc::new(alpha));
+        let icc = embedded_icc(data).filter(|p| is_grey_icc(p)).map(Arc::new);
+        Some(Self { grey: Arc::new(grey), alpha, size, icc })
+    }
+}
+
+impl krilla::image::CustomImage for GreyImage {
+    fn color_channel(&self) -> &[u8] {
+        &self.grey
+    }
+    fn alpha_channel(&self) -> Option<&[u8]> {
+        self.alpha.as_deref().map(Vec::as_slice)
+    }
+    fn bits_per_component(&self) -> krilla::image::BitsPerComponent {
+        krilla::image::BitsPerComponent::Eight
+    }
+    fn size(&self) -> (u32, u32) {
+        self.size
+    }
+    fn icc_profile(&self) -> Option<&[u8]> {
+        self.icc.as_deref().map(Vec::as_slice)
+    }
+    fn color_space(&self) -> krilla::image::ImageColorspace {
+        krilla::image::ImageColorspace::Luma
+    }
+}
+
 /// A CMYK raster as a krilla image: its samples are written unchanged as DeviceCMYK, like a
 /// CMYK JPEG's. An embedded ICC profile is left out, as it is for JPEGs: the inks are meant for
 /// the output intent's press, and tagging them with another CMYK profile would let a RIP
@@ -1768,11 +1842,18 @@ fn recompress(data: &[u8], mode: RasterMode) -> Option<Image> {
     if img.color().has_alpha() && img.to_rgba8().pixels().any(|p| p[3] < 255) {
         return None;
     }
-    let rgb = img.to_rgb8();
     let mut buf = Vec::new();
     let enc = image::codecs::jpeg::JpegEncoder::new_with_quality(&mut buf, 90);
-    image::ImageEncoder::write_image(enc, rgb.as_raw(), rgb.width(), rgb.height(), image::ExtendedColorType::Rgb8).ok()?;
-    jpeg(buf.into(), || embedded_icc(data).filter(|p| is_rgb_icc(p)), mode)
+    // A grey image stays a grey JPEG (#1426).
+    let grey = !img.color().has_color();
+    if grey {
+        let l = img.to_luma8();
+        image::ImageEncoder::write_image(enc, l.as_raw(), l.width(), l.height(), image::ExtendedColorType::L8).ok()?;
+    } else {
+        let rgb = img.to_rgb8();
+        image::ImageEncoder::write_image(enc, rgb.as_raw(), rgb.width(), rgb.height(), image::ExtendedColorType::Rgb8).ok()?;
+    }
+    jpeg(buf.into(), || embedded_icc(data).filter(|p| if grey { is_grey_icc(p) } else { is_rgb_icc(p) }), mode)
 }
 
 #[cfg(test)]
diff --git a/crates/pdf/src/forms.rs b/crates/pdf/src/forms.rs
index 39aa597e..07f4cf04 100644
--- a/crates/pdf/src/forms.rs
+++ b/crates/pdf/src/forms.rs
@@ -8,7 +8,7 @@ use std::fmt::Write as _;
 use designcraft_doc::{Document, FieldKind, FormField, Item, MediaOptions};
 
 use crate::export::Sheet;
-use crate::transitions::{int_after, object, rfind};
+use crate::transitions::{bracketed, int_after, object, rfind};
 
 /// A field placed on an output page: (page index, PDF rectangle, field).
 pub(crate) type Placed = (usize, [f64; 4], FormField);
@@ -94,7 +94,7 @@ pub(crate) fn add_fields(pdf: &[u8], fields: &[Placed], media: &[PlacedMedia]) -
     let pages_id = int_after(&cat, "/Pages")?;
     let pages = String::from_utf8_lossy(&pdf[object(pdf, pages_id)?]).to_string();
     let kids_str = &pages[pages.find("/Kids")? + 5..];
-    let kids_str = &kids_str[kids_str.find('[')? + 1..kids_str.find(']')?];
+    let kids_str = bracketed(kids_str)?;
     let nums: Vec<usize> = kids_str.split_whitespace().filter_map(|t| t.parse().ok()).collect();
     let kids: Vec<usize> = nums.chunks(2).map(|c| c[0]).collect();
 
diff --git a/crates/pdf/src/pdfx.rs b/crates/pdf/src/pdfx.rs
index 534886f1..2be38f97 100644
--- a/crates/pdf/src/pdfx.rs
+++ b/crates/pdf/src/pdfx.rs
@@ -10,6 +10,8 @@ use hayro_syntax::page::Resources;
 
 use crate::transitions::{find, int_after, object, rfind};
 
+mod fonts;
+
 /// Escape a PDF literal string.
 fn lit(s: &str) -> String {
     let mut o = String::from("(");
@@ -94,7 +96,7 @@ pub fn make_pdfx4(pdf: &[u8], title: &str, date: Option<i64>) -> Option<Vec<u8>>
         let s0 = find(body, b"stream", 0)? + b"stream".len();
         let s0 = s0 + body[s0..].iter().take_while(|c| **c == b'\r' || **c == b'\n').count();
         let s1 = rfind(body, b"endstream")?;
-        let xml = String::from_utf8_lossy(&body[s0..s1]).trim_end().to_string();
+        let xml = String::from_utf8_lossy(body.get(s0..s1)?).trim_end().to_string();
         let dict = String::from_utf8_lossy(&body[..find(body, b"stream", 0)?]).to_string();
         if dict.contains("/Filter") {
             return None;
@@ -246,6 +248,7 @@ pub fn check_pdfx4(pdf: &[u8]) -> Vec<String> {
         issues.push("Type 3 fonts aren't allowed".into());
     }
     issues.extend(device_rgb(pdf));
+    issues.extend(fonts::unembedded_fonts(pdf));
     issues
 }
 
@@ -480,7 +483,7 @@ mod tests {
 
     use crate::{ExportReport, PdfOptions, Standard, check_pdfx4, export_pdf_with_report};
 
-    fn place(d: &mut Document, name: &str, data: Vec<u8>, size: (f64, f64), at: (f64, f64)) {
+    pub(super) fn place(d: &mut Document, name: &str, data: Vec<u8>, size: (f64, f64), at: (f64, f64)) {
         let asset = AssetId(d.alloc());
         let mime = designcraft_images::mime(&data).into();
         let pixels = designcraft_images::pixel_size(&data);
@@ -579,7 +582,7 @@ mod tests {
         pdf.finish().unwrap()
     }
 
-    fn x4(d: &Document) -> ExportReport {
+    pub(super) fn x4(d: &Document) -> ExportReport {
         export_pdf_with_report(d, &Cache::new(), &PdfOptions { standard: Standard::PdfX4, ..Default::default() }).unwrap()
     }
 
@@ -645,13 +648,18 @@ mod tests {
     /// A minimal PDF with a CMYK (N 4) PDF/X output intent and one page with `entries` (its
     /// resources, a group…) and `content`.
     fn tiny_pdf(entries: &str, content: &str) -> Vec<u8> {
+        tiny_pdf_with(entries, content, "<</N 3/Length 0>>\nstream\n\nendstream")
+    }
+
+    /// [`tiny_pdf`] with `extra` as object 6 (an RGB profile in [`tiny_pdf`]).
+    pub(super) fn tiny_pdf_with(entries: &str, content: &str, extra: &str) -> Vec<u8> {
         let objects = [
             "<</Type/Catalog/Pages 2 0 R/OutputIntents[<</Type/OutputIntent/S/GTS_PDFX/DestOutputProfile 4 0 R>>]>>".to_string(),
             "<</Type/Pages/Kids[3 0 R]/Count 1>>".to_string(),
             format!("<</Type/Page/Parent 2 0 R/MediaBox[0 0 100 100]{entries}/Contents 5 0 R>>"),
             "<</N 4/Length 0>>\nstream\n\nendstream".to_string(),
             format!("<</Length {}>>\nstream\n{content}\nendstream", content.len()),
-            "<</N 3/Length 0>>\nstream\n\nendstream".to_string(),
+            extra.to_string(),
         ];
         let mut out = b"%PDF-1.6\n".to_vec();
         let mut offsets = Vec::new();
@@ -668,6 +676,18 @@ mod tests {
         out
     }
 
+    /// A metadata object whose only `stream` is the one inside `endstream` is refused, not a slice panic.
+    #[test]
+    fn metadata_with_only_endstream_does_not_panic() {
+        let objects = ["<</Type/Catalog/Pages 2 0 R/Metadata 3 0 R>>", "<</Type/Pages/Kids[]/Count 0>>", "<</Type/Metadata>>endstream"];
+        let mut out = b"%PDF-1.6\n".to_vec();
+        for (i, o) in objects.iter().enumerate() {
+            out.extend_from_slice(format!("{} 0 obj\n{o}\nendobj\n", i + 1).as_bytes());
+        }
+        out.extend_from_slice(b"trailer\n<</Size 4/Root 1 0 R>>\nstartxref\n0\n%%EOF\n");
+        assert!(super::make_pdfx4(&out, "t", None).is_none());
+    }
+
     /// DeviceRGB is allowed when a `DefaultRGB` colour space makes it colour-managed.
     #[test]
     fn default_rgb_makes_device_rgb_managed() {
@@ -682,6 +702,108 @@ mod tests {
         assert!(!cmyk.iter().any(rgb), "{cmyk:?}");
     }
 
+    /// Every font that draws visible text must be embedded (#909): a base-14 font with no font
+    /// file, a CID font whose descendant has none, and one drawn from inside a form are reported;
+    /// an embedded font, an unused one and invisible text (render mode 3, as in OCR layers) are not.
+    #[test]
+    fn unembedded_fonts_are_flagged() {
+        let fonts = |entries: &str, content: &str| -> Vec<String> {
+            check_pdfx4(&tiny_pdf(entries, content)).into_iter().filter(|i| i.contains("font")).collect()
+        };
+        let helvetica = "/Resources<</Font<</F1<</Type/Font/Subtype/Type1/BaseFont/Helvetica>>>>>>";
+        assert_eq!(
+            fonts(helvetica, "BT /F1 24 Tf 20 50 Td (Base14 text) Tj ET"),
+            ["the font Helvetica isn't embedded (page 1): PDF/X-4 needs every font used for visible text embedded"]
+        );
+        assert!(fonts(helvetica, "BT /F1 24 Tf 3 Tr 20 50 Td (OCR) Tj ET").is_empty(), "invisible text needs no embedded font");
+        assert!(fonts(helvetica, "0 0 0 1 k 0 0 10 10 re f").is_empty(), "an unused font is not reported");
+        let restored = fonts(helvetica, "BT /F1 24 Tf q 3 Tr Q 20 50 Td (shown) Tj ET");
+        assert_eq!(restored.len(), 1, "Q restores the visible render mode: {restored:?}");
+
+        let embedded = "/Resources<</Font<</F1<</Type/Font/Subtype/TrueType/BaseFont/ABCDEF+Arial/FontDescriptor<</Type/FontDescriptor/FontName/ABCDEF+Arial/FontFile2 6 0 R>>>>>>>>";
+        assert!(fonts(embedded, "BT /F1 12 Tf (x) Tj ET").is_empty());
+        let cid = "/Resources<</Font<</F1<</Type/Font/Subtype/Type0/BaseFont/KozMin/Encoding/Identity-H/DescendantFonts[<</Type/Font/Subtype/CIDFontType0/BaseFont/KozMin/FontDescriptor<</Type/FontDescriptor/FontName/KozMin>>>>]>>>>>>";
+        assert_eq!(fonts(cid, "BT /F1 12 Tf <0001> Tj ET").len(), 1);
+        let cid_embedded = cid.replace("/FontName/KozMin>>", "/FontName/KozMin/FontFile3 6 0 R>>");
+        assert!(fonts(&cid_embedded, "BT /F1 12 Tf <0001> Tj ET").is_empty());
+
+        let draw = "BT /T 9 Tf (in a form) Tj ET";
+        let form = format!(
+            "<</Type/XObject/Subtype/Form/BBox[0 0 100 100]/Resources<</Font<</T<</Type/Font/Subtype/Type1/BaseFont/Times-Roman>>>>>>/Length {}>>\nstream\n{draw}\nendstream",
+            draw.len()
+        );
+        let pdf = tiny_pdf_with("/Resources<</XObject<</X1 6 0 R>>>>", "/X1 Do", &form);
+        let issues: Vec<String> = check_pdfx4(&pdf).into_iter().filter(|i| i.contains("font")).collect();
+        assert_eq!(issues.len(), 1, "{issues:?}");
+        assert!(issues[0].starts_with("the font Times-Roman isn't embedded"), "{issues:?}");
+    }
+
+    /// A placed PDF that draws with an unembedded font: the PDF/X-4 export warns about it (#909).
+    #[test]
+    fn placed_pdf_with_an_unembedded_font_is_reported() {
+        let mut d = Document::new(&NewDocument::default());
+        let placed = tiny_pdf(
+            "/Resources<</Font<</F1<</Type/Font/Subtype/Type1/BaseFont/Helvetica/Encoding/WinAnsiEncoding>>>>>>",
+            "BT /F1 24 Tf 0 0 0 1 k 20 50 Td (Base14 text) Tj ET",
+        );
+        place(&mut d, "helvetica.pdf", placed, (100.0, 100.0), (72.0, 72.0));
+        let r = x4(&d);
+        assert!(r.warnings.iter().any(|w| w.starts_with("PDF/X-4: the font Helvetica isn't embedded (page 1)")), "{:?}", r.warnings);
+    }
+
+    #[test]
+    fn unembedded_fonts_are_reported_by_every_text_show_operator() {
+        let entries = "/Resources<</Font<</F1<</Type/Font/Subtype/Type1/BaseFont/Helvetica>>>>>>";
+        for show in ["(x) Tj", "[(x) 20 (y)] TJ", "(x) '", "0 0 (x) \""] {
+            let pdf = tiny_pdf(entries, &format!("BT /F1 12 Tf {show} ET"));
+            let issues = check_pdfx4(&pdf);
+            assert_eq!(issues.iter().filter(|i| i.contains("isn't embedded")).count(), 1, "{show}: {issues:?}");
+        }
+    }
+
+    #[test]
+    fn unembedded_fonts_in_forms_inherit_and_restore_text_state() {
+        let entries = "/Resources<</Font<</F1<</Type/Font/Subtype/Type1/BaseFont/Helvetica>>>>/XObject<</X1 6 0 R>>>>";
+        let draw = "BT (inherited font) Tj /F1 10 Tf 3 Tr ET";
+        let form = format!("<</Type/XObject/Subtype/Form/BBox[0 0 100 100]/Length {}>>\nstream\n{draw}\nendstream", draw.len());
+        for (content, count) in [
+            ("/F1 12 Tf /X1 Do", 1),
+            ("/F1 12 Tf 3 Tr /X1 Do", 0),
+            ("/F1 12 Tf 3 Tr /X1 Do 0 Tr /X1 Do", 1),
+            ("/F1 12 Tf /X1 Do BT (still visible) Tj ET", 1),
+        ] {
+            let pdf = tiny_pdf_with(entries, content, &form);
+            let issues = check_pdfx4(&pdf);
+            assert_eq!(issues.iter().filter(|i| i.contains("isn't embedded")).count(), count, "{content}: {issues:?}");
+        }
+    }
+
+    #[test]
+    fn unembedded_fonts_in_recursive_forms_are_bounded() {
+        let draw = "BT /F1 12 Tf (x) Tj ET /X1 Do";
+        let form = format!(
+            "<</Type/XObject/Subtype/Form/BBox[0 0 100 100]/Resources<</Font<</F1<</Type/Font/Subtype/Type1/BaseFont/Helvetica>>>>/XObject<</X1 6 0 R>>>>/Length {}>>\nstream\n{draw}\nendstream",
+            draw.len()
+        );
+        let pdf = tiny_pdf_with("/Resources<</XObject<</X1 6 0 R>>>>", "/X1 Do", &form);
+        let issues = check_pdfx4(&pdf);
+        assert_eq!(issues.iter().filter(|i| i.contains("isn't embedded")).count(), 1, "{issues:?}");
+    }
+
+    #[test]
+    fn unembedded_fonts_are_reported_after_form_text_state_is_restored() {
+        let entries = "/Resources<</Font<</F1<</Type/Font/Subtype/Type1/BaseFont/Helvetica>>>>/XObject<</X1 6 0 R>>>>";
+        let draw = "BT /F2 10 Tf 3 Tr (hidden) Tj ET";
+        let form = format!(
+            "<</Type/XObject/Subtype/Form/BBox[0 0 100 100]/Resources<</Font<</F2<</Type/Font/Subtype/Type1/BaseFont/Times-Roman>>>>>>/Length {}>>\nstream\n{draw}\nendstream",
+            draw.len()
+        );
+        let pdf = tiny_pdf_with(entries, "/F1 12 Tf /X1 Do BT (visible) Tj ET", &form);
+        let issues: Vec<String> = check_pdfx4(&pdf).into_iter().filter(|i| i.contains("isn't embedded")).collect();
+        assert_eq!(issues.len(), 1, "{issues:?}");
+        assert!(issues[0].starts_with("the font Helvetica isn't embedded"), "{issues:?}");
+    }
+
     /// An RGB blending space on the page group and an RGB inline image are device RGB too.
     #[test]
     fn rgb_groups_and_inline_images_are_flagged() {
diff --git a/crates/pdf/src/pdfx/fonts.rs b/crates/pdf/src/pdfx/fonts.rs
new file mode 100644
index 00000000..5dc149b7
--- /dev/null
+++ b/crates/pdf/src/pdfx/fonts.rs
@@ -0,0 +1,172 @@
+use std::collections::{BTreeMap, BTreeSet, HashMap, HashSet};
+
+use hayro_syntax::content::UntypedIter;
+use hayro_syntax::object::{Array, Dict, Name, Object, ObjectIdentifier};
+use hayro_syntax::page::Resources;
+
+use super::MAX_DEPTH;
+
+#[cfg(test)]
+mod tests;
+
+const MAX_OPERATIONS: usize = 100_000;
+const LIMIT_WARNING: &str = "font scan operation limit reached: PDF/X-4 font embedding checks are incomplete";
+const DEPTH_WARNING: &str = "font scan nesting depth limit reached: PDF/X-4 font embedding checks are incomplete";
+
+pub(super) fn unembedded_fonts(pdf: &[u8]) -> Vec<String> {
+    let Ok(file) = hayro_syntax::Pdf::new(pdf.to_vec()) else { return Vec::new() };
+    let mut found: BTreeMap<String, Vec<usize>> = BTreeMap::new();
+    let mut scan = FontScan::default();
+    for (i, page) in file.pages().iter().enumerate() {
+        scan.font = None;
+        scan.mode = 0;
+        if let Some(content) = page.page_stream() {
+            scan.content(content, page.resources(), 0);
+        }
+        for name in std::mem::take(&mut scan.found) {
+            found.entry(name).or_default().push(i + 1);
+        }
+        if scan.limited {
+            break;
+        }
+    }
+    let mut warnings: Vec<String> = found
+        .into_iter()
+        .map(|(name, pages)| {
+            let list: Vec<String> = pages.iter().take(10).map(|p| p.to_string()).collect();
+            let more = if pages.len() > 10 { ", …" } else { "" };
+            let s = if pages.len() == 1 { "" } else { "s" };
+            format!("the font {name} isn't embedded (page{s} {}{more}): PDF/X-4 needs every font used for visible text embedded", list.join(", "))
+        })
+        .collect();
+    if scan.limited {
+        warnings.push(LIMIT_WARNING.to_string());
+    }
+    if scan.depth_limited {
+        warnings.push(DEPTH_WARNING.to_string());
+    }
+    warnings
+}
+
+fn font_embedded(font: &Dict<'_>) -> bool {
+    let descriptor = match font.get::<Name<'_>>(b"Subtype").as_deref() {
+        Some(b"Type3") => return true,
+        Some(b"Type0") => {
+            font.get::<Array<'_>>(b"DescendantFonts").and_then(|a| a.iter::<Dict<'_>>().next()).and_then(|d| d.get::<Dict<'_>>(b"FontDescriptor"))
+        }
+        _ => font.get::<Dict<'_>>(b"FontDescriptor"),
+    };
+    descriptor.is_some_and(|d| d.contains_key(b"FontFile") || d.contains_key(b"FontFile2") || d.contains_key(b"FontFile3"))
+}
+
+#[derive(Default)]
+struct FontScan<'a> {
+    found: BTreeSet<String>,
+    active: HashSet<ObjectIdentifier>,
+    path: Vec<ObjectIdentifier>,
+    completed: HashMap<FormContext<'a>, BTreeSet<String>>,
+    font: Option<Dict<'a>>,
+    mode: i32,
+    operations: usize,
+    limited: bool,
+    // A form nested too deeply to follow. The scan goes on (unlike `limited`), and the flag is
+    // never cleared, so a memoized subtree that was cut short can't hide it.
+    depth_limited: bool,
+}
+
+// Forms inherit text state and missing resource names. Depth and ancestors also affect
+// which descendants the depth/cycle guards permit; only identical contexts may share results.
+#[derive(Hash, PartialEq, Eq)]
+struct FormContext<'a> {
+    form: ObjectIdentifier,
+    font: Option<&'a [u8]>,
+    mode: i32,
+    resources: Vec<(&'a [u8], &'a [u8])>,
+    ancestors: Vec<ObjectIdentifier>,
+}
+
+impl<'a> FontScan<'a> {
+    fn content(&mut self, data: &[u8], res: &Resources<'a>, depth: usize) {
+        if depth > MAX_DEPTH {
+            return;
+        }
+        let mut saved = Vec::new();
+        let mut ops = UntypedIter::new(data);
+        while let Some(op) = ops.next() {
+            if self.operations == MAX_OPERATIONS {
+                self.limited = true;
+                return;
+            }
+            self.operations += 1;
+            let operator: &[u8] = op.operator;
+            match operator {
+                b"q" => saved.push((self.font.clone(), self.mode)),
+                b"Q" => {
+                    if let Some(state) = saved.pop() {
+                        (self.font, self.mode) = state;
+                    }
+                }
+                b"Tf" => self.font = op.operands().next().cloned().and_then(Object::into_name).and_then(|n| res.get_font(&n)),
+                b"Tr" => {
+                    if let Some(mode) = op.operands().next().cloned().and_then(|n| i32::try_from(n).ok()) {
+                        self.mode = mode;
+                    }
+                }
+                b"Tj" | b"TJ" | b"'" | b"\"" if self.mode != 3 => {
+                    if let Some(font) = self.font.as_ref().filter(|f| !font_embedded(f)) {
+                        let name = font.get::<Name<'_>>(b"BaseFont").map_or_else(|| "(unnamed)".to_string(), |n| n.as_str().to_string());
+                        self.found.insert(name);
+                    }
+                }
+                b"Do" => {
+                    let xo = op.operands().last().cloned().and_then(Object::into_name).and_then(|n| res.get_x_object(&n));
+                    if let Some(form) = xo.filter(|x| x.dict().get::<Name<'_>>(b"Subtype").as_deref() == Some(b"Form"))
+                        && (depth < MAX_DEPTH || {
+                            // A form already being scanned is a cycle: it can't hide new content.
+                            self.depth_limited |= !self.active.contains(&form.obj_id());
+                            false
+                        })
+                        && self.active.insert(form.obj_id())
+                    {
+                        let mut resources = Vec::new();
+                        let mut parent = Some(res);
+                        while let Some(r) = parent {
+                            resources.push((r.fonts.data(), r.x_objects.data()));
+                            parent = r.parent();
+                        }
+                        let key = FormContext {
+                            form: form.obj_id(),
+                            font: self.font.as_ref().map(Dict::data),
+                            mode: self.mode,
+                            resources,
+                            ancestors: self.path.clone(),
+                        };
+                        if let Some(found) = self.completed.get(&key) {
+                            self.found.extend(found.iter().cloned());
+                            self.active.remove(&form.obj_id());
+                            continue;
+                        }
+                        let inner = Resources::from_parent(form.dict().get::<Dict<'_>>(b"Resources").unwrap_or_default(), res.clone());
+                        let state = (self.font.clone(), self.mode);
+                        let outer_found = std::mem::take(&mut self.found);
+                        self.path.push(form.obj_id());
+                        if let Ok(data) = form.decoded() {
+                            self.content(&data, &inner, depth + 1);
+                        }
+                        self.path.pop();
+                        if !self.limited {
+                            self.completed.insert(key, self.found.clone());
+                        }
+                        self.found.extend(outer_found);
+                        (self.font, self.mode) = state;
+                        self.active.remove(&form.obj_id());
+                        if self.limited {
+                            return;
+                        }
+                    }
+                }
+                _ => {}
+            }
+        }
+    }
+}
diff --git a/crates/pdf/src/pdfx/fonts/tests.rs b/crates/pdf/src/pdfx/fonts/tests.rs
new file mode 100644
index 00000000..c148cb07
--- /dev/null
+++ b/crates/pdf/src/pdfx/fonts/tests.rs
@@ -0,0 +1,153 @@
+use std::time::{Duration, Instant};
+
+use super::{DEPTH_WARNING, FontScan, LIMIT_WARNING, MAX_OPERATIONS, unembedded_fonts};
+use crate::check_pdfx4;
+use crate::pdfx::tests::{place, tiny_pdf_with, x4};
+use designcraft_doc::{Document, build::NewDocument};
+
+fn stream(entries: &str, content: &str) -> String {
+    format!("<<{entries}/Length {}>>\nstream\n{content}\nendstream", content.len())
+}
+
+fn fanout_pdf(levels: usize) -> Vec<u8> {
+    let mut objects = vec![
+        "<</Type/Catalog/Pages 2 0 R>>".to_string(),
+        "<</Type/Pages/Kids[3 0 R]/Count 1>>".to_string(),
+        "<</Type/Page/Parent 2 0 R/MediaBox[0 0 100 100]/Resources<</XObject<</Next 5 0 R>>>>/Contents 4 0 R>>".to_string(),
+        stream("", "/Next Do"),
+    ];
+    for level in 0..levels {
+        let resources = if level + 1 == levels {
+            "/Font<</F1<</Type/Font/Subtype/Type1/BaseFont/Helvetica>>>>".to_string()
+        } else {
+            format!("/XObject<</Next {} 0 R>>", level + 6)
+        };
+        let content = if level + 1 == levels { "BT /F1 12 Tf (bottom) Tj ET".to_string() } else { "/Next Do\n".repeat(10) };
+        objects.push(stream(&format!("/Type/XObject/Subtype/Form/BBox[0 0 100 100]/Resources<<{resources}>>"), &content));
+    }
+    pdf_objects(&objects)
+}
+
+fn pdf_objects(objects: &[String]) -> Vec<u8> {
+    let mut bytes = b"%PDF-1.6\n".to_vec();
+    let mut offsets = Vec::new();
+    for (i, object) in objects.iter().enumerate() {
+        offsets.push(bytes.len());
+        bytes.extend_from_slice(format!("{} 0 obj\n{object}\nendobj\n", i + 1).as_bytes());
+    }
+    let xref = bytes.len();
+    bytes.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f\r\n", objects.len() + 1).as_bytes());
+    for offset in offsets {
+        bytes.extend_from_slice(format!("{offset:010} 00000 n\r\n").as_bytes());
+    }
+    bytes.extend_from_slice(format!("trailer\n<</Size {}/Root 1 0 R>>\nstartxref\n{xref}\n%%EOF\n", objects.len() + 1).as_bytes());
+    bytes
+}
+
+#[test]
+fn nested_form_fanout_is_memoized_and_reports_bottom_font() {
+    let bytes = fanout_pdf(16);
+    let pdf = hayro_syntax::Pdf::new(bytes.clone()).unwrap();
+    let page = pdf.pages().first().unwrap();
+    let mut scan = FontScan::default();
+    let start = Instant::now();
+    scan.content(page.page_stream().unwrap(), page.resources(), 0);
+    assert!(start.elapsed() < Duration::from_millis(500));
+    assert_eq!(scan.operations, 155);
+    assert_eq!(scan.completed.len(), 16);
+    assert!(!scan.limited);
+    assert!(!scan.depth_limited);
+    assert_eq!(scan.found.into_iter().collect::<Vec<_>>(), ["Helvetica"]);
+    assert!(check_pdfx4(&bytes).iter().any(|w| w.contains("Helvetica isn't embedded")));
+}
+
+#[test]
+fn placed_pdf_nested_form_fanout_reports_unembedded_font() {
+    let mut doc = Document::new(&NewDocument::default());
+    place(&mut doc, "fanout.pdf", fanout_pdf(14), (100.0, 100.0), (72.0, 72.0));
+    let report = x4(&doc);
+    assert!(report.warnings.iter().any(|w| w.contains("Helvetica isn't embedded")), "{:?}", report.warnings);
+}
+
+#[test]
+fn form_memo_resolves_resource_names_in_each_parent_context() {
+    let wrapper = |font: &str| {
+        stream(
+            &format!("/Type/XObject/Subtype/Form/BBox[0 0 100 100]/Resources<</Font<</F1<</Type/Font/Subtype/Type1/BaseFont/{font}>>>>>>"),
+            "/Shared Do",
+        )
+    };
+    let bytes = pdf_objects(&[
+        "<</Type/Catalog/Pages 2 0 R>>".into(),
+        "<</Type/Pages/Kids[3 0 R]/Count 1>>".into(),
+        "<</Type/Page/Parent 2 0 R/MediaBox[0 0 100 100]/Resources<</XObject<</A 5 0 R/B 6 0 R/Shared 7 0 R>>>>/Contents 4 0 R>>".into(),
+        stream("", "/A Do /B Do"),
+        wrapper("Helvetica"),
+        wrapper("Times-Roman"),
+        stream("/Type/XObject/Subtype/Form/BBox[0 0 100 100]", "BT /F1 12 Tf (shared) Tj ET"),
+    ]);
+    let issues = unembedded_fonts(&bytes);
+    assert_eq!(issues.len(), 2, "{issues:?}");
+    assert!(issues.iter().any(|w| w.contains("Helvetica isn't embedded")));
+    assert!(issues.iter().any(|w| w.contains("Times-Roman isn't embedded")));
+}
+
+#[test]
+fn form_memo_replays_font_findings_on_each_page() {
+    let page = "<</Type/Page/Parent 2 0 R/MediaBox[0 0 100 100]/Resources<</XObject<</Shared 6 0 R>>>>/Contents 5 0 R>>";
+    let bytes = pdf_objects(&[
+        "<</Type/Catalog/Pages 2 0 R>>".into(),
+        "<</Type/Pages/Kids[3 0 R 4 0 R]/Count 2>>".into(),
+        page.into(),
+        page.into(),
+        stream("", "/Shared Do"),
+        stream(
+            "/Type/XObject/Subtype/Form/BBox[0 0 100 100]/Resources<</Font<</F1<</Type/Font/Subtype/Type1/BaseFont/Helvetica>>>>>>",
+            "BT /F1 12 Tf (shared) Tj ET",
+        ),
+    ]);
+    let issues = unembedded_fonts(&bytes);
+    assert_eq!(issues.len(), 1, "{issues:?}");
+    assert!(issues[0].contains("(pages 1, 2)"), "{issues:?}");
+}
+
+#[test]
+fn form_memo_keeps_inherited_font_and_resource_contexts_distinct() {
+    let draw = "BT (inherited) Tj /F1 12 Tf (resource) Tj ET";
+    let form = stream("/Type/XObject/Subtype/Form/BBox[0 0 100 100]", draw);
+    let entries = "/Resources<</Font<</F1<</Type/Font/Subtype/Type1/BaseFont/Helvetica>>/F2<</Type/Font/Subtype/Type1/BaseFont/Times-Roman>>>>/XObject<</X1 6 0 R>>>>";
+    let bytes = tiny_pdf_with(entries, "/F1 12 Tf /X1 Do /F2 12 Tf /X1 Do", &form);
+    let issues = unembedded_fonts(&bytes);
+    assert_eq!(issues.len(), 2, "{issues:?}");
+    assert!(issues.iter().any(|w| w.contains("Times-Roman isn't embedded")));
+}
+
+#[test]
+fn font_scan_operation_budget_warns_instead_of_silently_truncating() {
+    let content = "q Q\n".repeat(MAX_OPERATIONS);
+    let bytes = tiny_pdf_with("/Resources<<>>", &content, "<<>>");
+    assert_eq!(unembedded_fonts(&bytes), [LIMIT_WARNING]);
+}
+
+#[test]
+fn font_scan_depth_limit_warns_instead_of_silently_truncating() {
+    // The font is two levels below the deepest form followed, and every level draws the next
+    // ten times: memo replays of the cut-short subtree still give one warning.
+    assert_eq!(unembedded_fonts(&fanout_pdf(18)), [DEPTH_WARNING]);
+}
+
+#[test]
+fn font_scan_cycles_are_not_reported_as_incomplete() {
+    let font = "/Font<</F1<</Type/Font/Subtype/Type1/BaseFont/Helvetica>>>>";
+    let bytes = pdf_objects(&[
+        "<</Type/Catalog/Pages 2 0 R>>".to_string(),
+        "<</Type/Pages/Kids[3 0 R]/Count 1>>".to_string(),
+        "<</Type/Page/Parent 2 0 R/MediaBox[0 0 100 100]/Resources<</XObject<</A 5 0 R>>>>/Contents 4 0 R>>".to_string(),
+        stream("", "/A Do"),
+        stream(&format!("/Type/XObject/Subtype/Form/BBox[0 0 100 100]/Resources<<{font}/XObject<</B 6 0 R>>>>"), "BT /F1 12 Tf (a) Tj ET /B Do"),
+        stream("/Type/XObject/Subtype/Form/BBox[0 0 100 100]/Resources<</XObject<</A 5 0 R/B 6 0 R>>>>", "/A Do /B Do"),
+    ]);
+    let warnings = unembedded_fonts(&bytes);
+    assert_eq!(warnings.len(), 1, "{warnings:?}");
+    assert!(warnings[0].contains("Helvetica isn't embedded"), "{warnings:?}");
+}
diff --git a/crates/pdf/src/tests.rs b/crates/pdf/src/tests.rs
index ee02e219..39f472ff 100644
--- a/crates/pdf/src/tests.rs
+++ b/crates/pdf/src/tests.rs
@@ -340,6 +340,26 @@ fn cmyk_tiff_keeps_its_inks() {
     }
 }
 
+/// A placed greyscale TIFF went into PDFs as DeviceRGB, unlike a greyscale PNG or JPEG (#1426):
+/// a page holding only a black-and-white scan declared colour.
+#[test]
+fn grey_tiff_exports_as_device_gray() {
+    let px: Vec<u8> = vec![0, 64, 128, 255, 255, 128, 64, 0];
+    let mut tif = Vec::new();
+    tiff::encoder::TiffEncoder::new(std::io::Cursor::new(&mut tif)).unwrap().write_image::<tiff::encoder::colortype::Gray8>(4, 2, &px).unwrap();
+    let mut d = doc_with_text("x");
+    place(&mut d, tif, (4, 2));
+    for standard in [Standard::None, Standard::PdfX4] {
+        let r = export_pdf_with_report(&d, &Cache::new(), &PdfOptions { standard, ..Default::default() }).unwrap();
+        assert!(r.warnings.is_empty(), "{standard:?}: {:?}", r.warnings);
+        assert_eq!(image_xobjects(&r.bytes), vec![("DeviceGray".to_string(), px.clone())], "{standard:?}");
+    }
+    // Recompressed, it stays a grey JPEG.
+    let r = export_pdf_with_report(&d, &Cache::new(), &PdfOptions { compress_images: true, compress: false, ..Default::default() }).unwrap();
+    let s = String::from_utf8_lossy(&r.bytes);
+    assert!(s.contains("/DCTDecode") && s.contains("/DeviceGray") && !s.contains("/DeviceRGB"), "a grey JPEG");
+}
+
 /// An 8×8 raster encoded as `fmt`; `alpha` gives it a transparent corner.
 fn raster(fmt: image::ImageFormat, alpha: bool) -> Vec<u8> {
     let img =
diff --git a/crates/pdf/src/text.rs b/crates/pdf/src/text.rs
index 300a47d9..1aaf435d 100644
--- a/crates/pdf/src/text.rs
+++ b/crates/pdf/src/text.rs
@@ -160,7 +160,7 @@ fn cluster_chars(members: &[PlacedGlyph], cluster: &str) -> Option<Vec<(usize, c
 fn text_rules(cs: &ComposedStory, ft: &FrameText, underline: bool) -> Vec<(designcraft_compose::Rule, Rect)> {
     let mut bars: Vec<(designcraft_compose::Rule, Rect)> = Vec::new();
     for line in &ft.lines {
-        for g in line.glyphs.iter().filter(|g| g.visible) {
+        for g in line.glyphs.iter().filter(|g| g.spans_rules()) {
             let style = &cs.styles[g.style as usize];
             let (on, rule) = if underline { (style.underline, &style.underline_rule) } else { (style.strikethrough, &style.strike_rule) };
             if !on {
@@ -638,3 +638,39 @@ fn glyph_outlines(glyphs: &[PlacedGlyph], size: f64, tan: f64) -> BezPath {
     }
     bp
 }
+
+#[cfg(test)]
+mod rule_tests {
+    use super::*;
+    use designcraft_compose::Cache;
+    use designcraft_doc::{Document, ParaFormat, SpreadRef};
+    use designcraft_geom::Rect;
+
+    /// A tab draws nothing but advances to its stop, and the underline runs across it, as it does
+    /// on screen: a form's fill-in lines are underlined tabs (#1466).
+    #[test]
+    fn an_underline_runs_across_a_tab() {
+        let mut doc = Document::new(&Default::default());
+        for style in &mut doc.styles_mut().paragraph {
+            style.chars.underline = Some(true);
+        }
+        let layer = doc.default_layer();
+        let (_, sid) =
+            doc.add_text_frame(SpreadRef::Doc(0), Rect::new(36.0, 36.0, 400.0, 300.0), layer, "Name\tCity", ParaFormat::default()).unwrap();
+        let cs = Cache::new().get(&doc, sid, None);
+        let line = &cs.frames[0].lines[0];
+        let tab = line.glyphs.iter().find(|g| g.rendered_char == '\t').expect("the tab is placed on the line");
+        let bars = text_rules(&cs, &cs.frames[0], true);
+        assert_eq!(bars.len(), 1, "one bar across the line, not one before the tab and one after: {bars:?}");
+        let bar = bars[0].1;
+        assert!(bar.x0 <= tab.x + 0.5 && bar.x1 >= tab.x + tab.adv - 0.5, "the bar covers the tab: {bar:?}, tab {} + {}", tab.x, tab.adv);
+        // The strikethrough of the same text behaves the same way.
+        for style in &mut doc.styles_mut().paragraph {
+            style.chars.underline = None;
+            style.chars.strikethrough = Some(true);
+        }
+        let cs = Cache::new().get(&doc, sid, None);
+        assert!(text_rules(&cs, &cs.frames[0], true).is_empty(), "no underline now");
+        assert_eq!(text_rules(&cs, &cs.frames[0], false).len(), 1, "one strike across the line");
+    }
+}
diff --git a/crates/pdf/src/transitions.rs b/crates/pdf/src/transitions.rs
index cbfbe27c..d37581af 100644
--- a/crates/pdf/src/transitions.rs
+++ b/crates/pdf/src/transitions.rs
@@ -43,6 +43,14 @@ pub(crate) fn int_after(s: &str, key: &str) -> Option<usize> {
     rest[..end].parse().ok()
 }
 
+/// The text between the first `[` and the first `]` after it. `None` when there is no such pair (a `]`
+/// before the `[` included).
+pub(crate) fn bracketed(s: &str) -> Option<&str> {
+    let open = s.find('[')?;
+    let close = s[open..].find(']')? + open;
+    s.get(open + 1..close)
+}
+
 /// Byte range of object `id`'s body (between `obj` and `endobj`).
 pub(crate) fn object(pdf: &[u8], id: usize) -> Option<std::ops::Range<usize>> {
     // The latest copy (incremental updates re-state objects further on).
@@ -132,7 +140,7 @@ pub fn add_page_entries(pdf: &[u8], extra: &[Option<String>]) -> Option<Vec<u8>>
     let pages = String::from_utf8_lossy(&pdf[object(pdf, pages_id)?]).to_string();
     let kids_at = pages.find("/Kids")?;
     let kids_str = &pages[kids_at + 5..];
-    let kids_str = &kids_str[kids_str.find('[')? + 1..kids_str.find(']')?];
+    let kids_str = bracketed(kids_str)?;
     let nums: Vec<usize> = kids_str.split_whitespace().filter_map(|t| t.parse().ok()).collect();
     let kids: Vec<usize> = nums.chunks(2).map(|c| c[0]).collect();
     let starts = object_starts(pdf, extra.iter().zip(&kids).filter_map(|(t, &kid)| t.as_ref().map(|_| kid)));
@@ -199,6 +207,31 @@ pub fn add_catalog_entries(pdf: &[u8], entries: &str) -> Option<Vec<u8>> {
     Some(out)
 }
 
+#[cfg(test)]
+mod bracket_tests {
+    use super::{add_page_entries, bracketed};
+
+    #[test]
+    fn bracketed_ignores_a_close_before_the_open() {
+        assert_eq!(bracketed(" [3 0 R 4 0 R] "), Some("3 0 R 4 0 R"));
+        assert_eq!(bracketed("] ["), None);
+        assert_eq!(bracketed("] [3 0 R]"), Some("3 0 R"));
+        assert_eq!(bracketed("[]"), Some(""));
+    }
+
+    /// `]` before the `[` of /Kids (a spoofed page tree) is refused, not a slice panic.
+    #[test]
+    fn kids_closed_before_opened_is_refused() {
+        let objects = ["<</Type/Catalog/Pages 2 0 R>>", "<</Type/Pages/Kids ] [3 0 R/Count 1>>"];
+        let mut out = b"%PDF-1.6\n".to_vec();
+        for (i, o) in objects.iter().enumerate() {
+            out.extend_from_slice(format!("{} 0 obj\n{o}\nendobj\n", i + 1).as_bytes());
+        }
+        out.extend_from_slice(b"trailer\n<</Size 3/Root 1 0 R>>\nstartxref\n0\n%%EOF\n");
+        assert!(add_page_entries(&out, &[Some("/Rotate 0".to_string())]).is_none());
+    }
+}
+
 #[cfg(test)]
 mod object_index_tests {
     use super::{MAX_INDEXED_PAGE_OBJECTS, object_starts};
diff --git a/crates/render/src/lib.rs b/crates/render/src/lib.rs
index 6823fc00..5159da0a 100644
--- a/crates/render/src/lib.rs
+++ b/crates/render/src/lib.rs
@@ -875,7 +875,13 @@ impl Renderer {
         let on_screen = (f.view * xf * g.xf).determinant().abs().sqrt();
         let on_screen = if f.opts.quality == DisplayQuality::Typical { on_screen.min(1.0) } else { on_screen };
         let hidden = HIDDEN_LAYERS.with(|h| h.borrow().clone());
-        let data = if !hidden.is_empty() && is_pdf(&asset.data) { pdf_layers::layered(&asset.data, &hidden) } else { asset.data.clone() };
+        let data = if !hidden.is_empty() && is_pdf(&asset.data) {
+            // Stale persisted/relinked choices must not reveal hidden source content.
+            let Some(variant) = pdf_layers::layered(&asset.data, &hidden) else { return };
+            variant
+        } else {
+            asset.data.clone()
+        };
         // A placed PDF cropped to a box: the whole page, placed so that the box spans graphic space.
         let [l, t, r, b] = shown_box(asset).unwrap_or([0.0, 0.0, 1.0, 1.0]);
         let (page_w, page_h) = (g.size.0 / (r - l), g.size.1 / (b - t));
@@ -1392,8 +1398,13 @@ pub fn pdf_crop_box(bytes: &[u8], page: usize, crop: designcraft_doc::PdfCrop) -
         PdfCrop::Crop => WHOLE,
         PdfCrop::ContentVisible => pdf_bounds::page_content_bounds(bytes, page).unwrap_or(WHOLE),
         PdfCrop::ContentAll => {
-            let all_on = pdf_hide_layers(bytes, &[]);
-            pdf_bounds::page_content_bounds(all_on.as_deref().unwrap_or(bytes), page).unwrap_or(WHOLE)
+            if pdf_layers::has_optional_content(&pdf) {
+                // If all-on rewriting is unsupported, a visible-only box could cut
+                // off hidden content. Keep the entire page conservatively instead.
+                pdf_hide_layers(bytes, &[]).and_then(|all_on| pdf_bounds::page_content_bounds(&all_on, page)).unwrap_or(WHOLE)
+            } else {
+                pdf_bounds::page_content_bounds(bytes, page).unwrap_or(WHOLE)
+            }
         }
         PdfCrop::Art | PdfCrop::Trim | PdfCrop::Bleed | PdfCrop::Media => {
             let media = p.media_box();
diff --git a/crates/render/src/pdf_layers.rs b/crates/render/src/pdf_layers.rs
index 3d90d808..47f93c06 100644
--- a/crates/render/src/pdf_layers.rs
+++ b/crates/render/src/pdf_layers.rs
@@ -34,6 +34,16 @@ fn ocgs(pdf: &Pdf) -> Vec<(ObjRef, String, bool)> {
         .collect()
 }
 
+/// Whether interpreting this file can depend on optional-content state. Empty/stub
+/// properties are layerless, but malformed group references with state overrides
+/// still require a conservative all-content crop when rewriting is unavailable.
+pub(crate) fn has_optional_content(pdf: &Pdf) -> bool {
+    let Some(cat) = pdf.xref().get::<Dict<'_>>(pdf.xref().root_id()) else { return false };
+    let Some(ocp) = cat.get::<Dict<'_>>(b"OCProperties") else { return false };
+    let nonempty = |dict: &Dict<'_>, key: &[u8]| dict.get::<Array<'_>>(key).is_some_and(|a| a.raw_iter().next().is_some());
+    nonempty(&ocp, b"OCGs") || ocp.get::<Dict<'_>>(b"D").is_some_and(|cfg| nonempty(&cfg, b"ON") || nonempty(&cfg, b"OFF"))
+}
+
 /// The layers of a placed PDF: (name, visible by default).
 pub fn pdf_layers(bytes: &[u8]) -> Vec<(String, bool)> {
     craft_pdf::open_slice(bytes, None).map(|p| ocgs(&p).into_iter().map(|(_, n, v)| (n, v)).collect()).unwrap_or_default()
@@ -83,19 +93,62 @@ fn patch_dict(dict: &Dict<'_>, updates: &[(&[u8], &[u8])]) -> Option<Vec<u8>> {
 
 fn trailer_at(bytes: &[u8], offset: usize) -> Option<Dict<'_>> {
     use craft_pdf::syntax::reader::{Reader, ReaderExt};
+    const MAX_TABLE_BYTES: usize = 4 * 1024 * 1024;
     let data = bytes.get(offset..)?;
-    let mut reader = Reader::new(data);
-    if data.starts_with(b"xref") {
-        let pos = data.get(..data.len().min(4 * 1024 * 1024))?.windows(7).position(|w| w == b"trailer")?;
-        reader.skip_bytes(pos.checked_add(7)?)?;
+    // Bound even whitespace/comment scanning and context-free dictionary parsing.
+    let mut reader = Reader::new(data.get(..data.len().min(MAX_TABLE_BYTES))?);
+    reader.skip_white_spaces_and_comments();
+    if reader.forward_tag(b"xref").is_some() {
+        // Walk table syntax, never a raw substring: a repairable file may contain
+        // a fake "trailer" in a comment. Such a comment must not hide real guards.
+        let mut ended = false;
+        for _ in 0..100_000 {
+            if reader.offset() > MAX_TABLE_BYTES {
+                return None;
+            }
+            reader.skip_white_spaces();
+            if reader.forward_tag(b"trailer").is_some() {
+                ended = true;
+                break;
+            }
+            reader.read_without_context::<u32>()?; // first object number
+            reader.skip_white_spaces();
+            let count = reader.read_without_context::<usize>()?;
+            if count > MAX_TABLE_BYTES / 18 {
+                return None;
+            }
+            for _ in 0..count {
+                reader.skip_white_spaces();
+                reader.read_without_context::<u32>()?; // offset or next free object
+                reader.skip_white_spaces();
+                if reader.read_without_context::<u32>()? > 65535 {
+                    return None;
+                }
+                reader.skip_white_spaces();
+                reader.forward_tag(b"n").or_else(|| reader.forward_tag(b"f"))?;
+                if reader.offset() > MAX_TABLE_BYTES {
+                    return None;
+                }
+            }
+        }
+        if !ended {
+            return None;
+        }
+        reader.skip_white_spaces();
     } else {
         // An xref stream's dictionary also holds the trailer entries.
         reader.read_without_context::<ObjectIdentifier>()?;
+        reader.skip_white_spaces_and_comments();
     }
-    reader.skip_white_spaces_and_comments();
     reader.read_without_context::<Dict<'_>>()
 }
 
+// Null dictionary entries are absent in PDF. Keep references and malformed values
+// fail-closed: trailer_at's dictionaries have no context for resolving references.
+fn has_non_null_entry(dict: &Dict<'_>, key: &[u8]) -> bool {
+    dict.contains_key(key) && !matches!(dict.get_raw::<Object<'_>>(key), Some(MaybeRef::NotRef(Object::Null(_))))
+}
+
 /// `bytes` with exactly the layers named in `hidden` off (the others on).
 /// Returns `None` for unreadable, encrypted, hybrid-reference or over-budget updates.
 /// Untouched catalog/configuration entries and full object references are preserved.
@@ -119,7 +172,7 @@ pub fn pdf_hide_layers(bytes: &[u8], hidden: &[String]) -> Option<Vec<u8>> {
             return None;
         }
         let t = trailer_at(bytes, at)?;
-        if t.contains_key(b"Encrypt") || t.contains_key(b"XRefStm") {
+        if has_non_null_entry(&t, b"Encrypt") || has_non_null_entry(&t, b"XRefStm") {
             return None;
         }
         offset = t.get::<usize>(b"Prev");
@@ -176,9 +229,9 @@ pub fn pdf_hide_layers(bytes: &[u8], hidden: &[String]) -> Option<Vec<u8>> {
 }
 
 /// Shared copies of layer variants (by source address and hidden set).
-pub(crate) fn layered(data: &Arc<Vec<u8>>, hidden: &[String]) -> Arc<Vec<u8>> {
+pub(crate) fn layered(data: &Arc<Vec<u8>>, hidden: &[String]) -> Option<Arc<Vec<u8>>> {
     type Key = (usize, Vec<String>);
-    static CACHE: Mutex<Option<HashMap<Key, (Arc<Vec<u8>>, Arc<Vec<u8>>)>>> = Mutex::new(None);
+    static CACHE: Mutex<Option<HashMap<Key, (Arc<Vec<u8>>, Option<Arc<Vec<u8>>>)>>> = Mutex::new(None);
     let key = (Arc::as_ptr(data) as usize, hidden.to_vec());
     let mut c = CACHE.lock().unwrap_or_else(|e| e.into_inner());
     let map = c.get_or_insert_with(HashMap::new);
@@ -188,7 +241,7 @@ pub(crate) fn layered(data: &Arc<Vec<u8>>, hidden: &[String]) -> Arc<Vec<u8>> {
     if map.len() > 64 {
         map.clear();
     }
-    let v = pdf_hide_layers(data, hidden).map(Arc::new).unwrap_or_else(|| data.clone());
+    let v = pdf_hide_layers(data, hidden).map(Arc::new);
     map.insert(key, (data.clone(), v.clone()));
     v
 }
@@ -198,6 +251,42 @@ mod tests {
     use super::*;
     use craft_pdf::syntax::reader::{Reader, ReaderExt};
 
+    #[test]
+    fn trailer_lookup_does_not_take_guard_values_from_xref_comments() {
+        for guard in ["/Encrypt 12 0 R", "/XRefStm 123"] {
+            let bytes = format!("xref\n% trailer <</Size 9/Encrypt null>>\n0 1\n0000000000 65535 f\r\ntrailer\n<</Size 9{guard}>>");
+            assert!(trailer_at(bytes.as_bytes(), 0).is_none(), "repair-only table must fail closed: {guard}");
+        }
+    }
+
+    #[test]
+    fn trailer_lookup_accepts_whitespace_and_bounded_table_layouts() {
+        for eol in ["\n", "\r\n"] {
+            let bytes = format!(" \r\nxref{eol}0 1{eol}0000000000 65535 f{eol}7 1{eol}0000000123 00001 n{eol}trailer{eol}<</Size 9/Root 1 0 R>>");
+            assert_eq!(trailer_at(bytes.as_bytes(), 0).unwrap().get::<usize>(b"Size"), Some(9));
+        }
+        assert!(trailer_at(b"xref\n0 1\n0000000000 65535 f\ntrailer% comment\n<< /Size 1 >>", 0).is_none());
+        let mut whitespace = vec![b' '; 4 * 1024 * 1024];
+        whitespace.extend_from_slice(b"xref\n0 0\ntrailer<<>>");
+        assert!(trailer_at(&whitespace, 0).is_none());
+        for bytes in [b"xref\n0 999999999\n".as_slice(), b"xref\n0 1\n0000000000 99999 f\ntrailer<<>>", b"xref\n0 1\n0000000000 65535 x\ntrailer<<>>"]
+        {
+            assert!(trailer_at(bytes, 0).is_none());
+        }
+    }
+
+    #[test]
+    fn null_trailer_entries_are_absent_but_references_stay_unsupported() {
+        for key in ["Encrypt", "XRefStm"] {
+            assert!(!has_non_null_entry(&Dict::empty(), key.as_bytes()));
+            for (value, allowed) in [("null", true), ("12 0 R", false), ("<< /Filter /Standard >>", false), ("false", false)] {
+                let input = format!("<</{key} {value}>>");
+                let dict = Reader::new(input.as_bytes()).read_without_context::<Dict<'_>>().unwrap();
+                assert_eq!(!has_non_null_entry(&dict, key.as_bytes()), allowed, "{key}: {value}");
+            }
+        }
+    }
+
     #[test]
     fn dictionary_patch_preserves_raw_values_and_bounds_updates() {
         let data = b"<</Unknown[(x) 12 1 R <ff>]/Base#53tate/OFF/Name(a(b)c)>>";
diff --git a/crates/render/src/text.rs b/crates/render/src/text.rs
index 70f31b4f..a4fa80ad 100644
--- a/crates/render/src/text.rs
+++ b/crates/render/src/text.rs
@@ -162,7 +162,7 @@ fn build_line(db: &FontDb, cs: &ComposedStory, l: &Line, vertical: bool) -> Line
     let mut strikes: Vec<(String, f32, Rect)> = Vec::new();
     let mut glyphs = 0;
     for g in &l.glyphs {
-        if !g.visible {
+        if !g.spans_rules() {
             continue;
         }
         let style = &cs.styles[g.style as usize];
@@ -185,6 +185,10 @@ fn build_line(db: &FontDb, cs: &ComposedStory, l: &Line, vertical: bool) -> Line
                 }
             }
         }
+        // A tab carries the rule across its width but draws nothing itself.
+        if !g.visible {
+            continue;
+        }
         let outline = db.outline(&g.face, g.gid);
         if outline.elements().is_empty() {
             continue;
@@ -725,3 +729,45 @@ mod cache_identity_tests {
         assert_eq!(glyphs.lines[0].runs, runs);
     }
 }
+
+#[cfg(test)]
+mod rule_tests {
+    use super::*;
+
+    /// A tab is not drawn, but it is a character with an advance, and InDesign underlines it:
+    /// forms rule their fill-in lines with underlined tabs (`Name ⇥⇥⇥⇥, city ⇥⇥⇥⇥`). The bars
+    /// stopped at the last letter before each tab, so an imported form lost every writing line
+    /// (#1466).
+    #[test]
+    fn an_underline_runs_across_a_tab() {
+        let mut doc = designcraft_doc::Document::new(&Default::default());
+        for style in &mut doc.styles_mut().paragraph {
+            style.chars.underline = Some(true);
+        }
+        let layer = doc.default_layer();
+        let (_, sid) = doc
+            .add_text_frame(
+                designcraft_doc::SpreadRef::Doc(0),
+                Rect::new(36.0, 36.0, 400.0, 300.0),
+                layer,
+                "Name\tCity",
+                designcraft_doc::ParaFormat::default(),
+            )
+            .unwrap();
+        let owner = crate::Cache::new();
+        let cs = owner.get(&doc, sid, None);
+        let line = &cs.frames[0].lines[0];
+        let tab = line.glyphs.iter().find(|g| g.rendered_char == '\t').expect("the tab is placed on the line");
+        assert!(!tab.visible, "a tab draws nothing itself");
+        assert!(tab.adv > 1.0, "it advances to its stop: {}", tab.adv);
+
+        let mut cache = GlyphCache::default();
+        cache.tick();
+        let glyphs = cache.get(&cs, &cs.frames[0]);
+        let bars = &glyphs.lines[0].underlines;
+        assert_eq!(bars.len(), 1, "one bar across the line, not one before the tab and one after: {bars:?}");
+        let bar = bars[0].2;
+        assert!(bar.x0 <= tab.x + 0.5, "the bar starts at the text, not at the tab: {bar:?}");
+        assert!(bar.x1 >= tab.x + tab.adv - 0.5, "the bar covers the tab's width: {bar:?}, tab {} + {}", tab.x, tab.adv);
+    }
+}
diff --git a/crates/textimport/src/docx.rs b/crates/textimport/src/docx.rs
index 783b010c..87aaa335 100644
--- a/crates/textimport/src/docx.rs
+++ b/crates/textimport/src/docx.rs
@@ -115,6 +115,12 @@ pub(crate) fn parse(xml: &str) -> Result<El, ImportError> {
                     p.kids.push(Node::Text(s));
                 }
             }
+            Event::CData(t) => {
+                let s = t.decode().map(|s| s.to_string()).unwrap_or_default();
+                if let Some(p) = stack.last_mut() {
+                    p.kids.push(Node::Text(s));
+                }
+            }
             Event::GeneralRef(e) => {
                 let name = String::from_utf8_lossy(&e).to_string();
                 let s = match name.as_str() {
@@ -180,8 +186,9 @@ fn run_attrs(rpr: Option<&El>) -> CharAttrs {
     if let Some(s) = r.on("strike") {
         a.strikethrough = Some(s);
     }
-    if let Some(sz) = r.val("sz").and_then(|v| v.parse::<f64>().ok()).filter(|v| v.is_finite()) {
-        a.size = Some(sz / 2.0);
+    // Half-points; sizes outside the engine's 0.1–1296 pt range (or non-finite) are dropped.
+    if let Some(pt) = r.val("sz").and_then(|v| v.parse::<f64>().ok()).map(|sz| sz / 2.0).filter(|pt| (0.1..=1296.0).contains(pt)) {
+        a.size = Some(pt);
     }
     if let Some(f) = r.child("rFonts").and_then(|f| f.attr("ascii").or(f.attr("hAnsi"))) {
         a.font_family = Some(f.to_string());
@@ -578,6 +585,12 @@ mod tests {
     use super::*;
     use std::io::Write;
 
+    #[test]
+    fn cdata_text() {
+        let el = parse("<a><t><![CDATA[x < y]]></t></a>").unwrap();
+        assert_eq!(el.child("t").unwrap().text(), "x < y");
+    }
+
     /// Issue #712: nesting past the budget is an error from the parser, not a stack overflow later.
     #[test]
     fn nesting_past_the_budget_is_refused() {
@@ -702,6 +715,19 @@ mod tests {
         }
     }
 
+    #[test]
+    fn out_of_range_sizes_are_dropped() {
+        let document = format!(
+            r#"<w:document {W}><w:body>
+              <w:p><w:r><w:rPr><w:sz w:val="0"/></w:rPr><w:t>a</w:t></w:r><w:r><w:rPr><w:sz w:val="99999999"/></w:rPr><w:t>b</w:t></w:r></w:p>
+            </w:body></w:document>"#
+        );
+        let st = import(&docx(&document, "", "")).unwrap().story;
+        for at in [0, 1] {
+            assert_eq!(st.format_after(at).over.size, None, "run {at}");
+        }
+    }
+
     #[test]
     fn tracked_changes_import_as_accepted_including_moves() {
         // Regression (#256): text in a tracked move destination (`w:moveTo`) vanished on import.
diff --git a/crates/textimport/src/lib.rs b/crates/textimport/src/lib.rs
index ba9cb92e..56eac1a0 100644
--- a/crates/textimport/src/lib.rs
+++ b/crates/textimport/src/lib.rs
@@ -114,7 +114,7 @@ pub fn import(name: &str, bytes: &[u8]) -> Result<Imported, ImportError> {
     if l.ends_with(".doc") {
         return Err(ImportError::Unsupported("legacy Word .doc (save it as .docx)".into()));
     }
-    Ok(plain(&String::from_utf8_lossy(bytes)))
+    Ok(plain(&tagged::decode(bytes)))
 }
 
 /// Plain text: line breaks become paragraphs (CRLF / CR normalised).
@@ -136,4 +136,14 @@ mod tests {
         assert!(is_text_file("Report.DOCX") && !is_text_file("a.png"));
         assert!(matches!(import("x.doc", b"\xD0\xCF"), Err(ImportError::Unsupported(_))));
     }
+
+    #[test]
+    fn plain_text_utf16() {
+        let mut le = vec![0xFF, 0xFE];
+        le.extend("Hi there".encode_utf16().flat_map(u16::to_le_bytes));
+        assert_eq!(import("a.txt", &le).unwrap().story.text, "Hi there");
+        let mut be = vec![0xFE, 0xFF];
+        be.extend("Hi there".encode_utf16().flat_map(u16::to_be_bytes));
+        assert_eq!(import("a.txt", &be).unwrap().story.text, "Hi there");
+    }
 }
diff --git a/crates/textimport/src/rtf.rs b/crates/textimport/src/rtf.rs
index baf065c3..78207179 100644
--- a/crates/textimport/src/rtf.rs
+++ b/crates/textimport/src/rtf.rs
@@ -95,6 +95,8 @@ pub fn import(bytes: &[u8]) -> Result<Imported, ImportError> {
                     stack.push(top);
                 }
                 first = false;
+                // A group is not a character: the `\uN` fallback skip ends here too.
+                pending = 0;
                 // `{\*\dest …}`: an ignorable destination.
                 if chars.get(i + 1) == Some(&'\\')
                     && chars.get(i + 2) == Some(&'*')
@@ -134,6 +136,11 @@ pub fn import(bytes: &[u8]) -> Result<Imported, ImportError> {
                 }
                 if !next.is_ascii_alphabetic() {
                     // Control symbols: \\ \{ \} \~ (nbsp) \- (soft hyphen) \_ (nb hyphen).
+                    i += 2;
+                    if pending > 0 {
+                        pending -= 1;
+                        continue;
+                    }
                     let skip = stack.last().is_some_and(|s| s.skip);
                     if !skip {
                         match next {
@@ -149,7 +156,6 @@ pub fn import(bytes: &[u8]) -> Result<Imported, ImportError> {
                             _ => {}
                         }
                     }
-                    i += 2;
                     continue;
                 }
                 // A control word with an optional numeric parameter and one delimiting space.
@@ -172,6 +178,11 @@ pub fn import(bytes: &[u8]) -> Result<Imported, ImportError> {
                     k += 1;
                 }
                 i = k;
+                // A control word is one character of the `\uN` fallback (a following `\u` is not).
+                if pending > 0 && word != "u" {
+                    pending -= 1;
+                    continue;
+                }
                 let skip = stack.last().is_some_and(|s| s.skip);
                 if SKIP.contains(&word.as_str()) {
                     flush(&mut st, &mut buf, &fmt);
@@ -234,9 +245,12 @@ pub fn import(bytes: &[u8]) -> Result<Imported, ImportError> {
                     }
                     "u" => {
                         if let Some(n) = param {
-                            let unit = if n < 0 { (n + 65536) as u32 } else { n as u32 };
-                            if let Some(ch) = units.push(unit) {
-                                buf.push(ch);
+                            // RTF allows -32768..=65535; anything else is dropped.
+                            if (-32768..=65535).contains(&n) {
+                                let unit = if n < 0 { (n + 65536) as u32 } else { n as u32 };
+                                if let Some(ch) = units.push(unit) {
+                                    buf.push(ch);
+                                }
                             }
                             pending = stack.last().map_or(1, |s| s.uc);
                         }
@@ -282,6 +296,12 @@ fn cp1252(b: u8) -> char {
 mod tests {
     use super::*;
 
+    #[test]
+    fn out_of_range_unicode_escape_is_dropped() {
+        assert_eq!(import(br"{\rtf1 a\u4294967361?b}").unwrap().story.text, "ab");
+        assert_eq!(import(br"{\rtf1 a\u-4294967231?b}").unwrap().story.text, "ab");
+    }
+
     #[test]
     fn imports_rtf_text_and_formatting() {
         let rtf = br"{\rtf1\ansi{\fonttbl{\f0 Times;}}{\colortbl;\red0\green0\blue0;}{\*\generator Test;}
@@ -320,6 +340,18 @@ Caf\'e9 \u8364? price\tab tab\line next\par
         assert_eq!(i.story.text, "Rock\u{2014}-roll, x\t-y, ab");
     }
 
+    /// A control word or control symbol is one character of the `\uN` fallback, so it is skipped
+    /// like a plain character and does not eat the text after it.
+    #[test]
+    fn control_fallback_after_unicode_is_skipped() {
+        let i = import(br"{\rtf1 \u8220\ldblquote Hi\u8221\rdblquote  x\u8212\emdash y}").unwrap();
+        assert_eq!(i.story.text, "\u{201C}Hi\u{201D} x\u{2014}y");
+        let i = import(br"{\rtf1 \u8220\{Hi}").unwrap();
+        assert_eq!(i.story.text, "\u{201C}Hi");
+        let i = import(br"{\rtf1 \u8220{\b Hi}}").unwrap();
+        assert_eq!(i.story.text, "\u{201C}Hi");
+    }
+
     /// Characters past U+FFFF are written as two `\uN` words, a UTF-16 surrogate pair (the form
     /// our own exporter and Word write). Each half was converted alone and dropped.
     #[test]
diff --git a/crates/textimport/src/tagged.rs b/crates/textimport/src/tagged.rs
index 9bc84b76..3a890734 100644
--- a/crates/textimport/src/tagged.rs
+++ b/crates/textimport/src/tagged.rs
@@ -25,6 +25,37 @@ fn escape(out: &mut String, c: char) {
     }
 }
 
+/// A tag value with '<', '>' and '\\' escaped by a backslash, so it keeps the tag intact.
+fn escape_value(v: &str) -> String {
+    let mut out = String::with_capacity(v.len());
+    for c in v.chars() {
+        if matches!(c, '<' | '>' | '\\') {
+            out.push('\\');
+        }
+        out.push(c);
+    }
+    out
+}
+
+/// A tag value with the escapes `escape_value` writes (`\\`, `\<`, `\>`) decoded. Any other
+/// backslash, including a trailing one, stays literal, as older files and InDesign's `\:` expect.
+fn unescape_value(v: &str) -> String {
+    let mut out = String::with_capacity(v.len());
+    let mut it = v.chars().peekable();
+    while let Some(c) = it.next() {
+        if c == '\\'
+            && let Some(&n) = it.peek()
+            && matches!(n, '\\' | '<' | '>')
+        {
+            out.push(n);
+            it.next();
+        } else {
+            out.push(c);
+        }
+    }
+    out
+}
+
 /// `story` as Tagged Text.
 pub fn tagged_text(doc: &Document, story: &Story) -> String {
     let mut out = String::from("<ASCII-WIN>\r\n<Version:7>\r\n");
@@ -34,7 +65,7 @@ pub fn tagged_text(doc: &Document, story: &Story) -> String {
             out.push_str("\r\n");
         }
         let pf = story.paras.get(i).cloned().unwrap_or_default();
-        let _ = write!(out, "<ParaStyle:{}>", pf.style.replace(['<', '>', ':'], ""));
+        let _ = write!(out, "<ParaStyle:{}>", escape_value(&pf.style));
         for (rr, f) in story.runs() {
             let (a, b) = (rr.start.max(r.start), rr.end.min(r.end));
             if a >= b {
@@ -45,7 +76,7 @@ pub fn tagged_text(doc: &Document, story: &Story) -> String {
             }
             let mut open = Vec::new();
             if f.style != NO_CHAR_STYLE {
-                let _ = write!(out, "<CharStyle:{}>", f.style.replace(['<', '>', ':'], ""));
+                let _ = write!(out, "<CharStyle:{}>", escape_value(&f.style));
                 open.push("CharStyle");
             }
             if let Some(v) = &f.over.font_family {
@@ -72,7 +103,7 @@ pub fn tagged_text(doc: &Document, story: &Story) -> String {
 }
 
 /// Text of a Tagged Text file (ASCII, UTF-8 or UTF-16 by byte-order mark).
-fn decode(bytes: &[u8]) -> String {
+pub(crate) fn decode(bytes: &[u8]) -> String {
     if bytes.starts_with(&[0xFF, 0xFE]) || bytes.starts_with(&[0xFE, 0xFF]) {
         let le = bytes[0] == 0xFF;
         let units: Vec<u16> = bytes[2..]
@@ -153,7 +184,7 @@ pub fn import(bytes: &[u8]) -> Result<Imported, ImportError> {
                     }
                     "ParaStyle" => {
                         started = true;
-                        let v = value.trim().to_string();
+                        let v = unescape_value(value.trim());
                         if !v.is_empty() && !para_styles.contains(&v) {
                             para_styles.push(v.clone());
                         }
@@ -162,10 +193,10 @@ pub fn import(bytes: &[u8]) -> Result<Imported, ImportError> {
                         }
                     }
                     "CharStyle" => {
-                        let v = value.trim();
-                        fmt.style = if v.is_empty() { NO_CHAR_STYLE.into() } else { v.to_string() };
-                        if !v.is_empty() && !char_styles.contains(&v.to_string()) {
-                            char_styles.push(v.to_string());
+                        let v = unescape_value(value.trim());
+                        fmt.style = if v.is_empty() { NO_CHAR_STYLE.into() } else { v.clone() };
+                        if !v.is_empty() && !char_styles.contains(&v) {
+                            char_styles.push(v);
                         }
                     }
                     "cFont" => fmt.over.font_family = (!value.is_empty()).then(|| value.to_string()),
@@ -268,6 +299,34 @@ mod tests {
         assert_eq!(back.story.paras, story.paras);
     }
 
+    /// Style names with ':', '<', '>' or '\' were written with those characters dropped, so
+    /// re-import gave the paragraphs a different style.
+    #[test]
+    fn style_names_with_tag_characters_round_trip() {
+        let doc = Document::new(&designcraft_doc::build::NewDocument::default());
+        for name in ["Body: Indent", "A<b>c", "x\\y", "end\\"] {
+            let mut story = Story::new(StoryId(0));
+            story.insert_with(0, "Text", CharFormat { style: name.into(), ..Default::default() });
+            story.paras[0].style = name.into();
+            let out = tagged_text(&doc, &story);
+            let back = import(out.as_bytes()).unwrap();
+            assert_eq!(back.story.text, "Text", "{out}");
+            assert_eq!(back.story.paras[0].style, name, "{out}");
+            assert_eq!(back.story.char_format_at(1).style, name, "{out}");
+            assert_eq!(back.para_styles.iter().map(|s| s.name.as_str()).collect::<Vec<_>>(), [name]);
+            assert_eq!(back.char_styles.iter().map(|s| s.name.as_str()).collect::<Vec<_>>(), [name]);
+        }
+    }
+
+    /// A backslash that isn't one of our escapes (older files, InDesign's `\:`) stays literal.
+    #[test]
+    fn unknown_backslashes_in_style_names_stay_literal() {
+        assert_eq!(unescape_value(r"x\y"), r"x\y");
+        assert_eq!(unescape_value(r"a\:b"), r"a\:b");
+        assert_eq!(unescape_value("end\\"), "end\\");
+        assert_eq!(unescape_value(r"\<a\>\\"), r"<a>\");
+    }
+
     #[test]
     fn tagged_text_round_trips() {
         let src = "<ASCII-WIN>\r\n<Version:7>\r\n<ParaStyle:Head>Caf<0x00E9> \\<1\\>\r\n<ParaStyle:Body>A <CharStyle:Em>word<CharStyle:> and <cSize:18.000000>big<cSize:> text";
diff --git a/crates/tools/src/select.rs b/crates/tools/src/select.rs
index 86600310..c437484c 100644
--- a/crates/tools/src/select.rs
+++ b/crates/tools/src/select.rs
@@ -1,6 +1,7 @@
 //! Selection tool (V) and Direct Selection tool (A).
 //!
-//! Click selects the frontmost item (Shift toggles), drag moves (Alt duplicates, Shift constrains),
+//! Click selects the frontmost item (Shift toggles; a click on one of several selected items makes
+//! it the key object for Align, a second click drops it), drag moves (Alt duplicates, Shift constrains),
 //! the 8 bounding-box handles resize (Shift keeps proportions, Alt from centre, Cmd scales content),
 //! empty-canvas drags make a marquee (it selects the ruler guides it crosses when it touches no
 //! object), double-clicking a text frame switches to the Type tool and
@@ -223,6 +224,9 @@ pub struct SelectionTool {
     guides: Vec<Overlay>,
     /// Selected item to toggle if this Shift press never becomes a drag.
     shift_release: Option<u64>,
+    /// One of several selected items to make (or stop being) the key object for Align if this
+    /// press never becomes a drag.
+    key_release: Option<u64>,
     /// The loaded text cursor.
     loaded: Option<Loaded>,
     /// Frame whose live corners are being edited (diamonds shown).
@@ -231,7 +235,7 @@ pub struct SelectionTool {
 
 impl SelectionTool {
     pub fn new(direct: bool) -> Self {
-        Self { direct, drag: Drag::None, hover_handle: None, guides: vec![], shift_release: None, loaded: None, live: None }
+        Self { direct, drag: Drag::None, hover_handle: None, guides: vec![], shift_release: None, key_release: None, loaded: None, live: None }
     }
 
     /// [`bracket_at`] for this tool. With Direct Selection an anchor under the pointer wins: the
@@ -735,6 +739,7 @@ impl Tool for SelectionTool {
             }
             PointerKind::Down => {
                 self.shift_release = None;
+                self.key_release = None;
                 // Type on a path: a bracket moves where the text starts or ends.
                 if !ev.mods.shift
                     && let Some((id, end)) = self.bracket_at(cx, p)
@@ -825,6 +830,10 @@ impl Tool for SelectionTool {
                             }
                         } else if !cx.selection.contains(id) || (self.direct && !cx.selection.content) {
                             out.push(Action::Exec("selection.set".into(), json!({"ids": [id.0], "content": self.direct})));
+                        } else if !self.direct && cx.selection.items.len() > 1 {
+                            // InDesign: a click on one of several selected objects makes it the
+                            // key object, on release so that a drag still moves them all.
+                            self.key_release = Some(id.0);
                         }
                         let content = self.direct || on_selected_content(cx, p);
                         self.drag = Drag::Pending { start: p, hit: true, content };
@@ -852,6 +861,7 @@ impl Tool for SelectionTool {
                         return vec![];
                     }
                     self.shift_release = None;
+                    self.key_release = None;
                     if hit && !cx.selection.items.is_empty() {
                         // Direct Selection on items without content moves (or duplicates) them whole.
                         let content = content && cx.selection.items.iter().any(|i| cx.doc.item(*i).is_some_and(holds_content));
@@ -1124,6 +1134,7 @@ impl Tool for SelectionTool {
             PointerKind::Up => {
                 self.guides.clear();
                 let release = self.shift_release.take();
+                let key = self.key_release.take();
                 let d = std::mem::replace(&mut self.drag, Drag::None);
                 match d {
                     Drag::Move { .. }
@@ -1135,9 +1146,10 @@ impl Tool for SelectionTool {
                     | Drag::Bracket { .. } => {
                         vec![Action::Commit]
                     }
-                    Drag::Pending { .. } => match release {
-                        Some(id) => vec![Action::Exec("selection.toggle".into(), json!({"id": id}))],
-                        None => vec![],
+                    Drag::Pending { .. } => match (release, key) {
+                        (Some(id), _) => vec![Action::Exec("selection.toggle".into(), json!({"id": id}))],
+                        (None, Some(id)) => vec![Action::Exec("selection.key".into(), json!({"id": id}))],
+                        (None, None) => vec![],
                     },
                     Drag::Marquee { start, cur } => {
                         let r = Rect::from_points(start, cur);
diff --git a/crates/ui-egui/src/about.rs b/crates/ui-egui/src/about.rs
index 14745607..75442b93 100644
--- a/crates/ui-egui/src/about.rs
+++ b/crates/ui-egui/src/about.rs
@@ -77,16 +77,24 @@ pub fn paint_chat_icon(p: &egui::Painter, c: egui::Pos2, s: f32, color: Color32)
     p.circle_filled(body.center() + vec2(s * 0.18, 0.0), eye, bg);
 }
 
-/// The big "Join our Discord" button. Returns true when clicked.
+/// The Discord button's size for `label`: `min`, widened when the label would not fit inside it.
+pub fn discord_button_size(ctx: &egui::Context, label: &str, min: egui::Vec2) -> egui::Vec2 {
+    let galley = crate::rtl::plain(ctx, label, semibold((min.y * 0.42).max(11.0)), Color32::WHITE);
+    egui::vec2(min.x.max(min.y * 0.5 + 8.0 + galley.size().x + min.y), min.y)
+}
+
+/// The big "Join our Discord" button. Returns true when clicked. `size` is the minimum: a longer label
+/// widens the button (see `discord_button_size`) rather than spilling out of it.
 pub fn discord_button(ui: &mut egui::Ui, label: &str, size: egui::Vec2) -> bool {
-    let (r, resp) = ui.allocate_exact_size(size, Sense::click());
-    let resp = resp.on_hover_text(links::DISCORD).on_hover_cursor(egui::CursorIcon::PointingHand);
-    let fill = if resp.hovered() { Color32::from_rgb(0x47, 0x52, 0xc4) } else { DISCORD };
-    ui.painter().rect_filled(r, size.y / 2.0, fill);
+    let size = discord_button_size(ui.ctx(), label, size);
     let icon = size.y * 0.5;
     let font = semibold((size.y * 0.42).max(11.0));
     let galley = crate::rtl::plain(ui.ctx(), label, font, Color32::WHITE);
     let total = icon + 8.0 + galley.size().x;
+    let (r, resp) = ui.allocate_exact_size(size, Sense::click());
+    let resp = resp.on_hover_text(links::DISCORD).on_hover_cursor(egui::CursorIcon::PointingHand);
+    let fill = if resp.hovered() { Color32::from_rgb(0x47, 0x52, 0xc4) } else { DISCORD };
+    ui.painter().rect_filled(r, size.y / 2.0, fill);
     let x0 = r.center().x - total / 2.0;
     paint_chat_icon(ui.painter(), pos2(x0 + icon / 2.0, r.center().y), icon, Color32::WHITE);
     ui.painter().galley(pos2(x0 + icon + 8.0, r.center().y - galley.size().y / 2.0), galley, Color32::WHITE);
diff --git a/crates/ui-egui/src/canvas.rs b/crates/ui-egui/src/canvas.rs
index 318f8238..2118c492 100644
--- a/crates/ui-egui/src/canvas.rs
+++ b/crates/ui-egui/src/canvas.rs
@@ -1251,6 +1251,9 @@ fn draw_selection(app: &DesignApp, painter: &egui::Painter, xf: &Xf, doc: &Docum
         if sel.items.len() == 1 && sel.text.is_none() {
             // InDesign draws a 1 pt bounding box around the selection.
             painter.rect_stroke(xf.rect(a.transform_rect_bbox(it.bounds())), 0.0, Stroke::new(1.0, color), StrokeKind::Middle);
+        } else if sel.key == Some(*id) {
+            // The key object for Align: a thicker bounding box, as in InDesign.
+            painter.rect_stroke(xf.rect(a.transform_rect_bbox(it.bounds())), 0.0, Stroke::new(3.0, color), StrokeKind::Middle);
         }
         let b = xf.rect(a.transform_rect_bbox(it.bounds()));
         union = Some(union.map_or(b, |u| u.union(b)));
@@ -5317,7 +5320,7 @@ mod tests {
         let (pen, direct, text) = (shown("pen"), shown("directSelection"), shown("type"));
         let ppp = h.ctx.pixels_per_point();
         let images = &mut h.state_mut().cursors;
-        match crate::cursors::MODE {
+        match crate::cursors::mode() {
             crate::cursors::Mode::Os => {
                 assert_eq!(pen.1, images.get(Cursor::Pen, ppp), "Pen");
                 assert_eq!(direct.1, images.get(Cursor::ArrowHollow, ppp), "Direct Selection");
diff --git a/crates/ui-egui/src/chrome.rs b/crates/ui-egui/src/chrome.rs
index e853e679..b0fed579 100644
--- a/crates/ui-egui/src/chrome.rs
+++ b/crates/ui-egui/src/chrome.rs
@@ -852,85 +852,97 @@ pub fn start_screen(app: &mut DesignApp, ui: &mut egui::Ui) {
             egui::Align::Min
         })),
         |ui| {
-            ui.label(crate::rtl::widget(
-                ui,
-                egui::RichText::new(crate::i18n::tr(&app.ui.language, "Welcome to DesignCraft")).font(semibold(28.0)).color(t.text_strong),
-            ));
-            ui.label(crate::rtl::widget(
-                ui,
-                egui::RichText::new(crate::i18n::tr(&app.ui.language, "Page layout for print and screen — fast, open and scriptable."))
-                    .size(15.0)
-                    .color(t.text_dim),
-            ));
-            ui.add_space(24.0);
-            ui.horizontal(|ui| {
-                if ui
-                    .add(
-                        egui::Button::new(crate::rtl::widget(
-                            ui,
-                            egui::RichText::new(crate::i18n::tr(&app.ui.language, "  New file  ")).size(14.0).color(Color32::WHITE),
-                        ))
-                        .fill(t.accent_strong)
-                        .corner_radius(16.0)
-                        .min_size(vec2(0.0, 32.0)),
-                    )
-                    .clicked()
-                {
-                    let _ = app.run("app.newDocumentDialog", json!({}));
-                }
-                if ui
-                    .add(
-                        egui::Button::new(crate::rtl::widget(ui, egui::RichText::new(crate::i18n::tr(&app.ui.language, "  Open  ")).size(14.0)))
+            egui::ScrollArea::vertical().auto_shrink([false, false]).show(ui, |ui| {
+                ui.label(crate::rtl::widget(
+                    ui,
+                    egui::RichText::new(crate::i18n::tr(&app.ui.language, "Welcome to DesignCraft")).font(semibold(28.0)).color(t.text_strong),
+                ));
+                ui.label(crate::rtl::widget(
+                    ui,
+                    egui::RichText::new(crate::i18n::tr(&app.ui.language, "Page layout for print and screen — fast, open and scriptable."))
+                        .size(15.0)
+                        .color(t.text_dim),
+                ));
+                ui.add_space(24.0);
+                ui.horizontal(|ui| {
+                    if ui
+                        .add(
+                            egui::Button::new(crate::rtl::widget(
+                                ui,
+                                egui::RichText::new(crate::i18n::tr(&app.ui.language, "  New file  ")).size(14.0).color(Color32::WHITE),
+                            ))
+                            .fill(t.accent_strong)
                             .corner_radius(16.0)
                             .min_size(vec2(0.0, 32.0)),
-                    )
-                    .clicked()
-                {
-                    let _ = app.run("app.openDialog", json!({}));
-                }
-                if ui
-                    .add(
-                        egui::Button::new(crate::rtl::widget(
-                            ui,
-                            egui::RichText::new(crate::i18n::tr(&app.ui.language, "  Open sample magazine  ")).size(14.0),
-                        ))
-                        .corner_radius(16.0)
-                        .min_size(vec2(0.0, 32.0)),
-                    )
-                    .clicked()
-                {
-                    let _ = app.run("file.newSample", json!({}));
-                }
-            });
-            ui.add_space(20.0);
-            community_card(app, ui);
-            recent_files(app, ui);
-            ui.add_space(24.0);
-            ui.label(crate::rtl::widget(
-                ui,
-                egui::RichText::new(crate::i18n::tr(&app.ui.language, "Start a new document")).font(semibold(15.0)).color(t.text_strong),
-            ));
-            ui.add_space(8.0);
-            ui.horizontal_wrapped(|ui| {
-                for p in designcraft_doc::build::PRESETS.iter().filter(|p| p.intent == designcraft_doc::Intent::Print) {
-                    let (cr, resp) = ui.allocate_exact_size(vec2(120.0, 150.0), Sense::click());
-                    let hov = resp.hovered();
-                    ui.painter().rect_filled(cr, 6.0, if hov { t.hover } else { t.panel });
-                    let k = (80.0 / p.width.max(p.height)) as f32;
-                    let pr = egui::Rect::from_center_size(cr.center() - vec2(0.0, 14.0), vec2(p.width as f32 * k, p.height as f32 * k));
-                    ui.painter().rect_filled(pr, 0.0, Color32::from_gray(245));
-                    ui.painter().text(egui::pos2(cr.center().x, cr.max.y - 26.0), egui::Align2::CENTER_CENTER, p.name, semibold(12.0), t.text_strong);
-                    ui.painter().text(
-                        egui::pos2(cr.center().x, cr.max.y - 11.0),
-                        egui::Align2::CENTER_CENTER,
-                        format!("{} × {}", designcraft_geom::format_measure(p.width, p.units), designcraft_geom::format_measure(p.height, p.units)),
-                        egui::FontId::proportional(10.0),
-                        t.text_dim,
-                    );
-                    if resp.clicked() {
-                        let _ = app.run("file.new", json!({"preset": p.name}));
+                        )
+                        .clicked()
+                    {
+                        let _ = app.run("app.newDocumentDialog", json!({}));
                     }
-                }
+                    if ui
+                        .add(
+                            egui::Button::new(crate::rtl::widget(ui, egui::RichText::new(crate::i18n::tr(&app.ui.language, "  Open  ")).size(14.0)))
+                                .corner_radius(16.0)
+                                .min_size(vec2(0.0, 32.0)),
+                        )
+                        .clicked()
+                    {
+                        let _ = app.run("app.openDialog", json!({}));
+                    }
+                    if ui
+                        .add(
+                            egui::Button::new(crate::rtl::widget(
+                                ui,
+                                egui::RichText::new(crate::i18n::tr(&app.ui.language, "  Open sample magazine  ")).size(14.0),
+                            ))
+                            .corner_radius(16.0)
+                            .min_size(vec2(0.0, 32.0)),
+                        )
+                        .clicked()
+                    {
+                        let _ = app.run("file.newSample", json!({}));
+                    }
+                });
+                ui.add_space(20.0);
+                community_card(app, ui);
+                recent_files(app, ui);
+                ui.add_space(24.0);
+                ui.label(crate::rtl::widget(
+                    ui,
+                    egui::RichText::new(crate::i18n::tr(&app.ui.language, "Start a new document")).font(semibold(15.0)).color(t.text_strong),
+                ));
+                ui.add_space(8.0);
+                ui.horizontal_wrapped(|ui| {
+                    for p in designcraft_doc::build::PRESETS.iter().filter(|p| p.intent == designcraft_doc::Intent::Print) {
+                        let (cr, resp) = ui.allocate_exact_size(vec2(120.0, 150.0), Sense::click());
+                        let hov = resp.hovered();
+                        ui.painter().rect_filled(cr, 6.0, if hov { t.hover } else { t.panel });
+                        let k = (80.0 / p.width.max(p.height)) as f32;
+                        let pr = egui::Rect::from_center_size(cr.center() - vec2(0.0, 14.0), vec2(p.width as f32 * k, p.height as f32 * k));
+                        ui.painter().rect_filled(pr, 0.0, Color32::from_gray(245));
+                        ui.painter().text(
+                            egui::pos2(cr.center().x, cr.max.y - 26.0),
+                            egui::Align2::CENTER_CENTER,
+                            p.name,
+                            semibold(12.0),
+                            t.text_strong,
+                        );
+                        ui.painter().text(
+                            egui::pos2(cr.center().x, cr.max.y - 11.0),
+                            egui::Align2::CENTER_CENTER,
+                            format!(
+                                "{} × {}",
+                                designcraft_geom::format_measure(p.width, p.units),
+                                designcraft_geom::format_measure(p.height, p.units)
+                            ),
+                            egui::FontId::proportional(10.0),
+                            t.text_dim,
+                        );
+                        if resp.clicked() {
+                            let _ = app.run("file.new", json!({"preset": p.name}));
+                        }
+                    }
+                });
             });
         },
     );
@@ -1060,7 +1072,9 @@ fn community_card(app: &mut DesignApp, ui: &mut egui::Ui) {
             let (r, _) = ui.allocate_exact_size(vec2(44.0, 44.0), Sense::hover());
             crate::about::paint_mark(ui, r, crate::about::BRAND);
             ui.add_space(8.0);
-            let text_width = (ui.available_width() - BUTTON.x - 16.0).max(120.0);
+            let label = crate::i18n::tr(&app.ui.language, "Join our Discord");
+            let button = crate::about::discord_button_size(ui.ctx(), label, BUTTON);
+            let text_width = (ui.available_width() - button.x - 16.0).max(120.0);
             ui.vertical(|ui| {
                 ui.set_max_width(text_width);
                 ui.style_mut().wrap_mode = Some(egui::TextWrapMode::Wrap);
@@ -1090,7 +1104,7 @@ fn community_card(app: &mut DesignApp, ui: &mut egui::Ui) {
                 });
             });
             ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
-                if crate::about::discord_button(ui, crate::i18n::tr(&app.ui.language, "Join our Discord"), BUTTON) {
+                if crate::about::discord_button(ui, label, BUTTON) {
                     let _ = app.run("help.discord", json!({}));
                 }
             });
diff --git a/crates/ui-egui/src/cursors.rs b/crates/ui-egui/src/cursors.rs
index 566fe65f..28f98a5e 100644
--- a/crates/ui-egui/src/cursors.rs
+++ b/crates/ui-egui/src/cursors.rs
@@ -3,10 +3,10 @@
 //! what a click does (add, delete, close, convert, continue), and a curved double arrow for rotating.
 //! Cursors without a glyph stay system cursors.
 //!
-//! Linux and Windows show the glyphs as OS cursors ([`Images`]): the system moves them itself, so
-//! they never trail the pointer. macOS sizes a cursor bitmap in points (a Retina one would show
-//! twice as big, or blurred), so there the canvas paints the glyph at the pointer. The
-//! web build keeps the system cursors.
+//! Linux (X11) and Windows show the glyphs as OS cursors ([`Images`]): the system moves them itself,
+//! so they never trail the pointer. macOS sizes a cursor bitmap in points (a Retina one would show
+//! twice as big, or blurred) and a Wayland session (native or through XWayland) scales it by its own
+//! rules, so there the canvas paints the glyph at the pointer. The web build keeps the system cursors.
 
 use egui::epaint::{Mesh, TessellationOptions, Tessellator, Vertex};
 use egui::{Color32, CustomCursorImage, Pos2, Shape, Stroke, Vec2, pos2, vec2};
@@ -27,13 +27,32 @@ pub enum Mode {
     System,
 }
 
-pub const MODE: Mode = if cfg!(target_arch = "wasm32") {
-    Mode::System
-} else if cfg!(target_os = "macos") {
-    Mode::Painted
-} else {
-    Mode::Os
-};
+/// The mode for a platform: `wayland` is true on a Linux Wayland session.
+fn mode_for(wasm: bool, macos: bool, wayland: bool) -> Mode {
+    if wasm {
+        Mode::System
+    } else if macos || wayland {
+        Mode::Painted
+    } else {
+        Mode::Os
+    }
+}
+
+/// Whether the environment describes a Wayland session: a Wayland display, unless the session says X11.
+fn is_wayland(wayland_display: Option<&str>, session_type: Option<&str>) -> bool {
+    wayland_display.is_some_and(|d| !d.is_empty()) && !session_type.is_some_and(|t| t.eq_ignore_ascii_case("x11"))
+}
+
+/// How cursor glyphs are shown on this system. On Wayland the compositor sizes a cursor bitmap by
+/// its own scale, so the OS glyph came out far too big; there the canvas paints it, as on macOS.
+pub fn mode() -> Mode {
+    static MODE: std::sync::OnceLock<Mode> = std::sync::OnceLock::new();
+    *MODE.get_or_init(|| {
+        let wayland = cfg!(target_os = "linux")
+            && is_wayland(std::env::var("WAYLAND_DISPLAY").ok().as_deref(), std::env::var("XDG_SESSION_TYPE").ok().as_deref());
+        mode_for(cfg!(target_arch = "wasm32"), cfg!(target_os = "macos"), wayland)
+    })
+}
 
 /// The shapes of one glyph: every halo goes under all the ink, so one part's halo never cuts
 /// through another part's ink.
@@ -289,9 +308,9 @@ pub fn system(c: Cursor) -> egui::CursorIcon {
 }
 
 /// Show cursor `c` with the pointer at `hover` (screen points): set the OS cursor bitmap or paint
-/// the glyph per [`MODE`], and return the cursor icon to set.
+/// the glyph per [`mode`], and return the cursor icon to set.
 pub fn show(ctx: &egui::Context, images: &mut Images, c: Cursor, hover: Pos2) -> egui::CursorIcon {
-    match MODE {
+    match mode() {
         Mode::Os => {
             // The glyphs keep the system cursors' size whatever the interface scale.
             let ppp = ctx.pixels_per_point() / ctx.zoom_factor().max(0.01);
@@ -359,6 +378,19 @@ mod tests {
         assert!(rasterize(Cursor::Pen, f32::NAN).is_none() && rasterize(Cursor::Pen, 0.0).is_none());
     }
 
+    #[test]
+    fn wayland_paints_the_glyphs_and_x11_keeps_os_cursors() {
+        assert_eq!(mode_for(false, false, true), Mode::Painted);
+        assert_eq!(mode_for(false, false, false), Mode::Os);
+        assert_eq!(mode_for(false, true, false), Mode::Painted);
+        assert_eq!(mode_for(true, false, true), Mode::System);
+        assert!(is_wayland(Some("wayland-0"), Some("wayland")));
+        assert!(is_wayland(Some("wayland-0"), None));
+        assert!(!is_wayland(Some("wayland-0"), Some("x11")));
+        assert!(!is_wayland(Some(""), Some("wayland")));
+        assert!(!is_wayland(None, Some("wayland")));
+    }
+
     #[test]
     fn the_selection_arrows_differ_in_fill() {
         // A pixel inside the arrow's body, below the tip: ink for Selection, halo for Direct.
diff --git a/crates/ui-egui/src/dialogs.rs b/crates/ui-egui/src/dialogs.rs
index 40787954..b412a06f 100644
--- a/crates/ui-egui/src/dialogs.rs
+++ b/crates/ui-egui/src/dialogs.rs
@@ -1991,8 +1991,8 @@ fn preferences(app: &crate::DesignApp, ui: &mut egui::Ui, d: &mut Dialog, max_he
                     egui::ComboBox::from_id_salt("pref_language").width(180.0).height(400.0).selected_text(crate::rtl::widget(ui, current)).show_ui(
                         ui,
                         |ui| {
-                            for (code, name) in crate::i18n::LANGUAGES {
-                                if ui.selectable_label(*code == app.ui.language, crate::rtl::widget(ui, *name)).clicked() {
+                            for (code, name) in crate::i18n::picker_languages() {
+                                if ui.selectable_label(code == app.ui.language, crate::rtl::widget(ui, name)).clicked() {
                                     // Applied by `show` right after this frame, which has `&mut DesignApp`.
                                     d.fields.insert("applyLanguage".into(), json!(code));
                                 }
@@ -2456,6 +2456,9 @@ pub fn show(app: &mut DesignApp, ctx: &egui::Context) {
                         {
                             match app.session.execute("color.loadProfile", &json!({"path": path})) {
                                 Ok(_) => {
+                                    // Replayed in load order at start-up, so the latest load of a path comes last.
+                                    app.ui.color_profiles.retain(|p| p != &path);
+                                    app.ui.color_profiles.push(path);
                                     let f = app.session.execute("color.settings", &json!({})).unwrap_or_default();
                                     d.fields.insert("profiles".into(), f["profiles"].clone());
                                 }
@@ -2836,6 +2839,7 @@ pub fn show(app: &mut DesignApp, ctx: &egui::Context) {
         ui.horizontal(|ui| {
             if matches!(d.id.as_str(), "paragraphStyleOptions" | "characterStyleOptions") && !d.b("new") {
                 check(ui, &mut d, "preview", crate::i18n::tr(&app.ui.language, "Preview"));
+                app.ui.style_preview = d.b("preview");
                 style_options_preview(app, &mut d);
             }
             ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
@@ -3275,13 +3279,29 @@ pub fn confirm(app: &mut DesignApp) -> Result<Value, String> {
         }
         "pdfImport" => {
             let crop = d.s("crop");
+            // One page number, 1 or more; a blank field is page 1. A range or list ("4-5", "2,5"), a
+            // fraction or a negative is refused rather than placing some other page.
+            let raw = if d.fields.get("page").is_none_or(Value::is_null) { String::new() } else { d.s("page") };
+            let page = match raw.trim() {
+                "" => 1,
+                t => match t.parse::<u64>() {
+                    Ok(n) if n >= 1 => n,
+                    _ => {
+                        let e = "Enter a single page number; one page is placed at a time".to_string();
+                        let mut d = d;
+                        d.fields.insert("status".into(), json!(e));
+                        app.ui.dialog = Some(d);
+                        return Err(e);
+                    }
+                },
+            };
             if d.b("async") {
-                return app.confirm_pdf_import(d.n("page").unwrap_or(1.0).max(1.0) as u64, if crop.is_empty() { "crop".into() } else { crop });
+                return app.confirm_pdf_import(page, if crop.is_empty() { "crop".into() } else { crop });
             }
             if let Some(target) = d.fields.get("target").and_then(Value::as_u64) {
                 app.activate_import_target(&crate::ImportRequest { purpose: "place".into(), target: Some(target) })?;
             }
-            app.place_file(json!({"path": d.s("path"), "pdfPage": d.n("page").unwrap_or(1.0).max(1.0) as u64, "pdfCrop": if crop.is_empty() { "crop".to_string() } else { crop }}))
+            app.place_file(json!({"path": d.s("path"), "pdfPage": page, "pdfCrop": if crop.is_empty() { "crop".to_string() } else { crop }}))
         }
         "print" => {
             let pages = if d.s("range") == "all" { Value::Null } else { json!(d.s("pages")) };
@@ -3337,7 +3357,7 @@ pub fn confirm(app: &mut DesignApp) -> Result<Value, String> {
                 params["title"] = json!(title);
             }
             let name = if title.is_empty() { "Export.pdf".to_string() } else { format!("{title}.pdf") };
-            match app.services.pick_save.as_mut().and_then(|f| f(&name)) {
+            match app.pick_save(&name) {
                 Some(path) => {
                     params["path"] = json!(path);
                     crate::menus::export_pdf(app, &params)
@@ -5154,7 +5174,7 @@ pub fn open_style_options(app: &mut DesignApp, para: bool, name: &str) {
         return;
     }
     let id = if para { "paragraphStyleOptions" } else { "characterStyleOptions" };
-    app.ui.dialog = Some(Dialog::new(id, json!({"name": name})));
+    app.ui.dialog = Some(Dialog::new(id, json!({"name": name, "preview": app.ui.style_preview})));
 }
 
 /// New Paragraph Style… / New Character Style…: the style options for a style made on OK, named
@@ -7770,6 +7790,33 @@ mod tests {
         assert!(dialog.fields["status"].as_str().unwrap().contains("page size out of range"));
     }
 
+    #[test]
+    fn style_options_preview_choice_is_remembered_on_reopen() {
+        use egui_kittest::{Harness, kittest::Queryable};
+        let mut app = DesignApp::new(designcraft_engine::Session::new(), crate::Services::default());
+        app.run("file.new", json!({})).unwrap();
+        app.run("style.paragraph.create", json!({"name":"Tutorial","chars":{"size":10}})).unwrap();
+        open_style_options(&mut app, true, "Tutorial");
+        let mut h = Harness::builder().with_size(egui::vec2(1000.0, 800.0)).build_ui_state(
+            |ui, app: &mut DesignApp| {
+                let key = egui::Id::new("style_preview_remember_fonts");
+                if ui.data(|d| d.get_temp::<bool>(key)).is_none() {
+                    crate::theme::install_fonts(ui.ctx(), "");
+                    ui.data_mut(|d| d.insert_temp(key, true));
+                    return;
+                }
+                show(app, ui.ctx());
+            },
+            app,
+        );
+        h.run_steps(3);
+        h.get_by_label("Preview").click();
+        h.run_steps(3);
+        cancel(h.state_mut());
+        open_style_options(h.state_mut(), true, "Tutorial");
+        assert!(h.state().ui.dialog.as_ref().unwrap().b("preview"), "Preview stays checked on reopen");
+    }
+
     #[test]
     fn style_options_preview_updates_all_uses_cancels_and_commits_once() {
         use egui_kittest::{Harness, kittest::Queryable};
@@ -9102,7 +9149,11 @@ mod tests {
             for _ in 0..3 {
                 dialog_frame(&mut app, &ctx, screen, vec![]);
             }
-            let height = visible_label(&dialog_frame(&mut app, &ctx, screen, vec![]), screen, "66p1");
+            // With craft-fonts' Noto Sans Arabic the rows above are taller, so at the smallest size the
+            // Height field starts partly below the body's clip: scroll to it like the other fields.
+            let labels = dialog_frame(&mut app, &ctx, screen, vec![]);
+            let (_, _, body) = labels.iter().find(|(text, _, _)| text.trim() == "66p1").expect("66p1 is painted");
+            let height = scroll_to_label(&mut app, &ctx, screen, body.center(), "66p1");
             click_dialog(&mut app, &ctx, screen, height.center());
             dialog_frame(
                 &mut app,
diff --git a/crates/ui-egui/src/i18n.rs b/crates/ui-egui/src/i18n.rs
index 6057abc9..be5f43c9 100644
--- a/crates/ui-egui/src/i18n.rs
+++ b/crates/ui-egui/src/i18n.rs
@@ -34,6 +34,16 @@ pub const LANGUAGES: &[(&str, &str)] = &[
     ("ka", "ქართული"),
 ];
 
+/// The interface languages in the order the Preferences picker lists them: English first (the
+/// source language), then the rest by their own name with accents folded, so Čeština sits under
+/// C. Names in other scripts follow the Latin ones in code point order: Cyrillic, Arabic,
+/// Georgian, then the CJK languages.
+pub fn picker_languages() -> Vec<(&'static str, &'static str)> {
+    let mut rest: Vec<(&str, &str)> = LANGUAGES.iter().copied().filter(|(code, _)| !code.is_empty()).collect();
+    rest.sort_by_cached_key(|(_, name)| name_sort_key(name));
+    std::iter::once(LANGUAGES[0]).chain(rest).collect()
+}
+
 /// English → [German, French, Spanish, Japanese, Simplified Chinese].
 const TABLE: &[(&str, [&str; 5])] = &[
     // Menus.
@@ -4449,6 +4459,12 @@ fn column(lang: &str) -> Option<usize> {
 
 /// `s` in `lang` (English, or the string itself, when there's no translation).
 pub fn tr<'a>(lang: &str, s: &'a str) -> &'a str {
+    let text = lookup(lang, s);
+    // An empty row is a translation nobody has written yet.
+    if text.trim().is_empty() { s } else { text }
+}
+
+fn lookup<'a>(lang: &str, s: &'a str) -> &'a str {
     static GERMAN: OnceLock<HashMap<&'static str, &'static str>> = OnceLock::new();
     static JAPANESE: OnceLock<HashMap<&'static str, &'static str>> = OnceLock::new();
     static TRANSLATIONS: OnceLock<HashMap<&'static str, [&'static str; 5]>> = OnceLock::new();
@@ -4467,18 +4483,18 @@ pub fn tr<'a>(lang: &str, s: &'a str) -> &'a str {
     // The German and Japanese tables cover the whole interface; the shared table's German and Japanese
     // columns are the fallback for keys added there after them.
     if lang == "de"
-        && let Some(text) = GERMAN.get_or_init(|| de::TABLE.iter().copied().collect()).get(s).copied()
+        && let Some(text) = GERMAN.get_or_init(|| de::TABLE.iter().copied().collect()).get(s).copied().filter(|text| !text.trim().is_empty())
     {
         return text;
     }
     if lang == "ja"
-        && let Some(text) = JAPANESE.get_or_init(|| ja::TABLE.iter().copied().collect()).get(s).copied()
+        && let Some(text) = JAPANESE.get_or_init(|| ja::TABLE.iter().copied().collect()).get(s).copied().filter(|text| !text.trim().is_empty())
     {
         return text;
     }
     // `fr::TABLE` holds the strings the shared table has no row for.
     if lang == "fr"
-        && let Some(text) = FRENCH.get_or_init(|| fr::TABLE.iter().copied().collect()).get(s).copied()
+        && let Some(text) = FRENCH.get_or_init(|| fr::TABLE.iter().copied().collect()).get(s).copied().filter(|text| !text.trim().is_empty())
     {
         return text;
     }
@@ -4524,11 +4540,13 @@ pub fn tr_context<'a>(lang: &str, s: &'a str, context: &str) -> &'a str {
         "ar" => ar::CONTEXT,
         _ => &[],
     };
-    if let Some((_, _, text)) = contexts.iter().find(|(key, scope, _)| *key == s && *scope == context) {
+    let written = |text: &&str| !text.trim().is_empty();
+    if let Some(text) = contexts.iter().find(|(key, scope, _)| *key == s && *scope == context).map(|(_, _, text)| *text).filter(written) {
         return text;
     }
     if let Some(c) = column(lang)
-        && let Some(text) = CONTEXT.iter().find(|(key, scope, _)| *key == s && *scope == context).and_then(|(_, _, row)| row.get(c))
+        && let Some(text) =
+            CONTEXT.iter().find(|(key, scope, _)| *key == s && *scope == context).and_then(|(_, _, row)| row.get(c)).copied().filter(written)
     {
         return text;
     }
@@ -4567,7 +4585,9 @@ pub fn count_label(lang: &str, noun: &str, count: usize) -> String {
             2..=4 => few,
             _ => other,
         };
-        return format!("{count} {form}");
+        if !form.trim().is_empty() {
+            return format!("{count} {form}");
+        }
     }
     format!("{count} {}", tr(lang, noun))
 }
@@ -4625,15 +4645,9 @@ mod tests {
     /// The German and Japanese tables translate the whole interface and win over the shared columns.
     const WHOLE_INTERFACE: [&str; 2] = ["de", "ja"];
 
-    #[test]
-    fn every_interface_language_has_a_catalog() {
-        for (lang, i) in SHARED_COLUMNS.iter().zip(0..) {
-            assert_eq!(column(lang), Some(i), "{lang}");
-        }
-        for (code, name) in LANGUAGES.iter().filter(|(code, _)| !code.is_empty()) {
-            assert!(!name.is_empty(), "{code}");
-            assert!(LANGUAGE_TABLES.iter().any(|(lang, _)| lang == code) || column(code).is_some(), "{code} has no catalog in LANGUAGE_TABLES");
-        }
+    /// What `tr` shows for a row: an empty one is still untranslated.
+    fn or_english<'a>(text: &'a str, english: &'a str) -> &'a str {
+        if text.trim().is_empty() { english } else { text }
     }
 
     #[test]
@@ -4644,13 +4658,16 @@ mod tests {
         for (key, translations) in TABLE {
             for (lang, shared) in SHARED_COLUMNS.into_iter().zip(translations) {
                 // A language's own table is looked up before the shared column.
-                assert_eq!(tr(lang, key), own(lang, key).unwrap_or(*shared), "{lang}: {key}");
+                let expected = own(lang, key).filter(|text| !text.trim().is_empty()).unwrap_or(*shared);
+                assert_eq!(tr(lang, key), or_english(expected, key), "{lang}: {key}");
             }
             assert_eq!(tr("", key), *key);
         }
         for (lang, table) in LANGUAGE_TABLES {
             for (key, expected) in *table {
-                assert_eq!(tr(lang, key), *expected, "{lang}: {key}");
+                if !expected.trim().is_empty() {
+                    assert_eq!(tr(lang, key), *expected, "{lang}: {key}");
+                }
                 assert_eq!(tr("", key), *key);
             }
         }
@@ -4667,7 +4684,9 @@ mod tests {
     fn context_captions_come_from_their_context_or_the_plain_translation() {
         for (lang, table) in CONTEXT_TABLES {
             for (key, scope, text) in *table {
-                assert_eq!(tr_context(lang, key, scope), *text, "{lang}: {key} ({scope})");
+                if !text.trim().is_empty() {
+                    assert_eq!(tr_context(lang, key, scope), *text, "{lang}: {key} ({scope})");
+                }
             }
         }
         for (key, scope, row) in CONTEXT {
@@ -4678,8 +4697,10 @@ mod tests {
                     .filter(|(code, _)| *code == lang)
                     .flat_map(|(_, table)| table.iter())
                     .find(|(k, s, _)| k == key && s == scope)
-                    .map(|(_, _, text)| *text);
-                assert_eq!(tr_context(lang, key, scope), own.unwrap_or(*shared), "{lang}: {key} ({scope})");
+                    .map(|(_, _, text)| *text)
+                    .filter(|text| !text.trim().is_empty());
+                let expected = own.or(Some(*shared).filter(|text| !text.trim().is_empty())).unwrap_or_else(|| tr(lang, key));
+                assert_eq!(tr_context(lang, key, scope), expected, "{lang}: {key} ({scope})");
             }
         }
         // An unknown context, or a language without one, keeps the plain translation.
@@ -4692,33 +4713,37 @@ mod tests {
         }
     }
 
-    /// Every catalog: no duplicate or stale keys, no empty translations, and placeholders, padding,
-    /// ellipses and label colons as in English. A string a catalog doesn't translate yet falls back
-    /// to English, so missing translations don't fail here.
-    #[test]
-    fn every_catalog_is_unique_current_and_keeps_placeholders_and_markers() {
-        // (language, key, translation) of every catalog, and every catalog's keys by name.
-        let mut entries: Vec<(&str, &str, &str)> = Vec::new();
-        let mut catalogs: Vec<(&str, HashSet<&str>)> = Vec::new();
-        for (lang, table) in LANGUAGE_TABLES {
-            let keys: HashSet<_> = table.iter().map(|(key, _)| *key).collect();
-            assert_eq!(keys.len(), table.len(), "{lang}: duplicate keys");
-            catalogs.push((*lang, keys));
-            entries.extend(table.iter().map(|(key, text)| (*lang, *key, *text)));
-        }
-        let shared: HashSet<_> = TABLE.iter().map(|(key, _)| *key).collect();
-        assert_eq!(shared.len(), TABLE.len(), "duplicate keys in the shared table");
-        catalogs.push(("shared", shared.clone()));
+    /// The tables `tr` reads, as (language, key, translation), context captions included.
+    fn entries() -> Vec<(&'static str, &'static str, &'static str)> {
+        let mut entries: Vec<_> = LANGUAGE_TABLES.iter().flat_map(|(lang, table)| table.iter().map(|(key, text)| (*lang, *key, *text))).collect();
         for (lang, i) in SHARED_COLUMNS.into_iter().zip(0..) {
             entries.extend(TABLE.iter().filter_map(|(key, row)| row.get(i).map(|text| (lang, *key, *text))));
             entries.extend(CONTEXT.iter().filter_map(|(key, _, row)| row.get(i).map(|text| (lang, *key, *text))));
         }
-        let mut contexts = vec![("shared", CONTEXT.iter().map(|(key, scope, _)| (*key, *scope)).collect::<Vec<_>>())];
-        for (lang, table) in CONTEXT_TABLES {
-            contexts.push((*lang, table.iter().map(|(key, scope, _)| (*key, *scope)).collect()));
-            entries.extend(table.iter().map(|(key, _, text)| (*lang, *key, *text)));
-        }
+        entries.extend(CONTEXT_TABLES.iter().flat_map(|(lang, table)| table.iter().map(|(key, _, text)| (*lang, *key, *text))));
+        entries
+    }
 
+    /// Every catalog has one row per key and keeps the English placeholders. A string a catalog
+    /// doesn't translate shows in English, so a missing or empty row fails nothing here; the
+    /// `missing_translations_report` lists them.
+    #[test]
+    fn every_catalog_has_unique_keys_and_keeps_placeholders() {
+        for (lang, i) in SHARED_COLUMNS.iter().zip(0..) {
+            assert_eq!(column(lang), Some(i), "{lang}");
+        }
+        for (lang, table) in LANGUAGE_TABLES {
+            let keys: HashSet<_> = table.iter().map(|(key, _)| *key).collect();
+            assert_eq!(keys.len(), table.len(), "{lang}: duplicate keys");
+        }
+        let shared: HashSet<_> = TABLE.iter().map(|(key, _)| *key).collect();
+        assert_eq!(shared.len(), TABLE.len(), "duplicate keys in the shared table");
+        let shared_contexts: HashSet<_> = CONTEXT.iter().map(|(key, scope, _)| (*key, *scope)).collect();
+        assert_eq!(shared_contexts.len(), CONTEXT.len(), "duplicate keys in the shared context table");
+        for (lang, table) in CONTEXT_TABLES {
+            let keys: HashSet<_> = table.iter().map(|(key, scope, _)| (*key, *scope)).collect();
+            assert_eq!(keys.len(), table.len(), "{lang}: duplicate context keys");
+        }
         // A per-language table is looked up before the shared table, so a key in both hides the
         // shared column, except in the tables that translate the whole interface.
         for (lang, table) in LANGUAGE_TABLES.iter().filter(|(lang, _)| column(lang).is_some() && !WHOLE_INTERFACE.contains(lang)) {
@@ -4726,41 +4751,58 @@ mod tests {
             assert!(both.is_empty(), "{lang} keys also in the shared table: {both:?}");
         }
 
-        // A key is current while the interface or another catalog has it.
-        let interface = interface_strings();
-        let current = |key: &str, own: &str| interface.contains(key) || catalogs.iter().any(|(name, keys)| *name != own && keys.contains(key));
-        for (name, keys) in &catalogs {
-            let mut stale: Vec<_> = keys.iter().filter(|key| !current(key, name)).collect();
-            stale.sort();
-            assert!(stale.is_empty(), "{name}: entries for unknown keys: {stale:?}");
-        }
-        for (name, keys) in &contexts {
-            let unique: HashSet<_> = keys.iter().collect();
-            assert_eq!(unique.len(), keys.len(), "{name}: duplicate context keys");
-            let stale: Vec<_> = keys.iter().filter(|(key, _)| !current(key, "")).collect();
-            assert!(stale.is_empty(), "{name}: contexts for unknown keys: {stale:?}");
-        }
-
         let placeholders = |s: &'static str| {
             let mut names: Vec<_> = s.split('{').skip(1).filter_map(|part| part.split_once('}').map(|(name, _)| name)).collect();
             names.sort_unstable();
             names
         };
-        let ellipsis = |s: &str| s.ends_with('…') || s.ends_with("...");
-        let colon = |s: &str| s.ends_with(':') || s.ends_with('：');
-        // Full-width punctuation carries its own spacing.
-        let full_width = |c: char| ('\u{3000}'..='\u{303F}').contains(&c) || ('\u{FF00}'..='\u{FFEF}').contains(&c);
-        for (lang, key, text) in entries {
-            assert!(!text.trim().is_empty(), "{lang}: empty translation of {key:?}");
+        for (lang, key, text) in entries().into_iter().filter(|(_, _, text)| !text.trim().is_empty()) {
             assert_eq!(placeholders(key), placeholders(text), "{lang}: placeholders of {key:?}");
-            // Dialog ellipses, label colons and padded captions stay as in English.
-            assert_eq!(ellipsis(key), ellipsis(text), "{lang}: ellipsis of {key:?}");
-            assert_eq!(colon(key), colon(text), "{lang}: colon of {key:?}");
-            if !text.starts_with(full_width) {
-                assert_eq!(key.starts_with(' '), text.starts_with(' '), "{lang}: leading space of {key:?}");
-            }
-            if !text.ends_with(full_width) {
-                assert_eq!(key.ends_with(' '), text.ends_with(' '), "{lang}: trailing space of {key:?}");
+        }
+    }
+
+    /// The strings each interface language shows in English, for the `cargo xtask ci` log. It
+    /// always passes: `cargo xtask i18n-report` runs it.
+    #[test]
+    #[ignore = "a report, run by `cargo xtask i18n-report`"]
+    fn missing_translations_report() {
+        let interface = interface_strings();
+        let catalogs: Vec<(&str, HashSet<&str>)> = LANGUAGE_TABLES
+            .iter()
+            .map(|(lang, table)| (*lang, table.iter().map(|(key, _)| *key).collect()))
+            .chain([("shared", TABLE.iter().map(|(key, _)| *key).collect())])
+            .collect();
+        let mut keys: Vec<&str> = interface.iter().copied().chain(catalogs.iter().flat_map(|(_, keys)| keys.iter().copied())).collect();
+        keys.sort_unstable();
+        keys.dedup();
+        // `tr` hands back the string it was given when it has no translation.
+        let missing = |lang: &str| -> Vec<&str> {
+            keys.iter()
+                .copied()
+                .filter(|key| {
+                    let english = (*key).to_owned();
+                    std::ptr::eq(tr(lang, &english), english.as_str())
+                })
+                .collect()
+        };
+        let report: Vec<(&str, Vec<&str>)> = LANGUAGES.iter().filter(|(code, _)| !code.is_empty()).map(|(code, _)| (*code, missing(code))).collect();
+        println!("i18n report: {} interface strings; a missing translation shows in English.", keys.len());
+        for (lang, missing) in &report {
+            println!("  {lang:<6} {:>5} missing", missing.len());
+        }
+        for (lang, missing) in report.iter().filter(|(_, missing)| !missing.is_empty()) {
+            println!("{lang} ({}): {}", missing.len(), missing.iter().map(|key| format!("{key:?}")).collect::<Vec<_>>().join(", "));
+        }
+        // A catalog key neither the interface list nor another catalog knows is stale, or a label
+        // `interface_strings` doesn't list yet.
+        for (name, own) in &catalogs {
+            let mut unknown: Vec<_> = own
+                .iter()
+                .filter(|key| !interface.contains(*key) && !catalogs.iter().any(|(other, keys)| other != name && keys.contains(*key)))
+                .collect();
+            unknown.sort_unstable();
+            if !unknown.is_empty() {
+                println!("{name}: {} rows for keys the interface list doesn't have: {unknown:?}", unknown.len());
             }
         }
     }
@@ -4788,47 +4830,21 @@ mod tests {
         }
     }
 
+    /// Languages with several plural forms put the category first, so every number reads the same.
     #[test]
-    fn georgian_counts_use_category_captions_for_every_number() {
-        for n in [1, 2, 5, 21] {
-            assert_eq!(count_label("ka", "pages", n), format!("გვერდი: {n}"));
-        }
-    }
-
-    #[test]
-    fn ukrainian_counts_use_category_captions_for_every_number() {
-        for n in [0, 1, 2, 4, 5, 11, 21, 22, 25] {
-            assert_eq!(count_label("uk", "pages", n), format!("сторінок: {n}"));
-            assert_eq!(count_label("uk", "objects", n), format!("об’єктів: {n}"));
-            assert_eq!(count_label("uk", "errors", n), format!("помилок: {n}"));
-            let pages = tr("uk", "{pages} Pages in {spreads} Spreads").replace("{pages}", &n.to_string()).replace("{spreads}", &n.to_string());
-            assert_eq!(pages, format!("Сторінок: {n}; розворотів: {n}"));
+    fn category_first_counts_put_the_category_before_every_number() {
+        assert!(!category_first("de") && !category_first(""));
+        for lang in ["ka", "uk", "ru", "pl"] {
+            assert!(category_first(lang), "{lang}");
+            for noun in ["pages", "objects", "errors"] {
+                for n in [0, 1, 2, 4, 5, 11, 12, 21, 22, 25, 101, 111] {
+                    assert_eq!(count_label(lang, noun, n), format!("{}: {n}", tr(lang, noun)), "{lang}: {noun}");
+                }
+            }
         }
         assert_eq!(count_label("", "objects", 2), "2 objects");
     }
 
-    #[test]
-    fn russian_counts_use_category_captions_for_every_number() {
-        assert!(category_first("ru") && category_first("uk") && !category_first("de") && !category_first(""));
-        for n in [0, 1, 2, 4, 5, 11, 12, 21, 22, 25, 101, 111] {
-            assert_eq!(count_label("ru", "pages", n), format!("страниц: {n}"));
-            assert_eq!(count_label("ru", "objects", n), format!("объектов: {n}"));
-            assert_eq!(count_label("ru", "errors", n), format!("ошибок: {n}"));
-            let pages = tr("ru", "{pages} Pages in {spreads} Spreads").replace("{pages}", &n.to_string()).replace("{spreads}", &n.to_string());
-            assert_eq!(pages, format!("Страниц: {n}; разворотов: {n}"));
-        }
-    }
-
-    #[test]
-    fn polish_counts_use_category_captions_for_every_number() {
-        for n in [0, 1, 2, 5, 12, 22, 25] {
-            assert_eq!(count_label("pl", "pages", n), format!("Strony: {n}"));
-            assert_eq!(count_label("pl", "objects", n), format!("Obiekty: {n}"));
-            assert_eq!(count_label("pl", "errors", n), format!("Błędy: {n}"));
-        }
-        assert_eq!(tr("pl", "{pages} Pages in {spreads} Spreads"), "Strony: {pages}, rozkładówki: {spreads}");
-    }
-
     /// Every English string the interface passes to `tr`, as far as the command and tool tables and
     /// the list of UI-only labels know them.
     fn interface_strings() -> HashSet<&'static str> {
@@ -4929,26 +4945,52 @@ mod tests {
 
     #[test]
     fn czech_counts_use_the_plural_form_for_the_number() {
-        for (n, form) in [(0, "chyb"), (1, "chyba"), (2, "chyby"), (4, "chyby"), (5, "chyb"), (11, "chyb"), (22, "chyb")] {
-            assert_eq!(count_label("cs", "errors", n), format!("{n} {form}"));
+        for (noun, [one, few, other]) in cs::PLURALS {
+            for (n, form) in [(0, other), (1, one), (2, few), (4, few), (5, other), (11, other), (22, other)] {
+                let expected = if form.trim().is_empty() { format!("{n} {}", tr("cs", noun)) } else { format!("{n} {form}") };
+                assert_eq!(count_label("cs", noun, n), expected, "{noun}");
+            }
         }
-        // The status bar passes the singular noun for one error.
-        assert_eq!(count_label("cs", "error", 1), "1 chyba");
-        assert_eq!(count_label("cs", "pages", 1), "1 stránka");
-        assert_eq!(count_label("cs", "pages", 3), "3 stránky");
-        assert_eq!(count_label("cs", "pages", 5), "5 stránek");
-        assert_eq!(count_label("cs", "stories", 2), "2 články");
-        assert_eq!(count_label("cs", "items", 1), "1 položka");
-        assert_eq!(count_label("cs", "objects", 7), "7 objektů");
-        assert_eq!(count_label("cs", "warnings", 3), "3 varování");
-        assert_eq!(count_label("cs", "layer", 1), "1 vrstva");
-        assert_eq!(count_label("cs", "layers", 3), "3 vrstvy");
-        assert_eq!(count_label("cs", "layers", 8), "8 vrstev");
         // A noun without plural forms keeps the plain translation.
         assert_eq!(count_label("cs", "a new noun", 3), "3 a new noun");
-        for (noun, forms) in cs::PLURALS {
-            assert!(forms.iter().all(|form| !form.is_empty()), "{noun}");
-            assert!(forms.contains(&tr("cs", noun)), "{noun}: the catalog row is one of the plural forms");
-        }
+    }
+}
+
+/// `name` lowercased with the Latin accents that occur in language names folded away, so a
+/// byte-wise sort reads alphabetically. Other scripts are left as they are.
+fn name_sort_key(name: &str) -> String {
+    name.chars()
+        .flat_map(char::to_lowercase)
+        .map(|c| match c {
+            'à'..='å' | 'ā' | 'ă' | 'ą' => 'a',
+            'ç' | 'ć' | 'č' => 'c',
+            'è'..='ë' | 'ē' | 'ě' | 'ę' | 'ế' | 'ệ' => 'e',
+            'ì'..='ï' | 'ī' => 'i',
+            'ñ' | 'ń' | 'ň' => 'n',
+            'ò'..='ö' | 'ø' | 'ő' => 'o',
+            'ś' | 'š' => 's',
+            'ù'..='ü' | 'ū' | 'ů' | 'ű' => 'u',
+            'ý' | 'ÿ' => 'y',
+            'ź' | 'ż' | 'ž' => 'z',
+            c => c,
+        })
+        .collect()
+}
+
+#[cfg(test)]
+mod picker_order_tests {
+    use super::*;
+
+    #[test]
+    fn picker_lists_english_first_then_names_alphabetically() {
+        let order = picker_languages();
+        assert_eq!(order.first(), Some(&("", "English")));
+        assert_eq!(order.len(), LANGUAGES.len());
+        let keys: Vec<String> = order[1..].iter().map(|(_, name)| name_sort_key(name)).collect();
+        assert!(keys.windows(2).all(|w| w[0] <= w[1]), "{keys:?}");
+        let pos = |code: &str| order.iter().position(|(c, _)| *c == code).unwrap_or(usize::MAX);
+        assert!(pos("cs") < pos("de"), "Čeština sorts under C");
+        assert!(pos("pl") < pos("ru"), "Latin names come before Cyrillic");
+        assert!(pos("ru") < pos("ja"), "Cyrillic names come before CJK");
     }
 }
diff --git a/crates/ui-egui/src/i18n/de.rs b/crates/ui-egui/src/i18n/de.rs
index 4f4177cb..367ca52f 100644
--- a/crates/ui-egui/src/i18n/de.rs
+++ b/crates/ui-egui/src/i18n/de.rs
@@ -2075,55 +2075,3 @@ pub(super) const TABLE: &[(&str, &str)] = &[
     ("Update Data Source", "Datenquelle aktualisieren"),
     ("Validate from Root Element", "Ab Stammelement prüfen"),
 ];
-
-#[cfg(test)]
-mod tests {
-    use std::collections::HashSet;
-
-    use super::TABLE;
-    use crate::i18n::tr;
-
-    fn placeholders(text: &str) -> Vec<&str> {
-        let mut found = Vec::new();
-        let mut rest = text;
-        while let Some(start) = rest.find('{') {
-            let Some(len) = rest[start..].find('}') else { break };
-            found.push(&rest[start..start + len + 1]);
-            rest = &rest[start + len + 1..];
-        }
-        found.sort_unstable();
-        found
-    }
-
-    #[test]
-    fn rows_are_unique_and_complete() {
-        let mut seen = HashSet::new();
-        for (en, de) in TABLE {
-            assert!(seen.insert(*en), "duplicate {en}");
-            assert!(!de.is_empty(), "{en}");
-        }
-    }
-
-    #[test]
-    fn rows_keep_placeholders_padding_and_endings() {
-        let ellipsis = |text: &str| text.trim_end().ends_with('…') || text.trim_end().ends_with("...");
-        for (en, de) in TABLE {
-            assert_eq!(placeholders(en), placeholders(de), "placeholders of {en}");
-            assert_eq!(en.len() - en.trim_start().len(), de.len() - de.trim_start().len(), "leading space of {en}");
-            assert_eq!(en.len() - en.trim_end().len(), de.len() - de.trim_end().len(), "trailing space of {en}");
-            assert_eq!(ellipsis(en), ellipsis(de), "ellipsis of {en}");
-            // The numbering samples (`a, b, c, d...`) stay as they are; everything else uses `…`.
-            assert!(!de.contains("...") || de == en, "ASCII ellipsis in {en}");
-            assert_eq!(en.trim_end().ends_with(':'), de.trim_end().ends_with(':'), "colon of {en}");
-        }
-    }
-
-    #[test]
-    fn lookup_uses_this_table_and_leaves_unknown_text_alone() {
-        assert_eq!(tr("de", "File"), "Datei");
-        assert_eq!(tr("de", "Cancel"), "Abbrechen");
-        assert_eq!(tr("de", "{count} glyphs — click to insert at the text cursor").matches("{count}").count(), 1);
-        let unknown = String::from("A user-defined untranslated label");
-        assert!(std::ptr::eq(tr("de", &unknown), unknown.as_str()));
-    }
-}
diff --git a/crates/ui-egui/src/i18n/ja.rs b/crates/ui-egui/src/i18n/ja.rs
index e23ef15c..37b14ac5 100644
--- a/crates/ui-egui/src/i18n/ja.rs
+++ b/crates/ui-egui/src/i18n/ja.rs
@@ -2124,55 +2124,3 @@ pub(super) const TABLE: &[(&str, &str)] = &[
 
 /// Captions whose Japanese depends on where they appear: (English, context, Japanese).
 pub(super) const CONTEXT: &[(&str, &str, &str)] = &[("Span Columns", "paragraphLayout", "段抜き"), ("Columns:", "grid", "列:")];
-
-#[cfg(test)]
-mod tests {
-    use std::collections::HashSet;
-
-    use super::TABLE;
-    use crate::i18n::tr;
-
-    fn placeholders(text: &str) -> Vec<&str> {
-        let mut found = Vec::new();
-        let mut rest = text;
-        while let Some(start) = rest.find('{') {
-            let Some(len) = rest[start..].find('}') else { break };
-            found.push(&rest[start..start + len + 1]);
-            rest = &rest[start + len + 1..];
-        }
-        found.sort_unstable();
-        found
-    }
-
-    #[test]
-    fn rows_are_unique_and_complete() {
-        let mut seen = HashSet::new();
-        for (en, ja) in TABLE {
-            assert!(seen.insert(*en), "duplicate {en}");
-            assert!(!ja.is_empty(), "{en}");
-        }
-    }
-
-    #[test]
-    fn rows_keep_placeholders_padding_and_endings() {
-        let ellipsis = |text: &str| text.trim_end().ends_with('…') || text.trim_end().ends_with("...");
-        for (en, ja) in TABLE {
-            assert_eq!(placeholders(en), placeholders(ja), "placeholders of {en}");
-            assert_eq!(en.len() - en.trim_start().len(), ja.len() - ja.trim_start().len(), "leading space of {en}");
-            assert_eq!(en.len() - en.trim_end().len(), ja.len() - ja.trim_end().len(), "trailing space of {en}");
-            assert_eq!(ellipsis(en), ellipsis(ja), "ellipsis of {en}");
-            // The numbering samples (`a, b, c, d...`) stay as they are; everything else uses `…`.
-            assert!(!ja.contains("...") || ja == en, "ASCII ellipsis in {en}");
-            assert_eq!(en.trim_end().ends_with(':'), ja.trim_end().ends_with(':'), "colon of {en}");
-        }
-    }
-
-    #[test]
-    fn lookup_uses_this_table_and_leaves_unknown_text_alone() {
-        assert_eq!(tr("ja", "File"), "ファイル");
-        assert_eq!(tr("ja", "Cancel"), "キャンセル");
-        assert_eq!(tr("ja", "{count} glyphs — click to insert at the text cursor").matches("{count}").count(), 1);
-        let unknown = String::from("A user-defined untranslated label");
-        assert!(std::ptr::eq(tr("ja", &unknown), unknown.as_str()));
-    }
-}
diff --git a/crates/ui-egui/src/lib.rs b/crates/ui-egui/src/lib.rs
index 535c8762..b149cea6 100644
--- a/crates/ui-egui/src/lib.rs
+++ b/crates/ui-egui/src/lib.rs
@@ -71,7 +71,8 @@ pub type Inbox = std::sync::Arc<std::sync::Mutex<Vec<ImportedFile>>>;
 pub struct Services {
     /// Open-file dialog for a purpose (`open`, `place`) → path.
     pub pick_open: Option<PickFn>,
-    /// Save dialog with a suggested name → path.
+    /// Save dialog with a suggested name → path. The name may start with the folder the dialog
+    /// opens in (see [`DesignApp::pick_save`]).
     pub pick_save: Option<PickFn>,
     pub read: Option<ReadFn>,
     pub write: Option<WriteFn>,
@@ -223,6 +224,9 @@ pub struct UiState {
     pub pages_panel: panels::pages::PanelOptions,
     /// Edit › Color Settings (re-applied at start).
     pub color_settings: Option<designcraft_color::cms::ColorSettings>,
+    /// ICC files loaded with Edit › Color Settings › Load Profile… (loaded again at start, before
+    /// `color_settings`, so a loaded working space stays chosen).
+    pub color_profiles: Vec<String>,
     /// View › Proof Colors and View › Proof Setup.
     pub proof_colors: bool,
     pub proof_setup: designcraft_color::cms::ProofSetup,
@@ -236,6 +240,8 @@ pub struct UiState {
     pub flattener: String,
     /// File › Export PDF… options (persisted; see `PdfExportSettings`).
     pub pdf_export: PdfExportSettings,
+    /// The Preview checkbox of Paragraph/Character Style Options, remembered between openings.
+    pub style_preview: bool,
     /// View › Separations Preview: a process plate (0–3) and/or an ink limit (total, 0–4).
     #[serde(skip)]
     pub separation: Option<u8>,
@@ -285,6 +291,10 @@ pub struct UiState {
     pub custom_workspaces: Vec<SavedWorkspace>,
     /// File › New › Document › Recent: the settings of the last documents made, newest first.
     pub recent_new_documents: Vec<designcraft_doc::build::NewDocument>,
+    /// The folder of the last file saved or exported: where the save dialog starts for a
+    /// document never saved.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub last_save_folder: Option<String>,
     /// The font menus' sample text (a key of `panels::FONT_SAMPLES`) and size (0–2).
     pub font_sample: String,
     pub font_preview_size: u8,
@@ -383,12 +393,14 @@ impl Default for UiState {
             pages_parents_height: None,
             pages_panel: Default::default(),
             color_settings: None,
+            color_profiles: Vec::new(),
             proof_colors: false,
             proof_setup: Default::default(),
             dynamic_spelling: false,
             language: String::new(),
             flattener: String::new(),
             pdf_export: PdfExportSettings::default(),
+            style_preview: false,
             separation: None,
             ink_limit: None,
             display_quality: designcraft_render::DisplayQuality::High,
@@ -412,6 +424,7 @@ impl Default for UiState {
             workspace: "Essentials".into(),
             custom_workspaces: Vec::new(),
             recent_new_documents: Vec::new(),
+            last_save_folder: None,
             font_sample: "selected".into(),
             font_preview_size: 1,
             new_document_preview: false,
@@ -751,6 +764,32 @@ impl DesignApp {
         self.ui.status = s.into();
     }
 
+    /// The host's save dialog for `name`, started beside the active document once it has been
+    /// saved, else in the folder of the last file saved or exported (#1653). The answer's folder
+    /// is remembered for the next one.
+    pub(crate) fn pick_save(&mut self, name: &str) -> Option<String> {
+        use std::path::{Path, PathBuf};
+        let folder_of = |path: &str| Path::new(path).parent().filter(|f| !f.as_os_str().is_empty()).map(Path::to_path_buf);
+        let folder = self
+            .session
+            .active()
+            .and_then(|d| d.path.as_deref())
+            .and_then(folder_of)
+            .or_else(|| self.ui.last_save_folder.as_ref().map(PathBuf::from));
+        // Only the last part of a name goes after the folder: a title may hold a slash, and an
+        // empty name would make the folder itself the suggested file.
+        let file = Path::new(name).file_name();
+        let suggested = match (folder, file) {
+            (Some(f), Some(file)) => f.join(file).to_string_lossy().to_string(),
+            _ => name.to_string(),
+        };
+        let picked = self.services.pick_save.as_mut().and_then(|f| f(&suggested))?;
+        if let Some(folder) = folder_of(&picked) {
+            self.ui.last_save_folder = Some(folder.to_string_lossy().to_string());
+        }
+        Some(picked)
+    }
+
     /// Did an IME composition end outside the IME this frame (a click, a tool switch)? egui's
     /// `should_interrupt_composition` toggles winit's IME, which doesn't reach the macOS input
     /// context: it keeps the marked text and types it again into the next composition, so the
@@ -1106,8 +1145,22 @@ impl DesignApp {
         self.window_maximized = ctx.input(|i| i.viewport().maximized.unwrap_or(false));
         if !self.color_applied {
             self.color_applied = true;
+            for path in self.ui.color_profiles.clone() {
+                if let Err(e) = self.session.execute("color.loadProfile", &json!({"path": path})) {
+                    log::warn!("Color Settings: {e}");
+                    self.status_error("Color Settings", e);
+                }
+            }
             if let Some(cs) = self.ui.color_settings.clone() {
-                let _ = designcraft_color::cms::set_active(&cs.with_known_profiles());
+                let known = cs.with_known_profiles();
+                for (saved, used) in [(&cs.rgb, &known.rgb), (&cs.cmyk, &known.cmyk)] {
+                    if saved != used {
+                        let e = format!("saved profile {saved} is not available; using {used}");
+                        log::warn!("Color Settings: {e}");
+                        self.status_error("Color Settings", e);
+                    }
+                }
+                let _ = designcraft_color::cms::set_active(&known);
             }
         }
         let scale = self.ui.ui_scale.clamp(0.5, 3.0);
@@ -1834,6 +1887,70 @@ mod tests {
         assert_eq!(app.view_info().unit, Unit::Inches);
     }
 
+    /// Save and Export PDF dialogs started in the home folder (#1653): they start beside a saved
+    /// document, and for one never saved in the folder of the last save or export.
+    #[test]
+    fn save_dialogs_start_beside_the_document_or_in_the_last_folder() {
+        use std::{cell::RefCell, rc::Rc};
+        let home = tempfile::tempdir().unwrap();
+        let elsewhere = tempfile::tempdir().unwrap();
+        let asked: Rc<RefCell<Vec<String>>> = Rc::default();
+        let answer: Rc<RefCell<Option<String>>> = Rc::default();
+        let mut app = DesignApp::new(designcraft_engine::Session::new(), Services::default());
+        let (seen, reply) = (asked.clone(), answer.clone());
+        app.services.pick_save = Some(Box::new(move |name: &str| {
+            seen.borrow_mut().push(name.to_string());
+            reply.borrow().clone()
+        }));
+        app.services.write = Some(Box::new(|_: &str, _: &[u8]| Ok(())));
+        let last = |asked: &Rc<RefCell<Vec<String>>>| asked.borrow().last().cloned().unwrap_or_default();
+        let export_pdf = |app: &mut DesignApp| {
+            app.ui.dialog = Some(dialogs::Dialog::new("pdfExport", json!({})));
+            app.ui.dialog.as_mut().unwrap().fields.insert("title".into(), json!("Report"));
+            dialogs::confirm(app).unwrap();
+        };
+
+        app.run("file.new", json!({})).unwrap();
+        let untitled = format!("{}.designcraft", app.session.active().unwrap().doc.title);
+        app.run("app.saveDialog", json!({})).unwrap();
+        assert_eq!(last(&asked), untitled, "never saved, nothing remembered: the system's own folder");
+
+        let saved = home.path().join("Brochure.designcraft");
+        *answer.borrow_mut() = Some(saved.to_string_lossy().to_string());
+        app.run("app.saveDialog", json!({})).unwrap();
+        assert_eq!(app.session.active().unwrap().path.as_deref(), Some(&*saved.to_string_lossy()));
+        // An export into another folder becomes the last folder used.
+        *answer.borrow_mut() = Some(elsewhere.path().join("Proof.pdf").to_string_lossy().to_string());
+        export_pdf(&mut app);
+        *answer.borrow_mut() = None;
+        export_pdf(&mut app);
+        assert_eq!(last(&asked), home.path().join("Report.pdf").to_string_lossy(), "a saved document exports beside itself");
+
+        app.run("file.new", json!({})).unwrap();
+        let untitled = format!("{}.designcraft", app.session.active().unwrap().doc.title);
+        app.run("app.saveDialog", json!({})).unwrap();
+        assert_eq!(last(&asked), elsewhere.path().join(untitled).to_string_lossy(), "a new document starts in the last folder used");
+    }
+
+    /// No name (Save with no document) suggested the remembered folder itself as the file, and a
+    /// title with a slash moved the suggestion out of the document's folder.
+    #[test]
+    fn save_dialog_suggestions_keep_the_folder_and_only_a_file_name() {
+        use std::{cell::RefCell, rc::Rc};
+        let folder = tempfile::tempdir().unwrap();
+        let asked: Rc<RefCell<Vec<String>>> = Rc::default();
+        let mut app = DesignApp::new(designcraft_engine::Session::new(), Services::default());
+        let seen = asked.clone();
+        app.services.pick_save = Some(Box::new(move |name: &str| {
+            seen.borrow_mut().push(name.to_string());
+            None
+        }));
+        app.ui.last_save_folder = Some(folder.path().join("Docs").to_string_lossy().to_string());
+        app.pick_save("");
+        app.pick_save("Q1/Q2.pdf");
+        assert_eq!(*asked.borrow(), ["".to_string(), folder.path().join("Docs").join("Q2.pdf").to_string_lossy().to_string()]);
+    }
+
     /// An app with one document that has an unsaved edit.
     fn app_with_unsaved_document() -> DesignApp {
         let mut app = DesignApp::new(designcraft_engine::Session::new(), Services::default());
@@ -2929,6 +3046,19 @@ mod browser_import_tests {
         assert_eq!(pixels.data().iter().filter(|p| p.r > 240 && p.g < 10 && p.b < 10).count(), 0);
     }
 
+    #[test]
+    fn pdf_options_refuse_a_page_range_instead_of_placing_page_one() {
+        for spec in ["4-5", "2,5", "2-3", "2.5", "-3", "0", "nan", "inf"] {
+            let mut app = app();
+            let request = app.import_request("place");
+            deliver(&mut app, request, "three.pdf", pdf());
+            app.ui.dialog.as_mut().unwrap().fields.insert("page".into(), json!(spec));
+            assert!(dialogs::confirm(&mut app).is_err(), "{spec}");
+            assert!(app.session.doc().unwrap().doc.assets.is_empty(), "{spec}");
+            assert_eq!(app.ui.dialog.as_ref().unwrap().id, "pdfImport", "{spec}");
+        }
+    }
+
     #[test]
     fn place_loads_the_cursor_unless_a_frame_can_take_the_graphic() {
         let mut app = app();
diff --git a/crates/ui-egui/src/menus.rs b/crates/ui-egui/src/menus.rs
index 87537abd..d97dcdeb 100644
--- a/crates/ui-egui/src/menus.rs
+++ b/crates/ui-egui/src/menus.rs
@@ -1071,7 +1071,7 @@ fn run_ui_inner(app: &mut DesignApp, id: &str, p: &Value) -> Option<Result<Value
         }
         "app.saveDialog" => {
             let name = app.session.active().map(|d| format!("{}.designcraft", d.doc.title)).unwrap_or_default();
-            if let Some(path) = app.services.pick_save.as_mut().and_then(|f| f(&name)) {
+            if let Some(path) = app.pick_save(&name) {
                 return Some(app.run("file.saveAs", json!({"path": path})));
             }
             Ok(Value::Null)
@@ -1082,7 +1082,7 @@ fn run_ui_inner(app: &mut DesignApp, id: &str, p: &Value) -> Option<Result<Value
         }
         "app.saveCopyDialog" => {
             let name = app.session.active().map(|d| format!("{} copy.designcraft", d.doc.title)).unwrap_or_default();
-            if let Some(path) = app.services.pick_save.as_mut().and_then(|f| f(&name)) {
+            if let Some(path) = app.pick_save(&name) {
                 return Some(app.run("file.saveACopy", json!({"path": path})));
             }
             Ok(Value::Null)
@@ -1156,7 +1156,7 @@ fn run_ui_inner(app: &mut DesignApp, id: &str, p: &Value) -> Option<Result<Value
         "app.exportText" => export_bytes(app, p, "rtf", "file.exportText"),
         "app.packageDialog" => {
             let name = app.session.active().map(|d| format!("{} Folder", d.doc.title)).unwrap_or_default();
-            match app.services.pick_save.as_mut().and_then(|f| f(&name)) {
+            match app.pick_save(&name) {
                 Some(dir) => {
                     let r = app.run("file.package", json!({"dir": dir}));
                     if let Ok(v) = &r {
@@ -1217,7 +1217,7 @@ fn run_ui_inner(app: &mut DesignApp, id: &str, p: &Value) -> Option<Result<Value
         "app.saveSwatches" => {
             let path = match p.get("path").and_then(Value::as_str) {
                 Some(s) => Some(s.to_string()),
-                None => app.services.pick_save.as_mut().and_then(|f| f("Swatches.ase")),
+                None => app.pick_save("Swatches.ase"),
             };
             let Some(path) = path else { return Some(Ok(Value::Null)) };
             let r = match app.run("swatch.save", json!({})) {
@@ -2011,7 +2011,7 @@ fn export_png(app: &mut DesignApp, p: &Value) -> Result<Value, String> {
         Some(s) => Some(s.to_string()),
         None => {
             let name = format!("{}-p{}.png", st.doc.title, page + 1);
-            app.services.pick_save.as_mut().and_then(|f| f(&name))
+            app.pick_save(&name)
         }
     };
     let Some(path) = path else { return Ok(Value::Null) };
@@ -2029,7 +2029,7 @@ fn export_idml(app: &mut DesignApp, p: &Value) -> Result<Value, String> {
         Some(s) => Some(s.to_string()),
         None => {
             let name = format!("{}.idml", st.doc.title);
-            app.services.pick_save.as_mut().and_then(|f| f(&name))
+            app.pick_save(&name)
         }
     };
     let Some(path) = path else { return Ok(Value::Null) };
@@ -2049,7 +2049,7 @@ fn export_bytes(app: &mut DesignApp, p: &Value, ext: &str, cmd: &str) -> Result<
         Some(s) => Some(s.to_string()),
         None => {
             let name = format!("{}.{ext}", st.doc.title);
-            app.services.pick_save.as_mut().and_then(|f| f(&name))
+            app.pick_save(&name)
         }
     };
     let Some(path) = path else { return Ok(Value::Null) };
@@ -2077,7 +2077,7 @@ pub(crate) fn export_pdf(app: &mut DesignApp, p: &Value) -> Result<Value, String
         Some(s) => Some(s.to_string()),
         None => {
             let name = format!("{}.pdf", st.doc.title);
-            app.services.pick_save.as_mut().and_then(|f| f(&name))
+            app.pick_save(&name)
         }
     };
     let Some(path) = path else { return Ok(Value::Null) };
@@ -5642,4 +5642,111 @@ mod tests {
         assert!(texts.iter().any(|t| t == "Recent files"), "{texts:?}");
         assert!(texts.iter().any(|t| t == "gone"), "the card names it without `.designcraft`: {texts:?}");
     }
+
+    /// On a short window (1366 x 768 laptops) the start screen is taller than the window; the part
+    /// below the fold has to be reachable by scrolling instead of being cut off.
+    #[test]
+    fn start_screen_scrolls_when_the_window_is_too_short() {
+        let mut app = crate::DesignApp::new(designcraft_engine::Session::new(), crate::Services::default());
+        let ctx = egui::Context::default();
+        crate::theme::install_fonts(&ctx, "");
+        let size = egui::vec2(1366.0, 300.0);
+        let mut tile_y = |events: Vec<egui::Event>| {
+            let input = egui::RawInput { screen_rect: Some(egui::Rect::from_min_size(egui::Pos2::ZERO, size)), events, ..Default::default() };
+            let mut out = ctx.run_ui(input, |ui| {
+                app.logic(&ui.ctx().clone());
+                app.ui(ui);
+            });
+            out.textures_delta.clear();
+            out.shapes.iter().find_map(|s| match &s.shape {
+                // The preset tiles paint their names even when scrolled out of view (labels skip that).
+                egui::Shape::Text(t) if t.galley.text() == "Tabloid" => Some(t.pos.y),
+                _ => None,
+            })
+        };
+        let at = egui::pos2(600.0, 150.0);
+        let mut before = None;
+        for _ in 0..3 {
+            before = tile_y(vec![egui::Event::PointerMoved(at)]);
+        }
+        let before = before.expect("the Tabloid tile is laid out");
+        let wheel = egui::Event::MouseWheel {
+            unit: egui::MouseWheelUnit::Point,
+            delta: egui::vec2(0.0, -400.0),
+            phase: egui::TouchPhase::Move,
+            modifiers: egui::Modifiers::NONE,
+        };
+        let mut after = tile_y(vec![egui::Event::PointerMoved(at), wheel]);
+        for _ in 0..30 {
+            after = tile_y(Vec::new());
+        }
+        let after = after.expect("the Tabloid tile is laid out");
+        assert!(after < before - 50.0, "the start screen should scroll: {before} -> {after}");
+    }
+
+    // Regression test for #329: on the start screen (no document) the Help menu's links were greyed out.
+    #[test]
+    fn help_links_are_enabled_without_a_document() {
+        let app = crate::DesignApp::new(designcraft_engine::Session::new(), crate::Services::default());
+        assert!(app.session.active().is_none());
+        let ids: Vec<&str> = UI_COMMANDS.iter().map(|c| c.0).filter(|id| id.starts_with("help.")).collect();
+        assert!(ids.contains(&"help.discord") && ids.contains(&"help.github"), "{ids:?}");
+        for id in ids {
+            assert!(menu_enabled(&app, id), "{id} must work from the start screen");
+        }
+        assert!(!menu_enabled(&app, "view.rulers"), "other UI commands still need a document");
+    }
+
+    // Regression test for #248: the start screen offered no A6 sheet (it listed only the first ten presets).
+    #[test]
+    fn start_screen_offers_every_print_preset_including_a6() {
+        let mut app = crate::DesignApp::new(designcraft_engine::Session::new(), crate::Services::default());
+        let texts = start_screen_texts(&mut app);
+        for p in designcraft_doc::build::PRESETS.iter().filter(|p| p.intent == designcraft_doc::Intent::Print) {
+            assert!(texts.iter().any(|t| t == p.name), "start screen lacks the {} card: {texts:?}", p.name);
+        }
+        assert!(texts.iter().any(|t| t == "A6"), "{texts:?}");
+        let a6 = designcraft_doc::build::PRESETS.iter().find(|p| p.name == "A6").unwrap();
+        assert!((a6.width - 105.0 * 72.0 / 25.4).abs() < 0.01 && (a6.height - 148.0 * 72.0 / 25.4).abs() < 0.01, "{a6:?}");
+        let page = crate::panels::properties::PAGE_PRESETS.iter().find(|p| p.0 == "A6").expect("Properties page-size list has A6");
+        assert!((page.1 - a6.width).abs() < 0.01 && (page.2 - a6.height).abs() < 0.01, "{page:?} vs {a6:?}");
+    }
+
+    // Regression test for #249: a menu row only reacted over its text, not across the whole row.
+    #[test]
+    fn menu_rows_are_selectable_across_the_full_width() {
+        let mut app = DesignApp::new(designcraft_engine::Session::new(), crate::Services::default());
+        let ctx = egui::Context::default();
+        let screen = egui::Rect::from_min_size(egui::Pos2::ZERO, egui::vec2(600.0, 400.0));
+        let entries = vec![cmd_item("app.preferences", Value::Null)];
+        let mut tick = 0;
+        let mut frame = |app: &mut DesignApp, events: Vec<egui::Event>| {
+            tick += 1;
+            let mut row = egui::Rect::NOTHING;
+            let mut output =
+                ctx.run_ui(egui::RawInput { screen_rect: Some(screen), time: Some(tick as f64 / 60.0), events, ..Default::default() }, |ui| {
+                    egui::Area::new(egui::Id::new("menu_rows")).fixed_pos(egui::pos2(50.0, 50.0)).show(ui.ctx(), |ui| {
+                        let before = ui.cursor().min;
+                        menu_column(app, ui, &[("Test", entries.clone())]);
+                        row = egui::Rect::from_min_max(before, ui.min_rect().max);
+                    });
+                });
+            output.textures_delta.clear();
+            row
+        };
+        frame(&mut app, vec![]);
+        let row = frame(&mut app, vec![]);
+        assert!(row.width() >= 239.0, "the column is at least 240 wide: {row:?}");
+        let far = egui::pos2(row.right() - 6.0, row.top() + 8.0);
+        for pressed in [true, false] {
+            frame(
+                &mut app,
+                vec![
+                    egui::Event::PointerMoved(far),
+                    egui::Event::PointerButton { pos: far, button: egui::PointerButton::Primary, pressed, modifiers: egui::Modifiers::NONE },
+                ],
+            );
+        }
+        assert!(app.ui.dialog.is_some(), "clicking the empty end of the Preferences… row must choose it");
+    }
 }
diff --git a/crates/ui-egui/src/panels/library.rs b/crates/ui-egui/src/panels/library.rs
index 56d6c8ca..65fb1686 100644
--- a/crates/ui-egui/src/panels/library.rs
+++ b/crates/ui-egui/src/panels/library.rs
@@ -33,7 +33,7 @@ pub fn show(app: &mut DesignApp, ui: &mut egui::Ui) {
     ui.separator();
     ui.horizontal(|ui| {
         if ui.button(crate::rtl::widget(ui, crate::i18n::tr(&app.ui.language, "New Library…"))).clicked() {
-            let path = app.services.pick_save.as_mut().and_then(|f| f("Library.dclib"));
+            let path = app.pick_save("Library.dclib");
             let _ = app.run("library.new", json!({"path": path}));
         }
         if ui.button(crate::rtl::widget(ui, crate::i18n::tr(&app.ui.language, "Open…"))).clicked()
@@ -90,7 +90,7 @@ pub fn book(app: &mut DesignApp, ui: &mut egui::Ui) {
     let t = Tokens::get(ui.ctx());
     ui.horizontal(|ui| {
         if ui.button(crate::rtl::widget(ui, crate::i18n::tr(&app.ui.language, "New Book…"))).clicked()
-            && let Some(path) = app.services.pick_save.as_mut().and_then(|f| f("Book.dcbook"))
+            && let Some(path) = app.pick_save("Book.dcbook")
             && let Err(e) = app.run("book.new", json!({"path": path}))
         {
             app.status_error("Book", e);
@@ -154,7 +154,7 @@ pub fn book(app: &mut DesignApp, ui: &mut egui::Ui) {
             let _ = app.run("book.syncStyles", json!({}));
         }
         if ui.button(crate::rtl::widget(ui, crate::i18n::tr(&app.ui.language, "Export PDF…"))).clicked()
-            && let Some(path) = app.services.pick_save.as_mut().and_then(|f| f("Book.pdf"))
+            && let Some(path) = app.pick_save("Book.pdf")
             && let Err(e) = app.run("book.exportPdf", json!({"path": path}))
         {
             app.status_error("Book", e);
diff --git a/crates/ui-egui/src/panels/properties.rs b/crates/ui-egui/src/panels/properties.rs
index fd0094f9..0422936e 100644
--- a/crates/ui-egui/src/panels/properties.rs
+++ b/crates/ui-egui/src/panels/properties.rs
@@ -982,7 +982,9 @@ fn align_row(app: &mut DesignApp, ui: &mut Ui) {
     let t = Tokens::get(ui.ctx());
     ui.horizontal(|ui| {
         ui.spacing_mut().item_spacing.x = 8.0;
-        let to = app.ui.align_to.clone();
+        // A key object switches Align To to Key Object; choosing another target drops the key.
+        let key = app.session.active().and_then(|st| st.selection.key.filter(|_| st.selection.items.len() > 1));
+        let to = if key.is_some() { "keyObject".to_string() } else { app.ui.align_to.clone() };
         let to_label = match to.as_str() {
             "selection" => "Selection",
             "keyObject" => "Key Object",
@@ -1001,7 +1003,10 @@ fn align_row(app: &mut DesignApp, ui: &mut Ui) {
                 ("Align to Page", "page"),
                 ("Align to Spread", "spread"),
             ] {
-                if ui.selectable_label(app.ui.align_to == id, crate::rtl::widget(ui, crate::i18n::tr(&app.ui.language, label))).clicked() {
+                if ui.selectable_label(to == id, crate::rtl::widget(ui, crate::i18n::tr(&app.ui.language, label))).clicked() {
+                    if let Some(k) = key.filter(|_| id != "keyObject") {
+                        let _ = app.run("selection.key", json!({"id": k.0}));
+                    }
                     app.ui.align_to = id.into();
                     ui.close();
                 }
diff --git a/crates/ui-egui/src/panels/swatches.rs b/crates/ui-egui/src/panels/swatches.rs
index 3e7030e8..878904a5 100644
--- a/crates/ui-egui/src/panels/swatches.rs
+++ b/crates/ui-egui/src/panels/swatches.rs
@@ -18,53 +18,63 @@ pub fn show(app: &mut DesignApp, ui: &mut egui::Ui) {
     // Unnamed colours (mixed in the Color panel) aren't listed until Add to Swatches; swatches in
     // colour groups are listed under their folder.
     let grouped: Vec<&str> = doc.color_groups.iter().flat_map(|g| g.swatches.iter().map(String::as_str)).collect();
-    for sw in doc.swatches.iter().filter(|w| !w.hidden && !grouped.contains(&w.name.as_str())) {
-        swatch_row(app, ui, &doc, sw, 0.0, fill_cur.as_deref());
-    }
-    for g in &doc.color_groups {
-        let open_id = egui::Id::new(("color_group_open", &g.name));
-        let mut open: bool = ui.data(|d| d.get_temp(open_id)).unwrap_or(true);
-        let (row, resp) = ui.allocate_exact_size(vec2(ui.available_width(), 22.0), Sense::click());
-        resp.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, true, &g.name));
-        if resp.hovered() {
-            ui.painter().rect_filled(row, 0.0, t.hover);
+    // A gradient dragged from the Gradient panel's thumbnail is dropped on the list, colour
+    // groups included.
+    let (_, dropped) = ui.dnd_drop_zone::<GradientDrag, _>(egui::Frame::NONE, |ui| {
+        for sw in doc.swatches.iter().filter(|w| !w.hidden && !grouped.contains(&w.name.as_str())) {
+            swatch_row(app, ui, &doc, sw, 0.0, fill_cur.as_deref());
         }
-        icons::paint(
-            ui.painter(),
-            egui::Rect::from_min_size(row.min + vec2(2.0, 3.0), vec2(16.0, 16.0)),
-            if open { "chevron-down" } else { "chevron-right" },
-            t.text_dim,
-        );
-        // A folder.
-        let f = egui::Rect::from_min_size(row.min + vec2(20.0, 5.0), vec2(16.0, 12.0));
-        ui.painter().rect_stroke(f, 1.5, egui::Stroke::new(1.2, t.text_dim), egui::StrokeKind::Inside);
-        ui.painter().line_segment([f.left_top() + vec2(1.0, 3.0), f.right_top() + vec2(-1.0, 3.0)], egui::Stroke::new(1.0, t.text_dim));
-        ui.painter().text(row.min + vec2(42.0, 11.0), egui::Align2::LEFT_CENTER, &g.name, egui::FontId::proportional(12.5), t.text);
-        // A double click's first click folded the group: it stays as it was.
-        if resp.clicked() {
-            open = !open;
-            ui.data_mut(|d| d.insert_temp(open_id, open));
-        }
-        if resp.double_clicked() {
-            let _ = app.run("app.colorGroupOptionsDialog", json!({"name": g.name}));
-        }
-        resp.context_menu(|ui| {
-            if ui.button(crate::rtl::widget(ui, crate::i18n::tr(&app.ui.language, "Color Group Options…"))).clicked() {
+        for g in &doc.color_groups {
+            let open_id = egui::Id::new(("color_group_open", &g.name));
+            let mut open: bool = ui.data(|d| d.get_temp(open_id)).unwrap_or(true);
+            let (row, resp) = ui.allocate_exact_size(vec2(ui.available_width(), 22.0), Sense::click());
+            resp.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, true, &g.name));
+            if resp.hovered() {
+                ui.painter().rect_filled(row, 0.0, t.hover);
+            }
+            icons::paint(
+                ui.painter(),
+                egui::Rect::from_min_size(row.min + vec2(2.0, 3.0), vec2(16.0, 16.0)),
+                if open { "chevron-down" } else { "chevron-right" },
+                t.text_dim,
+            );
+            // A folder.
+            let f = egui::Rect::from_min_size(row.min + vec2(20.0, 5.0), vec2(16.0, 12.0));
+            ui.painter().rect_stroke(f, 1.5, egui::Stroke::new(1.2, t.text_dim), egui::StrokeKind::Inside);
+            ui.painter().line_segment([f.left_top() + vec2(1.0, 3.0), f.right_top() + vec2(-1.0, 3.0)], egui::Stroke::new(1.0, t.text_dim));
+            ui.painter().text(row.min + vec2(42.0, 11.0), egui::Align2::LEFT_CENTER, &g.name, egui::FontId::proportional(12.5), t.text);
+            // A double click's first click folded the group: it stays as it was.
+            if resp.clicked() {
+                open = !open;
+                ui.data_mut(|d| d.insert_temp(open_id, open));
+            }
+            if resp.double_clicked() {
                 let _ = app.run("app.colorGroupOptionsDialog", json!({"name": g.name}));
-                ui.close();
             }
-            if ui.button(crate::rtl::widget(ui, crate::i18n::tr(&app.ui.language, "Ungroup Color Group"))).clicked() {
-                let _ = app.run("swatch.ungroupColorGroup", json!({"name": g.name}));
-                ui.close();
-            }
-        });
-        if open {
-            for n in &g.swatches {
-                if let Some(sw) = doc.swatches.iter().find(|w| w.name == *n) {
-                    swatch_row(app, ui, &doc, sw, 16.0, fill_cur.as_deref());
+            resp.context_menu(|ui| {
+                if ui.button(crate::rtl::widget(ui, crate::i18n::tr(&app.ui.language, "Color Group Options…"))).clicked() {
+                    let _ = app.run("app.colorGroupOptionsDialog", json!({"name": g.name}));
+                    ui.close();
+                }
+                if ui.button(crate::rtl::widget(ui, crate::i18n::tr(&app.ui.language, "Ungroup Color Group"))).clicked() {
+                    let _ = app.run("swatch.ungroupColorGroup", json!({"name": g.name}));
+                    ui.close();
+                }
+            });
+            if open {
+                for n in &g.swatches {
+                    if let Some(sw) = doc.swatches.iter().find(|w| w.name == *n) {
+                        swatch_row(app, ui, &doc, sw, 16.0, fill_cur.as_deref());
+                    }
                 }
             }
         }
+    });
+    // An unnamed gradient becomes "New Gradient Swatch"; one that is a swatch already stays one.
+    if let Some(g) = dropped
+        && doc.swatch(&g.0).is_some_and(|w| w.hidden)
+    {
+        let _ = app.run("swatch.new", json!({"swatch": g.0}));
     }
     ui.add_space(6.0);
     // InDesign's bottom row: New Color Group, New Swatch, Delete Swatch (the one last clicked).
@@ -575,6 +585,11 @@ fn spectrum(app: &mut DesignApp, ui: &mut egui::Ui, target: &str) {
 #[derive(Clone, Debug)]
 pub struct SwatchDrag(pub String);
 
+/// The selection's gradient dragged from the Gradient panel's thumbnail (its swatch name): the
+/// Swatches panel takes it as a new gradient swatch.
+#[derive(Clone, Debug)]
+pub struct GradientDrag(pub String);
+
 /// A colour in `object.gradient` form, keeping its model (CMYK stays CMYK).
 fn color_json(c: &designcraft_color::Color) -> serde_json::Value {
     use designcraft_color::Color;
@@ -680,8 +695,18 @@ pub fn gradient_panel(app: &mut DesignApp, ui: &mut egui::Ui) {
     let full = ui.available_width().max(60.0);
     ui.add_enabled_ui(has_item, |ui| {
         ui.horizontal(|ui| {
-            let (r, resp) = ui.allocate_exact_size(vec2(34.0, 34.0), Sense::click());
+            let (r, resp) = ui.allocate_exact_size(vec2(34.0, 34.0), Sense::click_and_drag());
             thumbnail(ui.painter(), r.shrink(1.0), &g, t.field_border);
+            // Drag the gradient onto the Swatches panel to keep it as a swatch.
+            if is_gradient {
+                resp.dnd_set_drag_payload(GradientDrag(fill.swatch.clone()));
+                if resp.dragged()
+                    && let Some(p) = ui.ctx().pointer_interact_pos()
+                {
+                    let painter = ui.ctx().layer_painter(egui::LayerId::new(egui::Order::Tooltip, egui::Id::new("gradient_drag")));
+                    thumbnail(&painter, egui::Rect::from_min_size(p + vec2(8.0, 8.0), vec2(18.0, 18.0)), &g, t.field_border);
+                }
+            }
             // Clicking the thumbnail applies the gradient shown (InDesign's way to start one).
             if resp.clicked() && !is_gradient {
                 send = Some(json!({}));
@@ -1025,6 +1050,64 @@ mod gradient_panel_tests {
         assert_eq!(g.stops[1].color, Color::cmyk(1.0, 0.0, 0.0, 0.0));
         assert!((g.stops[1].offset - 0.5).abs() < 0.05, "{}", g.stops[1].offset);
     }
+
+    /// The Gradient panel's thumbnail drags the selection's gradient onto the Swatches panel,
+    /// which keeps it as a gradient swatch.
+    #[test]
+    fn a_gradient_dragged_onto_the_swatches_becomes_a_swatch() {
+        let mut app = app_with_frame();
+        app.run("object.gradient", json!({})).unwrap();
+        app.run("window.panel.float", json!({"panel": "gradient", "x": 300, "y": 120})).unwrap();
+        app.run("window.panel.float", json!({"panel": "swatches", "x": 620, "y": 120})).unwrap();
+        let named =
+            |app: &DesignApp| app.session.doc().unwrap().doc.swatches.iter().filter(|w| !w.hidden).map(|w| w.name.clone()).collect::<Vec<_>>();
+        let before = named(&app);
+        let mut h = crate::test_window::open(app, vec2(1400.0, 900.0));
+        h.run_steps(6);
+        drag_gradient_to(&mut h, "[Black]");
+        let after = named(&h.state().app);
+        assert_eq!(after.len(), before.len() + 1);
+        assert_eq!(after.last().map(String::as_str), Some("New Gradient Swatch"));
+        let d = &h.state().app.session.doc().unwrap().doc;
+        assert!(matches!(d.swatch("New Gradient Swatch").map(|w| &w.value), Some(SwatchValue::Gradient { .. })));
+        let id = h.state().app.session.doc().unwrap().selection.items[0];
+        assert_eq!(d.item(id).unwrap().fill.swatch, "New Gradient Swatch", "the object keeps it, now by name");
+    }
+
+    /// Drag the Gradient panel's thumbnail onto the Swatches panel row labelled `label`.
+    fn drag_gradient_to(h: &mut egui_kittest::Harness<'static, crate::test_window::Window>, label: &str) {
+        use egui::{Event, Modifiers, PointerButton};
+        // The thumbnail sits left of the Type row.
+        let ty = h.get_by_label("Type:").rect();
+        let from = egui::pos2(ty.min.x - 21.0, ty.min.y + 12.0);
+        let to = h.get_by_label(label).rect().center();
+        h.event(Event::PointerMoved(from));
+        h.step();
+        h.event(Event::PointerButton { pos: from, button: PointerButton::Primary, pressed: true, modifiers: Modifiers::NONE });
+        h.step();
+        for i in 1..=10 {
+            h.event(Event::PointerMoved(from + (to - from) * (i as f32 / 10.0)));
+            h.step();
+        }
+        h.event(Event::PointerButton { pos: to, button: PointerButton::Primary, pressed: false, modifiers: Modifiers::NONE });
+        h.run_steps(4);
+    }
+
+    /// A colour group's row is part of the list too: a gradient dropped on it becomes a swatch.
+    #[test]
+    fn a_gradient_dropped_on_a_colour_group_becomes_a_swatch() {
+        let mut app = app_with_frame();
+        app.run("object.gradient", json!({})).unwrap();
+        let group = app.run("swatch.newColorGroup", json!({})).unwrap()["name"].as_str().unwrap().to_string();
+        app.run("window.panel.float", json!({"panel": "gradient", "x": 300, "y": 120})).unwrap();
+        // Tall enough to show the group's row below the swatches.
+        app.run("window.panel.float", json!({"panel": "swatches", "x": 620, "y": 120, "height": 700})).unwrap();
+        let mut h = crate::test_window::open(app, vec2(1400.0, 900.0));
+        h.run_steps(6);
+        drag_gradient_to(&mut h, &group);
+        let d = &h.state().app.session.doc().unwrap().doc;
+        assert!(matches!(d.swatch("New Gradient Swatch").map(|w| &w.value), Some(SwatchValue::Gradient { .. })), "dropped on the group's row");
+    }
 }
 
 #[cfg(test)]
diff --git a/crates/ui-egui/src/theme.rs b/crates/ui-egui/src/theme.rs
index 7b2364ff..666394e0 100644
--- a/crates/ui-egui/src/theme.rs
+++ b/crates/ui-egui/src/theme.rs
@@ -446,9 +446,9 @@ pub(crate) fn add_system_fallbacks(fonts: &mut FontDefinitions, system: &[System
 
 /// The UI fonts: the app's own, then the craft-fonts faces from `craft` (empty without
 /// `CRAFT_FONTS_DIR`) as fallbacks at the end of every family: Japanese (BIZ UDPGothic first) and
-/// Simplified Chinese, in the interface language's order, then Arabic. The `arabic` families
+/// Simplified Chinese, in the interface language's order, then Arabic and Georgian. The `arabic` families
 /// put the Arabic face first for right-to-left runs. egui has no system-font discovery, so
-/// without craft-fonts CJK and Arabic UI text has no glyphs.
+/// without craft-fonts CJK, Arabic and Georgian UI text has no glyphs.
 pub(crate) fn font_definitions(craft: &'static [designcraft_fonts::CraftFont], lang: &str) -> FontDefinitions {
     let mut fonts = FontDefinitions::default();
     let add = |fonts: &mut FontDefinitions, name: &str, data: &'static [u8]| {
@@ -466,12 +466,13 @@ pub(crate) fn font_definitions(craft: &'static [designcraft_fonts::CraftFont], l
     japanese.sort_by_key(|f| (f.family != "BIZ UDPGothic", f.style != "Regular"));
     let chinese = pick("Hans");
     let arabic = pick("Arab");
+    let georgian = pick("Geor");
     let name = |f: &designcraft_fonts::CraftFont| format!("craft-{}-{}", f.family, f.style);
     for f in japanese.iter().chain(&chinese) {
         // CJK faces sit on the Latin baseline (see `baseline_tweak`).
         fonts.font_data.insert(name(f), Arc::new(FontData { tweak: baseline_tweak(f.bytes, 0), ..FontData::from_static(f.bytes) }));
     }
-    for f in &arabic {
+    for f in arabic.iter().chain(&georgian) {
         add(&mut fonts, &name(f), f.bytes);
     }
     // Han characters take the forms of the interface language: Chinese faces first for Chinese.
@@ -483,12 +484,16 @@ pub(crate) fn font_definitions(craft: &'static [designcraft_fonts::CraftFont], l
             ja.sort_by_key(|f| (f.family != "BIZ UDPGothic", f.style != "Bold"));
         }
         let (first, second) = if zh { (&chinese, &ja) } else { (&ja, &chinese) };
-        stack.extend(first.iter().chain(second).chain(&arabic).map(|f| name(f)));
+        stack.extend(first.iter().chain(second).chain(&arabic).chain(&georgian).map(|f| name(f)));
     }
     // Arabic runs (rtl.rs): the Arabic face first, so letters and spaces shape as one run.
     for family in ["arabic", "arabic-semibold"] {
         let ui = if family == "arabic" { "ui" } else { "ui-semibold" };
-        let stack = arabic.iter().map(|f| name(f)).chain([ui.to_string(), "ui".to_string()]).chain(japanese.iter().chain(&chinese).map(|f| name(f)));
+        let stack = arabic
+            .iter()
+            .map(|f| name(f))
+            .chain([ui.to_string(), "ui".to_string()])
+            .chain(japanese.iter().chain(&chinese).chain(&georgian).map(|f| name(f)));
         let mut seen = std::collections::HashSet::new();
         fonts.families.insert(FontFamily::Name(family.into()), stack.filter(|n| seen.insert(n.clone())).collect());
     }
diff --git a/crates/ui-egui/tests/it/color_profiles_restart.rs b/crates/ui-egui/tests/it/color_profiles_restart.rs
new file mode 100644
index 00000000..ad7ebcc7
--- /dev/null
+++ b/crates/ui-egui/tests/it/color_profiles_restart.rs
@@ -0,0 +1,43 @@
+//! A working space loaded with Edit › Color Settings › Load Profile… is active again after a
+//! restart (#1474). Colour settings are process-wide, so this lives in the integration tests.
+
+use designcraft_color::cms::{self, ColorSettings};
+use designcraft_engine::Session;
+use designcraft_ui_egui::{DesignApp, Services, UiState};
+use serde_json::json;
+
+/// The app's first frame, where saved settings are applied.
+fn start(app: &mut DesignApp) {
+    let mut out = egui::Context::default().run_ui(egui::RawInput::default(), |ui| app.logic(&ui.ctx().clone()));
+    out.textures_delta.clear();
+}
+
+#[test]
+fn loaded_working_space_survives_restart() {
+    let dir = tempfile::tempdir().unwrap();
+    let path = dir.path().join("restart-test.icc");
+    let mut profile = cms::icc_out::generic_cmyk_profile().unwrap().clone();
+    profile.description = "Restart Test CMYK".into();
+    std::fs::write(&path, profile.with_encoded_bytes().to_bytes().as_slice()).unwrap();
+
+    // What ui.json holds after Load Profile… and choosing that profile in a previous session.
+    let chosen = ColorSettings { cmyk: "Restart Test CMYK".into(), ..Default::default() };
+    let saved = json!({"colorProfiles": [path.to_string_lossy()], "colorSettings": chosen});
+
+    // This process has never loaded the profile: only the built-in ones are known.
+    assert!(!cms::profiles().iter().any(|p| p.name == chosen.cmyk));
+    let mut app = DesignApp::new(Session::new(), Services::default());
+    app.ui = serde_json::from_value::<UiState>(saved).unwrap();
+    start(&mut app);
+    let active = cms::active_settings();
+    cms::set_active(&ColorSettings::default()).unwrap();
+    assert_eq!(active, chosen, "the loaded working space is active again");
+
+    // A saved profile that can't be loaded any more is reported, not silently replaced.
+    let gone = json!({"colorProfiles": [dir.path().join("gone.icc").to_string_lossy()], "colorSettings": ColorSettings { cmyk: "Gone CMYK".into(), ..Default::default() }});
+    let mut app = DesignApp::new(Session::new(), Services::default());
+    app.ui = serde_json::from_value::<UiState>(gone).unwrap();
+    start(&mut app);
+    assert_eq!(cms::active_settings(), ColorSettings::default());
+    assert!(app.ui.status.contains("Gone CMYK"), "{}", app.ui.status);
+}
diff --git a/crates/ui-egui/tests/it/main.rs b/crates/ui-egui/tests/it/main.rs
index 2d07c962..6950fc77 100644
--- a/crates/ui-egui/tests/it/main.rs
+++ b/crates/ui-egui/tests/it/main.rs
@@ -1,2 +1,4 @@
 #[cfg(not(target_arch = "wasm32"))]
+mod color_profiles_restart;
+#[cfg(not(target_arch = "wasm32"))]
 mod native_job_lifetime_control;
diff --git a/docs/agents.md b/docs/agents.md
index 2b8d6e51..566357fb 100644
--- a/docs/agents.md
+++ b/docs/agents.md
@@ -63,6 +63,16 @@ The image must contain at most 16 million pixels. PDF/SVG graphics are unsupport
 not Adobe's palette algorithm. In the UI, click an image with the Color Theme Tool (Shift+I), or choose Color Theme…
 in the Swatches panel menu with one image selected. Cancel keeps the document unchanged.
 
+## PDF/X-4 validation
+
+`designcraft-cli validate-pdf FILE.pdf` prints JSON with `valid` and `issues`, and exits non-zero
+when a built-in check fails. Checks cover PDF version, output intent and profile, Info and XMP
+identification, image interpolation, encryption, trim boxes, Type 3 fonts, device RGB under a CMYK
+output intent, and unembedded fonts drawing visible text (including placed PDF forms). Render
+mode 3 (invisible OCR text) is exempt from the font-embedding check. PDF/X-4 export reports these
+issues as warnings; it does not embed or outline placed fonts. These checks are not a complete
+external PDF/X certification.
+
 ## Data merge
 
 `data.source.select {path, sheet?}` links a CSV/TSV/`.xlsx` file to the document (`data.source.update` re-reads it,
diff --git a/docs/file-format-parity.md b/docs/file-format-parity.md
index 381498fb..2a05973a 100644
--- a/docs/file-format-parity.md
+++ b/docs/file-format-parity.md
@@ -1,6 +1,6 @@
 # File format parity
 
-> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-15 · **Change:** minor (IDML liquid guide types, #872; .indd and .indt open through indd-utils; XLSX cached values preserve numeric precision and text; shared print spooler; Windows CI passes; content-indexed asset deduplication, #727) · **Target:** Adobe InDesign 2026 (21.6)
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-19 · **Change:** minor (PDF/X-4 visible unembedded font detection, #909; IDML liquid guide types, #872; .indd and .indt open through indd-utils; XLSX cached values preserve numeric precision and text; shared print spooler; Windows CI passes; content-indexed asset deduplication, #727) · **Target:** Adobe InDesign 2026 (21.6)
 
 Every format InDesign 2026 reads or writes, with DesignCraft's support, fidelity and tests. The
 InDesign list comes from its bundle's `Info.plist` (`CFBundleDocumentTypes`,
@@ -55,6 +55,14 @@ layer survive interchange; literal XML and round-trip tests are in
 | Print / PostScript | | ✓ printers, PPDs, separations | ~ PDF to CUPS/Windows (craft-print; no PostScript) | | 3% |
 | Package | folder | ✓ fonts, links, IDML, PDF, report | ✓ (#340: IDML inside links to absolute paths) | | 2% |
 
+PDF/X-4 export warns about unembedded fonts that draw visible text, including inside placed PDF
+forms; `designcraft-cli validate-pdf FILE.pdf` reports the same issues, with font names and pages
+(#909). Invisible text (render mode 3) is exempt from this font-embedding check. Detection does not
+automatically embed or outline fonts; embedding, substitution or outlining of placed-PDF fonts
+remains missing. A document-wide operation limit and a form-nesting depth limit report incomplete
+font checks rather than traversing pathological nesting. These built-in checks are not complete
+external PDF/X certification.
+
 ## Placed and imported content
 
 | Format | Ext | InDesign | DesignCraft | Notes | Weight |
@@ -114,6 +122,7 @@ up to 30 points.
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-10-19 | minor | PDF/X-4 export and `validate-pdf` report visible unembedded fonts by name and page, including placed forms; invisible text is exempt, operation- or depth-limited checks report incompleteness, and automatic font repair remains missing (#909) |
 | 2026-10-15 | minor | IDML retains liquid versus ruler guide types on document and parent pages, with literal XML and mixed-guide round-trip coverage; object liquid constraints remain unsupported (#872) |
 | 2026-10-13 | minor | Asset loading and compaction use content fingerprints with exact equality checks; tests cover equal-sized distinct buffers, shared copies, independent links and missing data (#727) |
 | 2026-10-13 | minor | `.indd` and `.indt` read through storytold/indd-utils; INDD remaining work is a real-file corpus (10–30 h); score unchanged until it is measured |
diff --git a/docs/gaps.md b/docs/gaps.md
index 8591e39b..6723fe1e 100644
--- a/docs/gaps.md
+++ b/docs/gaps.md
@@ -1,6 +1,6 @@
 # Where DesignCraft falls short of InDesign
 
-> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-17 · **Change:** minor (gap 6 shrunk: Type › Reload Fonts reads fonts installed, edited or removed while running (#328); gap 3: Package links are relative, #340; gap 27 closed: the loaded text cursor threads into a frame inside a group (#1075); .indd and .indt open through indd-utils; gap 0 shrunk: text threads by hand; threading gaps added; Optical kerning from outlines (#181); gap 6: macOS lists fonts that font services and managers activate; shared print spooler; image clipping paths from IDML; Tabs panel listed as present (#343); book chapter update safety; gap 16: Based on Parent leftovers; bounded control click/drag input; swatches on placed greyscale and bitmap images) · **Target:** Adobe InDesign 2026 (21.6)
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-22 · **Change:** minor (gap 28 added: placed-PDF font repair remains after visible unembedded font detection, #909; gap 26 shrunk: autoflow fills the following pages before it adds pages at the end; gap 6 shrunk: Type › Reload Fonts reads fonts installed, edited or removed while running (#328); gap 3: Package links are relative, #340; gap 27 closed: the loaded text cursor threads into a frame inside a group (#1075); .indd and .indt open through indd-utils; gap 0 shrunk: text threads by hand; threading gaps added; Optical kerning from outlines (#181); gap 6: macOS lists fonts that font services and managers activate; shared print spooler; image clipping paths from IDML; Tabs panel listed as present (#343); book chapter update safety; gap 16: Based on Parent leftovers; bounded control click/drag input; swatches on placed greyscale and bitmap images) · **Target:** Adobe InDesign 2026 (21.6)
 
 Every known shortfall against InDesign 2026, one entry each, ranked by how much it stops an
 InDesign professional from doing real work. This is the work list: agents pick from the top.
@@ -123,6 +123,18 @@ Kind: **F** feature · **U** UI/UX · **T** typography · **FF** file format ·
   spot, marks and bleed, the options dialog with remembered settings (#196).
 - **Estimate:** 40–70 h. **Doc:** [file-format-parity.md](file-format-parity.md)
 
+### 28. Placed-PDF font repair for PDF/X-4 (FF)
+- **Missing:** embedding, substitution or outlining of unembedded fonts in placed PDFs; export
+  does not automatically embed or outline them.
+- **Have:** PDF/X-4 export warnings and `validate-pdf` report unembedded fonts drawing visible
+  text, including inside placed PDF forms, with font names and pages (#909). Invisible text
+  (render mode 3) is exempt from this font-embedding check. A document-wide operation limit and a
+  form-nesting depth limit report incomplete font checks rather than traversing pathological
+  nesting.
+- **Impact:** detection now ships, but a placed PDF with visible unembedded fonts still needs
+  font repair before it can meet PDF/X-4 requirements.
+- **Doc:** [file-format-parity.md](file-format-parity.md)
+
 ### 10. Printing (H, F)
 - **Missing:** PostScript, a printer-driver options UI, separations to device, print presets, or trapping.
 - **Have:** `file.print` exports selected pages/spreads with marks and bleed, then submits through
@@ -209,13 +221,11 @@ Kind: **F** feature · **U** UI/UX · **T** typography · **FF** file format ·
   parallel story composition.
 - **Estimate:** 40–80 h.
 
-### 26. Autoflow fills the following pages before it adds pages (F)
-- **Missing:** Shift-click autoflow (and autoflow on Place) always adds new pages after the
-  story's last frame, one margin-sized frame each. InDesign first threads a frame per column on
-  the existing pages that follow, then adds pages at the end of the document.
-- **Impact:** autoflowing into a document that already has pages inserts new pages in the
-  middle of it instead of using the empty pages.
-- **Estimate:** 4–8 h.
+### 26. Autoflow flows into the primary text frame of the pages that follow (F)
+- **Missing:** autoflow threads a frame per column on the pages that follow, then adds pages at
+  the end of the document, as InDesign does. On a page whose parent has a primary text frame it
+  still sets a new frame instead of flowing into the primary one.
+- **Estimate:** 2–4 h.
 
 ## Lower
 
@@ -252,6 +262,8 @@ Cue. These are excluded from every percentage.
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-10-22 | minor | Gap 26 shrunk: autoflow threads a frame per column on the pages that follow the story's last frame, then adds pages at the end of the document |
+| 2026-10-19 | minor | Gap 28 added for remaining placed-PDF font embedding, substitution or outlining; visible unembedded font detection now ships in PDF/X-4 export and `validate-pdf`, with invisible text exempt and operation- or depth-limited checks reported incomplete (#909) |
 | 2026-10-16 | minor | Gap 27 closed: the loaded text cursor threads into a text frame inside a group (#1075) |
 | 2026-10-16 | trivial | Gap 13 shrunk: Greek hyphenates, so five languages do (#1077) |
 | 2026-10-13 | minor | Gap 16: Parent Options dialog and overrides of base items on a parent spread |
diff --git a/docs/localization-parity.md b/docs/localization-parity.md
index fa75a20d..bc209c11 100644
--- a/docs/localization-parity.md
+++ b/docs/localization-parity.md
@@ -1,6 +1,6 @@
 # Localization parity
 
-> **Last reviewed:** 2026-10-11 · **Last updated:** 2026-10-14 · **Change:** minor (Polish and Georgian interfaces; catalog counts remain the 2026-10-10 measurement) · **Target:** Adobe InDesign 2026 (21.6)
+> **Last reviewed:** 2026-10-11 · **Last updated:** 2026-10-23 · **Change:** minor (missing translations are reported, never a failure; catalog counts remain the 2026-10-10 measurement) · **Target:** Adobe InDesign 2026 (21.6)
 
 Per-language status of the DesignCraft interface and of document typesetting in each script.
 Script-specific typesetting detail: [cjk.md](cjk.md), [cjk-typography.md](cjk-typography.md),
@@ -19,6 +19,10 @@ in the UI crate appear in no catalog (some are test data or proper names), so th
 somewhat higher and every percentage below is a slight overestimate. Help: DesignCraft has no
 help content in any language (Help ▸ opens the project's pages).
 
+A missing translation never fails a test, a build or a release. `cargo xtask i18n-report` (also
+a step of `cargo xtask ci`, so the list is in every gate log) prints how many interface strings
+each language lacks, then the strings.
+
 InDesign 2026 ships 25 interface localizations (`.lproj` folders: cs, da, de, el, en, en_GB, es,
 fi, fr, hu, it, ja, ko, nb, nl, pl, pt, ro, ru, sq, sv, tr, uk, zh_CN, zh_TW); Arabic and Hebrew
 come as Middle East editions with an English or French interface and right-to-left features.
diff --git a/docs/mcp.md b/docs/mcp.md
index 7cf8227d..741174e1 100644
--- a/docs/mcp.md
+++ b/docs/mcp.md
@@ -182,7 +182,9 @@ and `text.move` return, a story's `length` in `get_story` and `inspect_document`
 `get_story`. A character outside ASCII takes 2 to 4 bytes (é 2, — and は 3), so the story `はただ商店` has length 15
 and its second character starts at 3. An offset inside a character snaps back to the start of that character, except
 in `story.replaceRange`: there an offset inside a character, an `end` past the end of the story or a `start` after `end`
-is an error that gives the story length in bytes, and the story is left unchanged.
+is an error that gives the story length in bytes, and the story is left unchanged. A `find.find` or `find.next` match
+that has a `cell` (`{table, row, col}`) is in that table cell's text, and its `start` / `end` count from the start of
+the cell.
 
 ## Text and image fitting
 
diff --git a/docs/pdf-backend.md b/docs/pdf-backend.md
index 4cbc985d..26d73aa7 100644
--- a/docs/pdf-backend.md
+++ b/docs/pdf-backend.md
@@ -1,7 +1,7 @@
 # Shared PDF backend
 
-DesignCraft pins `craft-pdf`, patched Krilla 0.8.2 and the four Hayro reader crates to
-craft-libs revision `89dcbb3060377a26c99a6d80caa16084366704c4`. Existing `craft-ui` and `craft-print` revisions
+DesignCraft pins `craft-pdf`, patched Krilla 0.8.2 and the five Hayro reader crates (with
+`hayro-cmap`) to craft-libs revision `9f75d3dc19b4b514c4f3d4847ed1ec1b0e86b4ef`. Existing `craft-ui` and `craft-print` revisions
 remain unchanged. The reader migration is reviewed on top of the separate writer change.
 
 ## Writing
@@ -49,6 +49,12 @@ are recorded separately in ASSETS.md.
 DesignCraft retains placement, layer-name policy, document state and the application render
 cache. Render output is premultiplied RGBA8. Page boxes use the same crop, rotation and
 UserUnit transform as raster output, including fractional placed-PDF dimensions.
+Layer choices are validated for every selected PDF before any document/undo state changes;
+a selection containing an unsupported or layerless PDF is refused rather than partially edited.
+Stale persisted/relinked choices that cannot be honored suppress the graphic on canvas rather
+than reveal hidden source content; resetting to file defaults remains available. All-content
+cropping keeps the whole page when real optional-content state cannot be rewritten, while
+layerless files and empty/null optional-content properties retain measured bounds.
 Layered-PDF export stops on failed layer rewriting, missing pages or reported incomplete
 content rather than saving an unchanged or incomplete placed page. Shared diagnostics only
 report known backend warnings; they do not certify all PDF fidelity.
diff --git a/docs/target-app-parity.md b/docs/target-app-parity.md
index bb7c5eb8..8ae902a2 100644
--- a/docs/target-app-parity.md
+++ b/docs/target-app-parity.md
@@ -1,6 +1,6 @@
 # DesignCraft parity with Adobe InDesign
 
-> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-16 · **Change:** minor (File ▸ Open Recent; .indd and .indt open through indd-utils; text threads by hand; image clipping paths from IDML; anchored objects wrap text; Tabs panel listed as present (#343); spring-loaded Zoom navigation; recovery checkpoint retention; cancelable macOS Dock Quit; Based on Parent; object styles carry effects; colour management on craft-cms, Coated FOGRA39 default CMYK; swatches on placed greyscale and bitmap images) · **Target:** Adobe InDesign 2026 (21.6.0.57, macOS)
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-24 · **Change:** minor (custom anchored objects honour Relative to Spine; PDF/X-4 visible unembedded font detection, #909; autoflow fills the following pages first; File ▸ Open Recent; .indd and .indt open through indd-utils; text threads by hand; image clipping paths from IDML; anchored objects wrap text; Tabs panel listed as present (#343); spring-loaded Zoom navigation; recovery checkpoint retention; cancelable macOS Dock Quit; Based on Parent; object styles carry effects; colour management on craft-cms, Coated FOGRA39 default CMYK; swatches on placed greyscale and bitmap images) · **Target:** Adobe InDesign 2026 (21.6.0.57, macOS)
 
 The authoritative assessment of how close DesignCraft is to Adobe InDesign. [ROADMAP.md](../ROADMAP.md)
 summarizes it; [gaps.md](gaps.md) lists every known shortfall one at a time; the feature-by-feature
@@ -211,18 +211,25 @@ table is the one summed.
 | Fill, stroke, colour | 100% | 60% | 20–35 | hex entry (#323); Assign Profiles / Convert to Profile; color-managed proofing depth; Adobe Color Themes OOS |
 | Effects & transparency | 100% | 50% | 20–30 | effects fidelity vs InDesign unmeasured; Clear Effects / Clear All Transparency; flattener depth |
 | Placing & links | 93% | 55% | 20–35 | EPS is preview-only (no PostScript interpreter); Edit Original; placed PDF layer visibility; INDD page place |
-| Type & text frames | 99% | 45% | 40–60 | Primary Text Frame pages users can't delete (alpha blocker, #165); autoflow doesn't fill existing pages; no threading into grouped frames with the loaded cursor; caret formatting discarded (#289); Notes/Track Changes menus; frame grids |
+| Type & text frames | 99% | 45% | 40–60 | Primary Text Frame pages users can't delete (alpha blocker, #165); autoflow sets new frames on following pages instead of flowing into their primary text frame; caret formatting discarded (#289); Notes/Track Changes menus; frame grids |
 | Typography | 100% | 45% | (typography dimension) | see [typography-parity.md](typography-parity.md) |
 | Styles | 100% | 60% | 15–25 | Paragraph Styles edit/delete reported failing (#169); style options depth |
 | Tables | 100% | 55% | 25–40 | anchored objects in cells not drawn (#163); Table ▸ Table Options submenus, Diagonal Lines, Edit Header/Footer |
 | Long documents | 100% | 45% | 30–50 | Books are shallow (sync, book pagination, book PDF/TOC/index); Table of Contents Styles |
 | Interactivity & digital | 100% | 40% | 30–50 | HTML export basic (#314); fixed-layout EPUB is page images; no animation, timing, media playback |
-| Output & production | 92% | 55% | 40–70 | PDF/X-4 only (no X-1a/X-3), no PDF/print presets or `.joboptions`, print via craft-print (CUPS/Windows), no trapping; Output Preview panel |
+| Output & production | 92% | 55% | 40–70 | PDF/X-4 only (no X-1a/X-3), with visible unembedded font detection (below); no PDF/print presets or `.joboptions`, print via craft-print (CUPS/Windows), no trapping; Output Preview panel |
 | XML & automation | 100% | 35% | (ecosystem dimension) | no ExtendScript/UXP; XML structure depth |
 | View & navigation | 100% | 65% | 10–20 | Navigator, display badges, Show/Hide extras (content grabber, live corners) |
 | Undo, history, saving | 100% | 70% | 5–10 | Undo/Redo name the action |
 | Accessibility | 100% | 50% | 15–25 | tagged PDF exists; PDF/UA validation, reading order depth, screen-reader support in the UI |
 
+PDF/X-4 export warnings and `validate-pdf` report unembedded fonts drawing visible text, including
+inside placed PDF forms, with font names and pages (#909). Invisible text (render mode 3) is exempt
+from the font-embedding check. Fonts are not embedded or outlined automatically; embedding,
+substitution or outlining of placed-PDF fonts remains missing ([gap 28](gaps.md#28-placed-pdf-font-repair-for-pdfx-4-ff)).
+A document-wide operation limit and a form-nesting depth limit report incomplete font checks rather
+than traversing pathological nesting. This is detection, not complete external PDF/X certification.
+
 ## Remaining effort and calibration
 
 **Calibrated against this repo's history.** The first commit was 2026-10-01 09:00; by 2026-10-10
@@ -299,7 +306,7 @@ It is evidence of breadth: each item exists. It is not a claim of InDesign-level
 - Edit › Paste Into (copied objects become a frame's content, clipped by it; rendered, PDF and IDML both ways — verified in InDesign 2026); Polygon Settings (sides, star inset; double-click the Polygon tool).
 - Color panel (fill/stroke proxy, CMYK/RGB/Lab sliders with channel ramps, tint slider for swatches, spectrum ramp, Add to Swatches) and Color Picker (double-click the proxy; R/G/B, C/M/Y/K and hex fields; a CMYK colour stays CMYK unless R/G/B values are typed); mixed colours are unnamed (not listed in Swatches until added); `object.color`, `swatch.addToSwatches`, `swatch.addUnnamed`.
 - Threading: click a selected text frame's in or out port (overset or not) to load the text cursor, then click a frame to thread it (stories merge), click empty space for a column-wide frame down to the bottom margin, or drag a frame; Shift-click autoflows, Alt-click stays loaded; click the linked frame or double-click a port to break the thread; Esc unloads. Link and unthread cursors show where a click threads or unthreads. `text.thread`, `text.unthread`, `text.removeFromThread`.
-- Place text files: Word (.docx: styles by name with their attributes, bold/italic/underline/size/font, footnotes, tables, tabs, breaks), RTF and plain text, into the insertion point, the selected frame or a new frame; autoflow threads one frame per page column and adds pages until the text fits; Remove Styles option (`designcraft-textimport`).
+- Place text files: Word (.docx: styles by name with their attributes, bold/italic/underline/size/font, footnotes, tables, tabs, breaks), RTF and plain text, into the insertion point, the selected frame or a new frame; autoflow threads one frame per page column, on the pages that follow first, then adds pages at the end of the document until the text fits; Remove Styles option (`designcraft-textimport`).
 - Gradient Feather (⇧G tool, `object.gradientFeather`): objects fade along a linear or radial opacity gradient, on screen and as a soft mask in PDF.
 - Script Label (`object.label`, `object.findByLabel`), alt text (`object.altText`), Isolate Blending / Knockout Group (`object.transparencyGroup`; on screen, PDF isolates), Table ▸ Sort (`table.sortRows`, numeric-aware, header/footer fixed).
 - File ▸ Export Text (`file.exportText`): a story as Text Only or RTF (fonts, styles, alignment, indents, tables as tab-separated rows); Export EPUB now asks for a path in the UI.
@@ -336,7 +343,7 @@ It is evidence of breadth: each item exists. It is not a claim of InDesign-level
 - View ▸ Fit Selection in Window (⌥⌘=) and Find/Change ▸ Object (`find.objects`, `find.changeObjects`: by fill, stroke, weight, opacity, kind, layer, label).
 - Custom workspaces (`window.newWorkspace/deleteWorkspace/resetWorkspace`; workspace switcher shows the current one): bars and panel arrangement saved by name. Essentials Classic shows the Control panel and InDesign's iconic panel groups with names. The Window menu follows InDesign's: Arrange, Workspace, then the panels alphabetically with their Color, Editorial, Interactive, Object & Layout, Output, Styles, Type & Tables and Utilities groups.
 - Word/RTF Import Options (File ▸ Place with Import Options…, `place.styles`, `file.place {styleMap, styleConflicts}`): map imported styles onto the document's, use existing / redefine / auto-rename on conflicts, or remove formatting.
-- Custom anchored objects (`anchored.insert/options {position: custom}`): placed relative to the anchor, frame, column, page margins or page edge with reference points and offsets, no space in the text, keep within column; IDML Anchored position. Their text wrap pushes aside the text of other stories they overlap and the lines of their own story after the anchor's line.
+- Custom anchored objects (`anchored.insert/options {position: custom}`): placed relative to the anchor, frame, column, page margins or page edge with reference points and offsets, no space in the text, keep within column, Relative to Spine (mirrored on right-hand pages); IDML Anchored position. Their text wrap pushes aside the text of other stories they overlap and the lines of their own story after the anchor's line.
 - Variable font axes: Character panel sliders; any axis values (`fontStyle: "Bold {wght:650}"`) make that instance for layout, screen and PDF.
 - Image Import Options › Crop to for placed PDFs (`file.place {pdfCrop: crop|trim|bleed|art|media}`, Place PDF dialog): the frame shows that page box.
 - Stroke styles: striped (thick-thin… and custom bands), wavy and straight-hash strokes now draw on screen and in PDF; named custom stripe/dash/dot styles (`strokeStyle.new/delete/list`, Stroke panel Type list; IDML Striped/Dashed/DottedStrokeStyle).
@@ -368,7 +375,7 @@ It is evidence of breadth: each item exists. It is not a claim of InDesign-level
 - Object States (`states.create/show/rename/release/list`, Object States panel): multi-state objects show one state on screen and in PDF.
 - Buttons (`button.set/clear/list`, Buttons and Forms panel): go to page / next / previous / first / last / URL as PDF link annotations. Form fields too (`form.set/clear/list`: text fields, check boxes, combo and list boxes, signature fields; required, multiline, defaults) exported as AcroForm widgets through an incremental update (not in PDF/X or PDF/A).
 - Power Zoom (Hand tool: press and hold still for half a second, or Alt-press): zoom out to the spread, aim the red view rectangle, release to zoom back in there.
-- Graphic cells (`table.placeGraphic`, `table.textCell`, Table › Convert Cell Type, Table panel): images in table cells, fitted or filled, clipped to the cell on screen and in PDF.
+- Graphic cells (`table.placeGraphic`, `table.textCell`, Table › Convert Cell Type, Table panel): images in table cells, fitted or filled, clipped to the cell on screen and in PDF; IDML export writes them as an inline graphic in the cell.
 - Live Distribute (Space while dragging a selection handle; `transform.resize {distribute}`): objects keep their size and spread with the bounds.
 - Flex Layout (InDesign 2026; `flex.add`, `flex.convert`, `flex.remove`, `flex.set`, `flex.reorder`, Window › Flex Layout and the Properties panel's Flex Layout section): a frame lays out its objects in rows or columns by direction, wrap, justification (Flex Start, Center, Flex End, Space Between, Space Around, Space Evenly), the alignment grid, Fixed/Auto width and height, padding and spacing; aligned objects are detected on Add (direction, Auto, Space Between); resizing a container reflows it; dragging an object in one reorders it. Not yet: item sizing (Fixed/Auto/Fill Space per object), object styles with Flex Layout settings, IDML (a container exports as a frame with pasted-in objects), nested selection cues on the canvas.
 - Liquid Layout (`liquid.pageRule/object`, `guide.liquid`, `layout.createAlternate`, Liquid Layout panel): scale / re-center / guide-based / object-based page rules applied on page resize and Document Setup; dashed liquid guides; alternate layouts as resized page copies in a named section. Text in an alternate layout stays linked to the original stories (Links panel shows them out of date; `story.updateLink`).
@@ -463,6 +470,7 @@ Task notes that headed ROADMAP.md:
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-10-19 | minor | Output assessment records visible unembedded font detection in PDF/X-4 export and `validate-pdf`, the invisible-text exemption, incomplete-check reporting at the operation and nesting-depth limits, and remaining placed-PDF font repair (#909); readiness and hours unchanged |
 | 2026-10-13 | minor | `.indd` and `.indt` open through storytold/indd-utils; INDD remaining work 10–30 h (real-file corpus); readiness unchanged until it is measured |
 | 2026-10-12 | minor | Text threads by hand; stage note and distance to alpha follow the gate (5–7 h, #165); percentages unchanged |
 | 2026-10-11 | minor | Spring-loaded Zoom navigation added to the working feature inventory (DC-1); readiness estimates unchanged |
diff --git a/docs/user/guides/export-a-pdf.md b/docs/user/guides/export-a-pdf.md
index 3bec469c..827f54c4 100644
--- a/docs/user/guides/export-a-pdf.md
+++ b/docs/user/guides/export-a-pdf.md
@@ -17,7 +17,7 @@ Shortcuts on this page use Ctrl. On macOS, use Cmd instead of Ctrl.
 4. Under **Compression**, tick or clear **Compress images**.
 5. Under **Marks and Bleeds**, tick **Include document bleed**, **Crop Marks**, **Bleed Marks** or **Page Information** as your printer asks. **Weight:** and **Offset:** set the marks.
 6. Under **Advanced**, pick a **Standard:** (**None**, **PDF/X-4** or **PDF/A-2b**) and decide on **Tagged PDF**.
-7. Click **OK**, then choose where to save. The file name starts as your document's title with `.pdf`.
+7. Click **OK**, then choose where to save. The file name starts as your document's title with `.pdf`. The save dialog opens in your document's folder, or, if the document has never been saved, in the folder you last saved or exported to.
 
 ## Presets
 
diff --git a/xtask/src/main.rs b/xtask/src/main.rs
index 5000860c..c1d08071 100644
--- a/xtask/src/main.rs
+++ b/xtask/src/main.rs
@@ -23,8 +23,9 @@ commands:
   pdf-deps        verify the pinned PDF backend, including Krilla dependencies
   wasm            cargo check --target wasm32-unknown-unknown for the wasm-safe crates (one call)
   test            workspace tests (cargo nextest when installed, else cargo test), then doctests
-  ci              fmt --check, pdf-deps, clippy -D warnings, test, doctest, assets, layers, wasm
-                  (stops at first failure)
+  i18n-report     list the interface strings each language shows in English (always passes)
+  ci              fmt --check, pdf-deps, clippy -D warnings, test, i18n-report, doctest, assets,
+                  layers, wasm (stops at first failure)
   corpus [--download]
                   show where test corpora live; --download fetches PngSuite into corpus/pngsuite
   stats [--exact] count tests and lines per crate (--exact: ask the test harness via `-- --list`)
@@ -42,6 +43,7 @@ fn main() -> ExitCode {
         Some("pdf-deps") => pdf_deps::run(&root()),
         Some("wasm") => cmd_wasm(),
         Some("test") => cmd_test().and_then(|()| cmd_doctest()),
+        Some("i18n-report") => cmd_i18n_report(),
         Some("ci") => cmd_ci(),
         Some("corpus") => cmd_corpus(rest.contains(&"--download")),
         Some("stats") => stats::run(&root(), rest.contains(&"--exact")),
@@ -177,6 +179,21 @@ fn cmd_test() -> Result<(), String> {
     run(c, &format!("cargo {tool} {}", TEST_TARGETS.join(" ")))
 }
 
+/// Runs the ignored `missing_translations_report` test with its output shown. It takes the test
+/// step's targets, so it reuses that build.
+fn cmd_i18n_report() -> Result<(), String> {
+    const REPORT: &str = "i18n::tests::missing_translations_report";
+    let mut c = cargo();
+    if nextest_available() {
+        c.args(["nextest", "run", "--cargo-quiet"]).args(TEST_TARGETS);
+        c.args(["--run-ignored", "only", "--no-capture", "--status-level", "fail", "--final-status-level", "fail", "-E"]);
+        c.arg(format!("package(designcraft-ui-egui) & test(={REPORT})"));
+    } else {
+        c.args(["test", "-q"]).args(TEST_TARGETS).args(["--", "--ignored", "--exact", REPORT, "--nocapture"]);
+    }
+    run(c, &format!("missing translations ({REPORT})"))
+}
+
 /// nextest does not run doctests.
 fn cmd_doctest() -> Result<(), String> {
     let mut c = cargo();
@@ -205,6 +222,7 @@ fn cmd_ci() -> Result<(), String> {
             }),
         ),
         ("test", Box::new(cmd_test)),
+        ("i18n-report", Box::new(cmd_i18n_report)),
         ("doctest", Box::new(cmd_doctest)),
         ("assets", Box::new(|| assets::run(&root()))),
         ("layers", Box::new(cmd_layers)),
diff --git a/xtask/src/pdf_deps.rs b/xtask/src/pdf_deps.rs
index bb2a4f01..7e9677d5 100644
--- a/xtask/src/pdf_deps.rs
+++ b/xtask/src/pdf_deps.rs
@@ -4,7 +4,7 @@ use std::process::Command;
 
 use serde_json::Value;
 
-const REV: &str = "89dcbb3060377a26c99a6d80caa16084366704c4";
+const REV: &str = "9f75d3dc19b4b514c4f3d4847ed1ec1b0e86b4ef";
 const PACKAGES: &[(&str, &str)] = &[
     ("craft-pdf", "0.1.0"),
     ("krilla", "0.8.2"),
@@ -12,6 +12,7 @@ const PACKAGES: &[(&str, &str)] = &[
     ("hayro-interpret", "0.7.0"),
     ("hayro-syntax", "0.7.2"),
     ("hayro-jbig2", "0.3.0"),
+    ("hayro-cmap", "0.1.0"),
 ];
 
 pub fn run(root: &Path) -> Result<(), String> {