Engine: the run's check of each step finds the inputs on their sheet after a sheet moved

- The check for writes over data compared the inputs' sheet with the sheet's index when the run
  started, while the inputs follow their cells: after a step inserted a sheet in front, a step
  writing into its own input on the moved sheet was stopped as writing over data. It now uses the
  sheet's index now. Test: the input case in
  `inputs_and_the_output_follow_their_cells_when_a_step_moves_them`.
- Docs: the page says `macro.run` checks the macro, its inputs and parameters and the policy
  before it runs, and that a formula whose references a move rewrites counts as changed too.

crates/engine/src/macros/run.rs

@@ -508,7 +508,8 @@ impl Guard {
             if Arc::ptr_eq(ps, sa) {
                 continue;
             }
-            let in_input = |c: CellRef| inputs.iter().any(|(_, p, _)| p.sheet == si && p.range.contains(c));
+            // The inputs have followed their cells, so they are on the sheet's index now.
+            let in_input = |c: CellRef| inputs.iter().any(|(_, p, _)| p.sheet == ai && p.range.contains(c));
             let mut hit: Vec<CellRef> = ps
                 .cells
                 .diff(&sa.cells)

crates/engine/src/tests/macros.rs

@@ -191,10 +191,21 @@ fn inputs_and_the_output_follow_their_cells_when_a_step_moves_them() {
         {"command": "home.insertSheet", "params": {"name": "Summary", "before": 0}},
         {"command": "cell.set", "params": {"cell": "Input", "input": "x"}}
     ]);
-    put(&mut s, json!({"name": "Front", "inputs": [{"name": "Input", "kind": "cell"}], "output": {"onConflict": "overwrite"}, "steps": steps}));
+    put(
+        &mut s,
+        json!({"name": "Front", "inputs": [{"name": "Input", "kind": "cell"}], "output": {"onConflict": "overwrite"}, "steps": steps.clone()}),
+    );
     s.execute("macro.run", json!({"name": "Front", "inputs": "Sheet1!B2"})).unwrap();
     assert_eq!((on(&s, "Sheet1", "B2"), on(&s, "Summary", "B2")), ("x".into(), "".into()));
 
+    // Data in the input: the step writes into its own input, which isn't data written over, on
+    // the input's sheet wherever it moved.
+    let mut s = super::s();
+    set(&mut s, "B2", "held");
+    put(&mut s, json!({"name": "Front", "inputs": [{"name": "Input", "kind": "cell"}], "output": {"onConflict": "fail"}, "steps": steps}));
+    s.execute("macro.run", json!({"name": "Front", "inputs": "Sheet1!B2"})).unwrap();
+    assert_eq!(on(&s, "Sheet1", "B2"), "x");
+
     // Rows inserted above: the input and the output move down with their cells.
     let mut s = super::s();
     set(&mut s, "B5", "in");

docs/macros.md

@@ -9,9 +9,10 @@ error (a file it already wrote stays), stops before it writes over data it may n
 touch files without permission.
 Agents run macros with `macro.run` like any other command.
 
-This page describes the macro format, its tokens, and running macros. The engine has no check of a
-macro before it runs, no macro debugger, recorder or management commands in this version, and no
-macro interface.
+This page describes the macro format, its tokens, and running macros. `macro.run` checks the
+macro, its inputs, its parameters and the policy before it runs, and each step as it runs; this
+version has no command that checks a macro without running it, no macro debugger, recorder or
+management commands, and no macro interface.
 
 ## A macro
 
@@ -115,7 +116,8 @@ refused rather than read as the header.
    step that writes over cells outside the inputs that held data when the run started, or deletes
    sheets or objects that were there, stops the run, which rolls the workbook back (a file already
    written stays). Moving such cells, as inserting or deleting rows or cells above them does,
-   counts as writing over them: the check compares cells by place. The rule is `onConflict` (or
+   counts as writing over them, and so does a formula whose references such a move rewrites: the
+   check compares cells by place, so it may ask about data that only moved, never the other way. The rule is `onConflict` (or
    the macro's `output.onConflict`): `ask` (the call fails with `confirm: …`; `overwrite: true`
    answers it), `fail` or `overwrite`. Shifting the data to make room (`shiftDown`,
    `shiftRight`) needs to know where the macro writes before it runs, which this version doesn't