Engine: building blocks for multi-command actions (undo groups, recording buffer, document trust, chunked hidden names) (#462)

* Engine: undo groups make several commands one undo step Session::grouped(label, f) runs f as one undo step on the active document. On success the group leaves exactly one undo entry holding the workbook from before the group; on error it restores the workbook, selection, undo and redo stacks as they were and returns the error. group_begin, group_end and group_rollback do the same across separate calls, for an action that runs one step per call. While a group is open on a document, undoable commands on it add no undo steps of their own, so a long group neither grows the history nor pushes older entries past the undo limit, and Undo and Redo are disabled there. Groups nest: the outermost one makes the step, and a failing inner group rolls back only its own changes. Closing a document drops its groups, and a command that panics drops the groups it opened. history.list reports whether a group is open. Insert Copied Cells folds its nested steps into one undo step by counting revisions; inside a group the nested steps push no entries, so it now leaves the history alone there instead of removing entries from before the group. * Engine: a recording buffer of top-level commands, apart from the journal A macro recorder needs more than a journal index: the journal is trimmed past 10,000 entries, it also holds the commands that other commands run (so playback would run them twice), and it keeps no selection, which relative references need. Session now tracks how deeply execute calls are nested. While recording, a buffer (record.rs) keeps each successful, journaled top-level call with the document uid, the active sheet (index and name) and the selection it ran in, then its id and parameters without secrets, as the journal stores them. Queries, failed commands and the command that starts recording are not kept. The buffer holds up to 100,000 steps and counts any it drops. Session::start_recording, stop_recording, is_recording and depth are the interface. Automate › Record Actions keeps recording through the journal as before. * Engine: document trust for workbooks opened from files Active content such as macros must not run only because a workbook was opened. DocState gets a trust state: Local for workbooks made in the session (new workbooks and samples) and FromFile for anything opened with file.open. Active content in a FromFile workbook asks before it runs. A second window on a workbook shares its trust. The clipboard carries the trust of its source document. Pasting formulas, formats (conditional formats hold formulas) or validation from a FromFile workbook into another workbook makes that workbook FromFile too; pasting values, column widths or notes carries nothing active and changes nothing. Sheet moves and copies stay inside one workbook, so its trust is unchanged. document.inspect reports the trust. * Engine: workbook data in chunked hidden names (cmd/stash.rs) GridCraft keeps workbook data in hidden defined names so it travels inside the xlsx file. The existing items write one name holding one string literal, which past Excel's 255-character literal and 8,192-character formula limits gives a file Excel does not accept. cmd/stash.rs stores an item `key` as hidden workbook-scope names _gc_<key>_0, _gc_<key>_1, ..., each a formula of string literals of at most 255 characters (UTF-16 units, as Excel counts them) joined with &, at most 8,192 characters per name. Reading concatenates the chunks in order and stops at a gap; it also accepts the older single _sc_<key> name. Names are matched case-insensitively and only at workbook scope. Keys are limited to letters, digits, _ and ., items to 4,194,304 characters, and junk around or inside the literals, duplicate or out-of-order chunks, non-JSON and over-deep JSON all read safely. keys(prefix) lists the stored items that start with a prefix. Custom views, scripts, the watch list and scenarios keep their current storage; nothing reads or writes the new names yet. docs/architecture.md describes the engine building blocks added in this series: undo groups, the recording buffer, document trust and this storage. * Engine: a linked paste of values from a file carries the file's trust A linked paste writes formulas even when it pastes values, but the values exception skipped the trust update, so a Local workbook stayed Local after linking to a FromFile one. The exception now applies only to unlinked pastes. * Engine: a stash item with only later chunks reads as missing and falls back to the legacy name With chunk _gc_k_2 but no _gc_k_0, get returned Some("") and never looked at _sc_k. It now takes the legacy path unless chunk 0 exists. * Engine: a command that runs its own undo groups makes one undo step for itself execute treated any change in the group epoch as 'the group owns the step'. A command that edited outside its own group, or whose group rolled back before it edited, left that edit with no undo step or only part of it. Now only a group that was open before the command (or is still open after) owns the step; a command that opened and closed its own groups replaces their steps with one entry for the command. * Engine: a full undo history keeps one step per command that runs its own undo groups When the history held 100 steps, group_end pushed its step and dropped the oldest one at once, so execute's collapse compared against a length that no longer matched. A command that was one group kept the group's step and added its own, losing two old steps. After test.editThenGroup, the second Undo brought back the intermediate state after the outside edit. The history limit now applies after the outermost command has collapsed its steps, and when a group ends outside any command. A document with an open group is trimmed when the group ends. * Engine: pasting only formats from a file leaves the destination's trust alone Paste Special › Formats copies cell styles and merged areas. It copies no conditional formats, formulas or validation, so it carries nothing that runs. It still marked the destination FromFile: copying a formula cell from an opened file and pasting its formats into a new workbook made that workbook ask before running its own active content. Formats pastes now count as passive, like values, column widths and notes. The comment and docs/architecture.md no longer say that pasted formats carry trust. * Engine: a command keeps its group's name only for a group it ended itself The record of the last group step (document, history length, epoch) outlived the Undo of that step. A later command that opened and closed its own groups at the same history length, after rolling one back, passed the epoch check (the record's epoch merely differed from the one the command started with) and took the name of the nested edit it had made instead of its own. The step must now come from a group ended during the command (an epoch past the command's starting one), and a rollback drops a record of a step it truncated away. * Engine: a group rolled back inside a command keeps the redo history A command that changed the workbook cleared the redo history even when an open group owned its step. When the group was then rolled back inside the same command (the debugger's Stop with Undo Changes), the rollback put the redo history back and the command's bookkeeping cleared it again. Now only a command that makes a step of its own clears the redo history; a group clears it when it ends as a step, and a rollback restores it. * Engine: a visible name of the item shape is not workbook data The item store read, listed and removed every workbook-scope name of the `_gc_<key>_<n>` shape, visible or not, so saving an item removed a person's own visible name that happened to look like one. Items are the hidden names the store writes; a legacy `_sc_<key>` name still reads. A visible `_gc_` name is left alone by every operation, and writing an item that would need that name is refused before anything changes: a hidden name beside it with the same name is the one an xlsx file drops, so the item would be lost on save. * Engine: a command keeps its group's name only for a step that is exactly the group's The record of the last group step held the document, the history length and a group epoch, and a command reused the group's label when the lengths matched and the epoch was newer. A direct edit after the group (no nested command, so the length still matches) then left the step named after the group alone. The record now holds the workbook the group's step led to (a weak reference, so it keeps nothing alive). A command keeps the group's name only when the one entry it added starts from the command's own starting workbook and ends at its result, which is provenance by identity rather than by position: an entry a nested command made, a step of an earlier command undone since, and a group step the command edited past all name the step after the command. A later group that rolled back changes nothing, and the rollback no longer needs to clear the record. * Engine: the recording buffer is bounded in bytes and keeps the start of a recording The buffer kept at most 100,000 steps but each step keeps its full parameters, and a file.open step holds the whole file as base64, so a recording of a few opens of a large workbook kept tens of MB alive. Like the journal, the buffer now also stops at 64 MB of steps serialized as JSON. A step that does not fit is counted as dropped, and once a step is dropped every later one is too, so what the buffer holds is always how the recording began, never a sequence with gaps. * Docs: the architecture revision row carries the date the change lands; document trust beside script trust The header and the revision row said 2026-10-11, older than the row above them. The document trust paragraph now says how DocState::trust (provenance) differs from DocState::scripts_trusted (per-session consent for stored scripts, #2178). * Engine: writing a stash item checks for a clashing visible name in one pass over the names The check ran once per chunk, each a scan of every defined name: an item of many chunks in a workbook with thousands of names compared every pair. One pass now parses each visible workbook-scope name and refuses when it is a chunk of this key below the chunk count. The behaviour and its test are unchanged. * Engine: a command's changes after ending a group, or before opening one it leaves open, are not lost or a step of their own Two boundaries of the group rules were wrong. A command that ended a group open before it was treated as grouped whatever it did next: with an unchanged group (no step) its later edit had no undo entry at all, and with nested edits after the end the entry was the nested command's. The group's step now stays the group's, and the command makes one step of its own, under its name, for what changed after the end, from the workbook the group ended at. A command that edited and then opened a group it leaves open (a debugger's start) left its nested entries in the history, so one Undo after the group ended brought back a state from inside the command. Such a group now takes the command's start as its own, and its step covers the command's earlier edits. The record of where the last group ended now holds the workbook and selection it ended at, the history length then and whether it made a step; it lives until the outermost command finishes. A rollback records where it ended too, unless the document is back exactly where the last recorded step left it. * Engine: the undo steps made inside a command are bounded while it runs The history limit is applied once the outermost command has finished, so the lengths its bookkeeping compares stay true (round 3). That left the steps nested commands make unbounded until then: a script of up to 100,000 steps, or a subtotal with a step per group, kept every one of them alive, each with the cells it retains, and before this branch every push trimmed the history at once. Each nested command now bounds the steps made since the latest mark on its document to the undo limit and byte budget, dropping the oldest of them. The marks are the starts of the running commands, the starts of the open groups and the end of the last group: the positions a command or group collapses its steps by when it finishes, so nothing before them moves. What the bound drops is only what the final trim would drop. * Engine: a grouped action that closes its document succeeds Session::grouped ended its group after the action, and when the action had closed the group's document (file.close, or file.open taking the place of an untouched new workbook) the group had gone with it, so the action was reported as failed although it had done what it was asked. A group that is gone because its document is gone now counts as ended; a group ended by someone else while the document is open is still an error. * Docs: undo groups at a command's boundaries, and the bound on steps made inside a command * Engine: a linked paste carries the file's trust whatever it pastes Paste Link writes a formula into every cell whatever `what` says, so a linked paste of formats from a file now makes the destination FromFile as a paste of formulas does. Column widths and notes write no cells, linked or not, and still carry nothing. Regression test for the three kinds. * Engine: a stash chunk number with leading zeros names someone else's name `_gc_watch_00` parsed as chunk 0, so a hidden one was read as the item's first chunk and a visible one stopped `_gc_watch_0` from being written. Only the chunk number as `set` writes it counts now. Regression test. * Engine: a command that panics leaves the undo history as it found it The panic guard restored the workbook and selection but not the history, so a nested edit made before the panic left a no-op undo step and the redo history it had cleared stayed lost. The guard now truncates the steps made during the command and puts the redo history back. Regression test, and the architecture note says what the guard restores. * Engine: a headless call that fails for want of a file is not recorded file.open with no file succeeds by queuing a dialog, which execute_headless turns into an error for callers with no UI; the recording kept the step. Recorder::truncate forgets it and keeps the byte count right. Regression test. * Engine: a later stash chunk on its own is not a listed item stash::keys reported a key that get read as missing, because only a later chunk of it existed. keys now counts chunk 0 and legacy names only, as get does. Regression assertions in the hostile-names test. * Tests: a linked paste of column widths or notes copies its metadata and no cell The source now carries a note and a column width, and the test checks that the destination received them while its trust stays Local and no cell is written. * Engine: the panic guard restores entries a nested Undo removed Truncating the undo history to its length at the command's start cannot bring back an entry that a nested edit.undo popped. The guard now keeps the undo and redo history as they were and puts both back. The regression test gains the undo-then-panic case. * Engine: a group a panicking command ended keeps its step A group open before a command and ended or rolled back inside it lost its undo step when the command then panicked: the restored history held no entry for the group's changes, so Undo skipped the state before the group. The panic path now pushes the outermost such group's step from its start to the restored workbook. The group stays ended, because its token went with the command. Regression test for a group ended and one rolled back. * Docs: list every paste that carries a file's trust The architecture note named formulas and validation only; it now lists the Paste Special kinds and linked pastes that write formulas, and the kinds that carry nothing. * Engine: a grouped action that panics is rolled back before the panic goes on Session::grouped ran its action without a panic guard, so a caller outside a command that caught the panic found the group still open: Undo and Redo disabled, the partial edits kept, and the next grouped action nested in the abandoned group. The group is now rolled back and the panic resumed. Regression test. * Engine: the recorder counts a dropped step without serializing it Once a step has been dropped, or the step count is full, push serialized each later step only to count it; a file.open step holds a whole file. The checks that need no size come first. * Engine: a failed command rolls back the undo groups it opened A command that opened an undo group and then returned an error (a `?` between `group_begin` and `group_end`) left the group open for good: Undo and Redo refused with "finish or stop the running action first", later edits made no undo steps, and nothing could stop the group. `execute` now rolls back every group a failed command opened, as `group_rollback` does, restoring the workbook, selection, undo and redo history to where each group began. Only a command that succeeds keeps a group it opened, which is what a debugger's start needs. `Session::abort_groups(doc)` and the menu-less command `automate.stopAction` roll back the groups left open on a document, for a debugger the person abandons or a caller that dropped its token. The command is not undoable and works while a group is open, and the Undo refusal now names it. * Engine: the recorder skips a call that only opened a dialog A menu-style call with no parameters, such as `file.open`, `data.fromTextCsv` or `home.formatCells` with `{}`, only queues its dialog and succeeds. The recorder kept it as a step with empty parameters, and then kept the dialog's confirming call as well, so playing the recording back ran the command twice, or failed on the empty step when played back headless. Only `execute_headless` took the step back, and only for the open and save-as dialogs. `execute` now compares the queued UI requests before and after a top-level command and does not record one that queued a dialog. The special case in `execute_headless` goes (it keeps turning a missing file into an error), and with it `Recorder::truncate`, which had no other caller. * Engine: stash items keep characters XML can't carry The xlsx writer drops characters XML 1.0 can't carry: controls other than tab, line feed and carriage return, and U+FFFE and U+FFFF. A stash item holding one lost it on save without a warning, and so did a JSON item, since serde_json leaves U+FFFE and U+FFFF unescaped: a stored macro parameter changed silently. `chunk_formulas` now writes each such character, and the marker itself, as the noncharacter U+FDD0 followed by four hex digits, and `get` turns them back for `_gc_` items. A marker that isn't followed by four hex digits naming a character is read as it is. An escape counts as five units against the 255-unit literal limit and is never split across literals, and the guard on the stored size allows the longest item even when every character is escaped. Legacy `_sc_` items are read unchanged. * Engine: list stash items in one pass over the names Each `stash::get` looks at every defined name, so listing the items with `keys` and then reading each with `get` took time quadratic in the number of names. A file with 20,000 hidden `_gc_macro_<i>_0` names took about ten seconds in a debug build, and the macro list reads its items this way from data that comes from the file. `stash::items(wb, prefix)` now groups the names by item in one pass and returns each item's text by key, and `keys` lists from the same pass. Both return at most `MAX_ITEMS` (10,000) items, the first keys in sorted order, so a file with any number of hidden names can't make a listing unbounded. A test counts the names each listing looks at. * Engine: the name commands leave GridCraft's data names alone `formulas.defineName {"name": "_gc_macro_1_0"}` replaced the hidden chunk of a stored item with a visible name: the item vanished from `stash::get` and `stash::keys`, and its other chunks stayed behind as orphan hidden names. `formulas.deleteName` could remove chunks the same way, and `formulas.createFromSelection` with `replace` could replace one from a cell label. `stash::set` refused a clash with a visible name, but nothing guarded the other direction. Defining, renaming or deleting a name that `stash::item_key` recognises (`_gc_<key>_<n>` and legacy `_sc_<key>`) is now refused with an error that names `force: true`, which lets the call go ahead. Create from Selection lists such labels in `skipped` unless `force` is true. The params docs of the three commands say so. * Engine: queries take no copy of the undo history `execute` copied the document's undo and redo history on every call, so a panic could put it back: up to 100 entries per stack, each with a label and a selection. Queries paid for it too, although no query runs a command or changes the history, and front ends and agents run queries all the time. The copy is now skipped for queries (commands that neither journal nor make undo steps). A test runs every query, with empty and with typical parameters, and checks the history is unchanged, so a query that ever changes it fails there. Commands that can change the history, nested ones included, still take the copy: a nested command that panics is restored at its own level, and the outer command can carry on, so relying on the outermost copy would weaken that restore. * Engine: a document's maker says where its content came from `Trust` defaulted to `Local`, and `DocState::new` set it, so a document was trusted unless its maker remembered to mark it. Every current path that reads a file goes through `file.open`, which marks it `FromFile`, but a later way of building a document from bytes (recovery, templates, a new import) would have come out trusted by omission. `DocState::new` now takes the `Trust`, and `Trust` has no default. New workbooks and samples pass `Local`, `file.open` passes `FromFile`, a new window passes the trust of its workbook, and the tests that build documents from bytes pass `FromFile`. * Engine: the name commands refuse only names that hold GridCraft's data The guard refused any name of the stash's shape, so a visible name a person had defined, such as _gc_rate_0, could not be edited or deleted from Name Manager, which cannot pass force. It now refuses a name only when the workbook holds a hidden workbook-scope item under it; a visible name of the shape is the person's own, as the stash itself treats it. The test covers such a name. The query comment says what the copy skip relies on: a query runs nothing that changes the history. * UI: the toolbar's Undo and Redo follow the commands' own availability The ribbon enabled them from the history lengths alone, so while an undo group was open on the document (an action spanning several calls) a click ran edit.undo and got its refusal. The buttons now ask cmd::can_undo and cmd::can_redo, the undo list is empty while a group is open, and the two buttons carry a name and their enabled state for assistive technology. A UI test opens a group, clicks both and checks the history and their state. * Engine: the name commands use the stash's own rule for what holds its data The guard asked for a hidden name, but the stash reads a legacy _sc_<key> name whether it is hidden or not, so a visible one could be removed or replaced without force. stash::holds_item is the one rule (item_of), shared by the guard; the test covers a visible legacy name. * Docs: the panic guard's note says what happens to a group the command ended It keeps a step from the group's start to the restored workbook, so Undo still returns to the state before the group; the note said the history came back exactly.
2026-10-29 21:26:48 -06:00 · 2026-10-24 02:06:44 -04:00
parent b8771d51fb
commit 6ead1fb519
22 changed files with 2461 additions and 39 deletions
@@ -741,7 +741,7 @@ fn copy_impl(s: &mut Session, p: &Json, cut: bool) -> Result<Json> {
    // The HTML rendering is for the host clipboard (UI); it can reach 4 MB, so agents and
    // scripts get it only when they ask for it.
    let html = if p.get("html").and_then(Json::as_bool) == Some(true) { crate::io::range_html(&wb, sheet, range, &text) } else { None };
-    let clip = Clipboard { wb, sheet, range, cut, doc_uid: d.uid, text: text.clone(), areas, selected };
+    let clip = Clipboard { wb, sheet, range, cut, doc_uid: d.uid, text: text.clone(), areas, selected, trust: d.trust };
    s.clipboard = Some(clip);
    let mut result = json!({"range": range.a1(), "text": text});
    if let Some(html) = html {
@@ -1264,6 +1264,16 @@ fn paste_special(s: &mut Session, p: &Json) -> Result<Json> {
        *cx.sel = crate::Selection { active: at, anchor: at, ranges: vec![RangeRef::new(at, end)] };
        Ok(())
    })?;
    // Formulas and validation from an untrusted file leave the destination untrusted; plain values,
    // formats (cell styles and merged areas, no conditional formats), column widths and notes
    // carry nothing active. A linked paste writes a formula into every cell whatever `what` says,
    // except for column widths and notes, which write no cells at all.
    let passive =
        matches!(what, What::ColumnWidths | What::Comments) || (!link && matches!(what, What::Formats | What::Values | What::ValuesAndNumberFormats));
    if !same_doc && !passive {
        let d = s.doc_mut()?;
        d.trust = d.trust.receive(clip.trust);
    }
    if cut_move {
        s.clipboard = None;
    }
@@ -212,6 +212,15 @@ pub fn specs() -> Vec<CommandSpec> {
            trust_scripts
        ),
        cmd!("automate.deleteScript", "Delete Script", [], None, "{name}", has_doc, delete_script),
        cmd!(
            noundo "automate.stopAction",
            "Stop Action",
            [],
            None,
            "{} → {stopped: bool}: stops an action left running on the active workbook (an open undo group, such as a debugger's) and puts back the workbook and its undo history as they were when it began",
            has_doc,
            stop_action
        ),
        // Cell controls, themes, borders, styles
        cmd!(
            "insert.checkbox",
@@ -800,7 +809,7 @@ fn split(s: &mut Session, _: &Json) -> Result<Json> {
 fn new_window(s: &mut Session, _: &Json) -> Result<Json> {
    let d = s.doc()?.clone();
-    let mut copy = crate::DocState::new((*d.wb).clone(), d.path.clone(), format!("{}:2", d.display_title()));
+    let mut copy = crate::DocState::new((*d.wb).clone(), d.path.clone(), format!("{}:2", d.display_title()), d.trust);
    copy.selection = d.selection.clone();
    copy.scripts_trusted = d.scripts_trusted;
    let i = s.add_document(copy);
@@ -1087,6 +1096,13 @@ fn run_script(s: &mut Session, p: &Json) -> Result<Json> {
    Ok(json!({"ran": n}))
 }
 /// Automate › Stop Action: rolls back the undo groups open on the active workbook, so Undo and
 /// Redo work there again.
 fn stop_action(s: &mut Session, _: &Json) -> Result<Json> {
    let uid = s.doc()?.uid;
    Ok(json!({"stopped": s.abort_groups(uid)}))
 }
 fn delete_script(s: &mut Session, p: &Json) -> Result<Json> {
    let name = str_param(p, "name").ok_or_else(|| bad("automate.deleteScript", "missing `name`"))?.to_string();
    edit(s, |cx| {
@@ -34,7 +34,7 @@ fn new_workbook(s: &mut Session, p: &Json) -> Result<Json> {
        Some(name) => {
            let wb = crate::sample::build(name).ok_or_else(|| bad("file.new", format!("unknown sample `{name}`")))?;
            let title = crate::sample::title(name);
-            s.add_document(DocState::new(wb, None, title))
+            s.add_document(DocState::new(wb, None, title, crate::Trust::Local))
        }
        None => s.new_workbook(),
    };
@@ -83,7 +83,8 @@ fn open(s: &mut Session, p: &Json) -> Result<Json> {
    {
        s.close_document(0);
    }
-    let mut doc = DocState::new(wb, path, title);
+    // Someone else may have made the file: its active content asks before it runs.
    let mut doc = DocState::new(wb, path, title, crate::Trust::FromFile);
    if crate::io::FileKind::from_path(&name).is_none() && gridcraft_xlsx::sniff(&bytes) == gridcraft_xlsx::Format::Xlsx {
        doc.content_kind = Some(crate::io::FileKind::Xlsx);
    }
@@ -1,7 +1,7 @@
 //! Formulas tab: AutoSum, Insert Function, names, auditing, calculation.
 use gridcraft_core::{CellError, CellRef, RangeRef, Value};
-use gridcraft_model::{CalcMode, DefinedName, Formula};
+use gridcraft_model::{CalcMode, DefinedName, Formula, Workbook};
 use serde_json::{Value as Json, json};
 use super::*;
@@ -32,18 +32,26 @@ pub fn specs() -> Vec<CommandSpec> {
            "Define Name…",
            ["Formulas", "Defined Names"],
            None,
-            "{name, refersTo?: \"=Sheet1!$A$1:$A$10\" (default: the selection), scope?: \"Workbook\"|sheet name, comment?, oldName?, oldScope?} (oldName: edit that name (Name Manager › Edit); a new name also renames it in formulas)",
+            "{name, refersTo?: \"=Sheet1!$A$1:$A$10\" (default: the selection), scope?: \"Workbook\"|sheet name, comment?, oldName?, oldScope?, force?: bool} (oldName: edit that name (Name Manager › Edit); a new name also renames it in formulas; a hidden name GridCraft keeps its own data in, `_gc_<key>_<n>` or `_sc_<key>`, is refused unless force is true)",
            has_doc,
            define_name
        ),
-        cmd!("formulas.deleteName", "Delete Name", [], None, "{name, scope?: \"Workbook\"|sheet name (default: every scope)}", has_doc, delete_name),
+        cmd!(
            "formulas.deleteName",
            "Delete Name",
            [],
            None,
            "{name, scope?: \"Workbook\"|sheet name (default: every scope), force?: bool} (a hidden name GridCraft keeps its own data in, `_gc_<key>_<n>` or `_sc_<key>`, is refused unless force is true)",
            has_doc,
            delete_name
        ),
        cmd!(query "formulas.nameManager", "Name Manager", ["Formulas", "Defined Names"], Some("Cmd+F3"), "{} → names with values", has_doc, name_manager),
        cmd!(
            "formulas.createFromSelection",
            "Create from Selection",
            ["Formulas", "Defined Names"],
            Some("Cmd+Shift+F3"),
-            "{range?, top?: true, left?: false, bottom?: false, right?: false, replace?: false (existing names are kept and listed in `skipped`)}",
+            "{range?, top?: true, left?: false, bottom?: false, right?: false, replace?: false (existing names are kept and listed in `skipped`), force?: false (labels of the shape GridCraft keeps its own data in, `_gc_<key>_<n>` and `_sc_<key>`, are listed in `skipped` unless force is true)}",
            has_doc,
            create_from_selection
        ),
@@ -268,6 +276,9 @@ fn define_name(s: &mut Session, p: &Json) -> Result<Json> {
    if !valid_name(&name) {
        return Err(EngineError::Other("The name that you entered is not valid.".into()));
    }
    for n in [Some(name.as_str()), str_param(p, "oldName")].into_iter().flatten() {
        refuse_stash_name(&s.doc()?.wb, p, n)?;
    }
    let d = s.doc()?;
    let scope = match str_param(p, "scope") {
        None | Some("Workbook") => None,
@@ -374,8 +385,29 @@ fn rename_name_in_formulas(wb: &mut gridcraft_model::Workbook, old: &str, old_sc
    }
 }
 /// Refuses a name of the shape GridCraft keeps its own workbook data in ([`super::stash`]):
 /// defining, renaming or deleting one would replace or remove part of an item (a stored macro,
 /// script or view) and leave the rest behind. `force: true` lets the call go ahead.
 /// Whether `name` is one the workbook holds GridCraft's own data in: a hidden workbook-scope
 /// name of an item's shape. A visible name of that shape is the person's own (see `stash`), and
 /// the name commands may change it.
 fn holds_gridcraft_data(wb: &Workbook, name: &str) -> bool {
    // The stash's own rule, so the two never disagree: a legacy `_sc_` item is read visible or not.
    stash::holds_item(wb, name)
 }
 fn refuse_stash_name(wb: &Workbook, p: &Json, name: &str) -> Result<()> {
    if holds_gridcraft_data(wb, name) && !bool_param(p, "force").unwrap_or(false) {
        return Err(EngineError::Other(format!(
            "'{name}' is a name GridCraft keeps its own data in (stored macros, scripts or views). Pass `force: true` to change it anyway."
        )));
    }
    Ok(())
 }
 fn delete_name(s: &mut Session, p: &Json) -> Result<Json> {
    let name = str_param(p, "name").ok_or_else(|| bad("formulas.deleteName", "missing `name`"))?.to_string();
    refuse_stash_name(&s.doc()?.wb, p, &name)?;
    let scope = match str_param(p, "scope") {
        None => None,
        Some("Workbook") => Some(None),
@@ -461,7 +493,11 @@ fn create_from_selection(s: &mut Session, p: &Json) -> Result<Json> {
    // Excel asks before replacing an existing name; here it's kept unless `replace` is set, and
    // reported.
    let exists = |n: &str| d.wb.names.iter().any(|x| x.name.eq_ignore_ascii_case(n) && x.scope.is_none());
-    let (made, skipped): (Vec<_>, Vec<_>) = made.into_iter().partition(|(n, _)| replace || !exists(n));
+    // A label that names one of GridCraft's own hidden data names would replace part of an item
    // (see `refuse_stash_name`).
    let force = bool_param(p, "force").unwrap_or(false);
    let ours = |n: &str| !force && holds_gridcraft_data(&d.wb, n);
    let (made, skipped): (Vec<_>, Vec<_>) = made.into_iter().partition(|(n, _)| !ours(n) && (replace || !exists(n)));
    let skipped: Vec<String> = skipped.into_iter().map(|(n, _)| n).collect();
    let n = made.len();
    edit(s, |cx| {
@@ -742,6 +778,57 @@ mod tests {
        assert_eq!(r["refersTo"], "=Sheet1!$A$1");
    }
    #[test]
    fn the_name_commands_leave_gridcraft_data_alone() {
        // Defining, renaming or deleting a name of a stored item's shape would replace or remove
        // one of its chunks and leave the rest behind: refused unless `force` is true.
        let mut s = Session::new();
        s.new_workbook();
        let wb = std::sync::Arc::make_mut(&mut s.doc_mut().unwrap().wb);
        let text = "m".repeat(9_000);
        stash::set(wb, "macro_1", &text).unwrap();
        wb.names.push(DefinedName { name: "_sc_watch".into(), scope: None, formula: "\"[]\"".into(), comment: String::new(), hidden: true });
        // A legacy item is read whether or not it is hidden, so a visible one is data too.
        wb.names.push(DefinedName { name: "_sc_old".into(), scope: None, formula: "\"[]\"".into(), comment: String::new(), hidden: false });
        let names = |s: &Session| s.doc().unwrap().wb.names.clone();
        let before = names(&s);
        assert!(before.len() >= 3, "the item takes two chunks");
        for params in [
            json!({"name": "_gc_macro_1_0", "refersTo": "=1"}),
            json!({"name": "_SC_Watch", "refersTo": "=1"}),
            json!({"name": "Mine", "refersTo": "=1", "oldName": "_gc_macro_1_1"}),
            json!({"name": "_gc_macro_1_0", "refersTo": "=1", "force": false}),
            json!({"name": "Mine2", "refersTo": "=1", "oldName": "_SC_old"}),
        ] {
            let err = s.execute("formulas.defineName", params.clone()).unwrap_err().to_string();
            assert!(err.contains("force"), "{params}: {err}");
        }
        for name in ["_gc_macro_1_1", "_sc_watch", "_sc_old"] {
            let err = s.execute("formulas.deleteName", json!({"name": name})).unwrap_err().to_string();
            assert!(err.contains("force"), "{name}: {err}");
        }
        s.execute("range.setValues", json!({"range": "A1:B2", "values": [["_gc_macro_1_0", "Rate"], [1, 2]]})).unwrap();
        let r = s.execute("formulas.createFromSelection", json!({"range": "A1:B2", "top": true, "replace": true})).unwrap();
        assert_eq!((r["created"].clone(), r["skipped"].clone()), (json!(1), json!(["_gc_macro_1_0"])));
        let after = names(&s);
        assert_eq!(after.iter().filter(|n| n.name != "Rate").cloned().collect::<Vec<_>>(), before);
        assert_eq!(stash::get(&s.doc().unwrap().wb, "macro_1").as_deref(), Some(text.as_str()));
        // A visible name of the shape is the person's own (the stash never reads it): the name
        // commands change and remove it without `force`, as Name Manager cannot pass one.
        let own = DefinedName { name: "_gc_rate_0".into(), scope: None, formula: "=1".into(), comment: String::new(), hidden: false };
        std::sync::Arc::make_mut(&mut s.doc_mut().unwrap().wb).names.push(own.clone());
        s.execute("formulas.defineName", json!({"name": "Rate0", "refersTo": "=2", "oldName": "_gc_rate_0"})).unwrap();
        s.execute("formulas.deleteName", json!({"name": "Rate0"})).unwrap();
        std::sync::Arc::make_mut(&mut s.doc_mut().unwrap().wb).names.push(own);
        s.execute("formulas.deleteName", json!({"name": "_gc_rate_0"})).unwrap();
        assert_eq!(stash::get(&s.doc().unwrap().wb, "macro_1").as_deref(), Some(text.as_str()), "the hidden item is untouched");
        // Ordinary names and forced calls go ahead.
        s.execute("formulas.deleteName", json!({"name": "Rate"})).unwrap();
        s.execute("formulas.defineName", json!({"name": "_gc_macro_1_1", "refersTo": "=1", "force": true})).unwrap();
        s.execute("formulas.deleteName", json!({"name": "_gc_macro_1_1", "force": true})).unwrap();
        assert!(!names(&s).iter().any(|n| n.name == "_gc_macro_1_1"));
    }
    #[test]
    fn arabic_defined_names_count_characters_not_bytes() {
        let mut s = Session::new();
@@ -7,11 +7,11 @@ use super::*;
 pub fn specs() -> Vec<CommandSpec> {
    vec![
-        cmd!(query "document.inspect", "Inspect Workbook", [], None, "{} → sheets, selection, names, tables, charts, dirty, history", has_doc, inspect),
+        cmd!(query "document.inspect", "Inspect Workbook", [], None, "{} → sheets, selection, names, tables, charts, dirty, trust (local|fromFile), history", has_doc, inspect),
        cmd!(query "sheet.read", "Read Range", [], None, "{range?: \"A1:D10\" (default: used range), sheet?, formulas?: bool, formatted?: bool} → rows of values", has_doc, read),
        cmd!(query "cell.get", "Get Cell", [], None, "{cell?, sheet?} → value, formula, display text, style, comment, link", has_doc, cell_get),
        cmd!(query "selection.stats", "Selection Statistics", [], None, "{} → count, sum, average, min, max", has_doc, sel_stats),
-        cmd!(query "history.list", "Undo History", [], None, "{} → undo/redo labels", has_doc, history),
+        cmd!(query "history.list", "Undo History", [], None, "{} → undo/redo labels, grouping (an undo group is open)", has_doc, history),
        cmd!(query "app.commands", "List Commands", [], None, "{search?} → ids, labels, params", always, list_commands),
    ]
 }
@@ -63,6 +63,7 @@ fn inspect(s: &mut Session, _: &Json) -> Result<Json> {
        "title": d.display_title(),
        "path": d.path,
        "dirty": d.is_dirty(),
        "trust": d.trust,
        "activeSheet": wb.active_sheet,
        "sheets": sheets,
        "selection": d.selection.a1(),
@@ -148,9 +149,11 @@ fn sel_stats(s: &mut Session, _: &Json) -> Result<Json> {
 fn history(s: &mut Session, _: &Json) -> Result<Json> {
    let d = s.doc()?;
-    Ok(
+    Ok(json!({
-        json!({"undo": d.undo.iter().rev().map(|e| e.label.clone()).collect::<Vec<_>>(), "redo": d.redo.iter().rev().map(|e| e.label.clone()).collect::<Vec<_>>()}),
+        "undo": d.undo.iter().rev().map(|e| e.label.clone()).collect::<Vec<_>>(),
-    )
+        "redo": d.redo.iter().rev().map(|e| e.label.clone()).collect::<Vec<_>>(),
        "grouping": s.in_group(d.uid),
    }))
 }
 fn list_commands(s: &mut Session, p: &Json) -> Result<Json> {
@@ -19,6 +19,7 @@ pub mod sheet;
 pub mod slicer;
 pub mod solver;
 pub mod spelling;
 pub mod stash;
 pub mod view;
 pub mod whatif;
@@ -96,12 +97,19 @@ pub fn has_doc(s: &Session) -> std::result::Result<(), String> {
 }
 pub fn can_undo(s: &Session) -> std::result::Result<(), String> {
    has_doc(s)?;
    not_grouping(s)?;
    if s.active().is_some_and(|d| !d.undo.is_empty()) { Ok(()) } else { Err("nothing to undo".into()) }
 }
 pub fn can_redo(s: &Session) -> std::result::Result<(), String> {
    has_doc(s)?;
    not_grouping(s)?;
    if s.active().is_some_and(|d| !d.redo.is_empty()) { Ok(()) } else { Err("nothing to redo".into()) }
 }
 /// Undo and Redo wait while an undo group is open on the active document (an action that spans
 /// several calls is still running).
 fn not_grouping(s: &Session) -> std::result::Result<(), String> {
    if s.active().is_some_and(|d| s.in_group(d.uid)) { Err("finish or stop the running action first (automate.stopAction)".into()) } else { Ok(()) }
 }
 pub fn has_clipboard(s: &Session) -> std::result::Result<(), String> {
    has_doc(s)?;
    if s.clipboard.is_some() { Ok(()) } else { Err("the clipboard is empty".into()) }
@@ -179,6 +187,23 @@ pub fn register_test_command(id: &'static str, run: Run) {
    test_commands().push(spec);
 }
 /// Test-only: an undoable command, to exercise how `execute` records its step.
 #[cfg(test)]
 pub(crate) fn register_undoable_test_command(id: &'static str, run: Run) {
    let spec: &'static CommandSpec = Box::leak(Box::new(CommandSpec {
        id,
        label: id,
        menu: &[],
        shortcut: None,
        params: "",
        enabled: |_| Ok(()),
        run,
        journal: false,
        undoable: true,
    }));
    test_commands().push(spec);
 }
 fn test_commands() -> std::sync::MutexGuard<'static, Vec<&'static CommandSpec>> {
    #[allow(clippy::unwrap_used)] // a poisoned test registry has no meaningful recovery
    match TEST_COMMANDS.lock() {
@@ -586,11 +586,15 @@ fn insert_copied_cells(s: &mut Session, p: &Json) -> Result<Json> {
    }
    let revision = d.revision;
    let before = (d.wb.clone(), d.selection.clone());
    // Inside an undo group the nested steps add no undo entries of their own.
    let nested_entries = !s.in_group(d.uid);
    let result = insert_copied_steps(s, &clip, sheet, at, shift, cut);
    let d = s.doc_mut()?;
    // The nested steps collapse into this command's single undo step.
-    for _ in 0..d.revision.saturating_sub(revision) {
+    if nested_entries {
-        d.undo.pop();
+        for _ in 0..d.revision.saturating_sub(revision) {
            d.undo.pop();
        }
    }
    match result {
        Ok((final_range, out)) => {
@@ -0,0 +1,606 @@
 //! GridCraft data kept in hidden workbook-scope defined names, so that it travels inside the xlsx
 //! file.
 //!
 //! An item `key` is stored as names `_gc_<key>_0`, `_gc_<key>_1`, …, each a formula of string
 //! literals joined with `&`: `"…"&"…"`. Excel limits a string literal to 255 characters and a
 //! formula to 8,192, so a long value is split over as many names as it needs and the file stays
 //! one that Excel accepts. Older items (custom views, scripts, the watch list and scenarios) keep
 //! one name each, `_sc_<key>`; reading accepts that form as well, so those items can move to this
 //! format later, and a write of the same key replaces it.
 //!
 //! XML can't carry every character (controls other than tab, line feed and carriage return, and
 //! U+FFFE and U+FFFF), and the xlsx writer drops those. In `_gc_` items each of them, and the
 //! marker itself, is written as [`ESCAPE`] followed by its code as four upper-case hex digits
 //! (`U+0001` becomes `\u{FDD0}0001`), and reading turns them back. The marker is a Unicode
 //! noncharacter, which XML carries but real text does not use, so the escape costs nothing on
 //! ordinary text. Legacy `_sc_` items are read as they are.
 use std::collections::BTreeMap;
 use std::fmt::Write as _;
 use gridcraft_model::{DefinedName, Workbook};
 use serde_json::Value as Json;
 use crate::{EngineError, Result};
 const PREFIX: &str = "_gc_";
 const LEGACY_PREFIX: &str = "_sc_";
 /// Characters (UTF-16 units, as Excel counts them) in one string literal.
 const LITERAL_UNITS: usize = 255;
 /// Characters in one name's formula.
 const FORMULA_UNITS: usize = 8_192;
 /// The longest key: `_gc_<key>_<k>` stays well inside Excel's 255-character names.
 const MAX_KEY: usize = 200;
 /// The longest item: 4,194,304 characters.
 pub const MAX_ITEM_CHARS: usize = 4 * 1024 * 1024;
 /// The most bytes the stored (escaped) form of an item can take: an escaped one-byte character
 /// takes seven (the three-byte marker and four digits).
 const MAX_STORED_BYTES: usize = MAX_ITEM_CHARS * 7;
 /// Starts an escaped character in a `_gc_` item: U+FDD0, a noncharacter.
 pub const ESCAPE: char = '\u{FDD0}';
 /// The most items [`items`] and [`keys`] return: the first this many keys in sorted order. A
 /// file can carry any number of hidden names; the rest are not listed.
 pub const MAX_ITEMS: usize = 10_000;
 /// The names that hold one item: its `_gc_` chunks by number (the first of each number) and its
 /// legacy `_sc_` name.
 #[derive(Default)]
 struct Parts<'a> {
    chunks: BTreeMap<u64, &'a str>,
    legacy: Option<&'a str>,
 }
 impl<'a> Parts<'a> {
    fn add(&mut self, chunk: Option<u64>, formula: &'a str) {
        match chunk {
            Some(i) => {
                self.chunks.entry(i).or_insert(formula);
            }
            None => self.legacy = self.legacy.or(Some(formula)),
        }
    }
    /// Whether the names make an item: a later chunk on its own does not.
    fn is_item(&self) -> bool {
        self.chunks.contains_key(&0) || self.legacy.is_some()
    }
 }
 #[cfg(test)]
 thread_local! {
    /// Names [`group`] has looked at on this thread, so a test can bound the work of a listing.
    static NAME_VISITS: std::cell::Cell<usize> = const { std::cell::Cell::new(0) };
 }
 /// The workbook's items whose lower-cased key starts with `prefix` (lower-cased), with the names
 /// that hold them, in one pass over the names.
 fn group<'a>(wb: &'a Workbook, prefix: &str) -> BTreeMap<String, Parts<'a>> {
    let prefix = prefix.to_ascii_lowercase();
    let mut items: BTreeMap<String, Parts<'a>> = BTreeMap::new();
    for n in wb.names.iter() {
        #[cfg(test)]
        NAME_VISITS.with(|v| v.set(v.get().saturating_add(1)));
        let Some((k, chunk)) = item_of(n) else { continue };
        let k = k.to_ascii_lowercase();
        if k.starts_with(&prefix) {
            items.entry(k).or_default().add(chunk, &n.formula);
        }
    }
    items
 }
 /// The item text stored under `key`, or `None` when there is none (or it is over the size limit).
 pub fn get(wb: &Workbook, key: &str) -> Option<String> {
    let mut parts = Parts::default();
    for n in wb.names.iter() {
        if let Some((k, chunk)) = item_of(n)
            && k.eq_ignore_ascii_case(key)
        {
            parts.add(chunk, &n.formula);
        }
    }
    assemble(&parts)
 }
 /// The items whose key starts with `prefix` (`"macro_"`), by lower-cased key, read in one pass
 /// over the names: the first [`MAX_ITEMS`] of [`keys`], without those over the size limit.
 pub fn items(wb: &Workbook, prefix: &str) -> BTreeMap<String, String> {
    group(wb, prefix)
        .into_iter()
        .filter(|(_, parts)| parts.is_item())
        .take(MAX_ITEMS)
        .filter_map(|(k, parts)| assemble(&parts).map(|text| (k, text)))
        .collect()
 }
 /// The text of the item held by `parts`, as [`get`] reads it.
 fn assemble(parts: &Parts) -> Option<String> {
    let chunks = &parts.chunks;
    let mut out = String::new();
    if !chunks.contains_key(&0) {
        out = string_literals(parts.legacy?);
    } else {
        // Chunks run 0, 1, 2, …; anything after a gap isn't part of the item.
        for (want, (i, f)) in chunks.iter().enumerate() {
            if *i != want as u64 {
                break;
            }
            out.push_str(&string_literals(f));
            if out.len() > MAX_STORED_BYTES {
                return None;
            }
        }
        out = unescape(&out);
    }
    (out.chars().count() <= MAX_ITEM_CHARS).then_some(out)
 }
 /// Whether `c` is stored escaped: XML can't carry it, or it is the marker.
 fn needs_escape(c: char) -> bool {
    c == ESCAPE || !matches!(c, '\t' | '\n' | '\r' | '\u{20}'..='\u{D7FF}' | '\u{E000}'..='\u{FFFD}' | '\u{10000}'..='\u{10FFFF}')
 }
 /// Turns [`ESCAPE`] and four hex digits back into the character. A marker not followed by four
 /// hex digits naming a character (a hand-made name) stays as it is.
 fn unescape(s: &str) -> String {
    if !s.contains(ESCAPE) {
        return s.to_string();
    }
    let mut out = String::with_capacity(s.len());
    let mut rest = s;
    while let Some(at) = rest.find(ESCAPE) {
        out.push_str(rest.get(..at).unwrap_or(""));
        let after = rest.get(at + ESCAPE.len_utf8()..).unwrap_or("");
        let code = after.get(..4).filter(|h| h.bytes().all(|b| b.is_ascii_hexdigit())).and_then(|h| u32::from_str_radix(h, 16).ok());
        match code.and_then(char::from_u32) {
            Some(c) => {
                out.push(c);
                rest = after.get(4..).unwrap_or("");
            }
            None => {
                out.push(ESCAPE);
                rest = after;
            }
        }
    }
    out.push_str(rest);
    out
 }
 /// Stores `text` under `key`, replacing what was there (in either format). Empty text removes it.
 pub fn set(wb: &mut Workbook, key: &str, text: &str) -> Result<()> {
    check_key(key)?;
    if text.chars().count() > MAX_ITEM_CHARS {
        return Err(EngineError::Other(format!("The data is too large to keep in the workbook ({} MB at most).", MAX_ITEM_CHARS / (1024 * 1024))));
    }
    let formulas = chunk_formulas(text);
    // A visible name of the item's shape is someone's own (see `item_of`); a hidden name beside
    // it with the same name would be the one an xlsx file drops. Refuse before changing anything,
    // in one pass over the names (a file can carry many thousands).
    let chunks = formulas.len() as u64;
    let taken = |n: &&DefinedName| {
        n.scope.is_none() && !n.hidden && parse_name(&n.name).is_some_and(|(k, i)| k.eq_ignore_ascii_case(key) && i.is_some_and(|i| i < chunks))
    };
    if let Some(n) = wb.names.iter().find(taken) {
        return Err(EngineError::Other(format!(
            "The workbook has a defined name '{}', which GridCraft needs for its own data. Rename it first.",
            n.name
        )));
    }
    remove(wb, key);
    for (i, formula) in formulas.into_iter().enumerate() {
        wb.names.push(DefinedName { name: format!("{PREFIX}{key}_{i}"), scope: None, formula, comment: "GridCraft data".into(), hidden: true });
    }
    Ok(())
 }
 /// Removes the item stored under `key`.
 pub fn remove(wb: &mut Workbook, key: &str) {
    wb.names.retain(|n| !item_of(n).is_some_and(|(k, _)| k.eq_ignore_ascii_case(key)));
 }
 /// The item under `key` as JSON (`None` when missing or not JSON).
 pub fn get_json(wb: &Workbook, key: &str) -> Option<Json> {
    serde_json::from_str(&get(wb, key)?).ok()
 }
 pub fn set_json(wb: &mut Workbook, key: &str, v: &Json) -> Result<()> {
    set(wb, key, &v.to_string())
 }
 /// The keys of the items stored in the workbook that start with `prefix` (`"macro_"`), sorted
 /// and lower-cased: the first [`MAX_ITEMS`] of them. To read them all, [`items`] takes one pass
 /// where a [`get`] per key would take one each.
 pub fn keys(wb: &Workbook, prefix: &str) -> Vec<String> {
    group(wb, prefix).into_iter().filter(|(_, parts)| parts.is_item()).map(|(k, _)| k).take(MAX_ITEMS).collect()
 }
 /// Whether the workbook holds an item under `name` (compared without case): a hidden workbook-scope
 /// `_gc_<key>_<k>` name, or a workbook-scope legacy `_sc_<key>` name, which is read whether or not
 /// it is hidden. A visible `_gc_` name is the person's own.
 pub fn holds_item(wb: &Workbook, name: &str) -> bool {
    wb.names.iter().any(|n| n.name.eq_ignore_ascii_case(name) && item_of(n).is_some())
 }
 /// The item a hidden name belongs to, lower-cased: `_gc_<key>_<k>` and `_sc_<key>` give `<key>`.
 pub fn item_key(name: &str) -> Option<String> {
    parse_name(name).map(|(k, _)| k.to_ascii_lowercase())
 }
 /// The item a name holds a part of: a hidden workbook-scope `_gc_<key>_<k>` name, or a legacy
 /// `_sc_<key>` one. A visible name of the `_gc_` shape is someone's own name, not an item: it is
 /// neither read, nor listed, nor removed on write.
 fn item_of(n: &DefinedName) -> Option<(&str, Option<u64>)> {
    if n.scope.is_some() {
        return None;
    }
    parse_name(&n.name).filter(|(_, chunk)| chunk.is_none() || n.hidden)
 }
 /// `_gc_<key>_<k>` → (`key`, `Some(k)`); `_sc_<key>` → (`key`, `None`).
 fn parse_name(name: &str) -> Option<(&str, Option<u64>)> {
    if let Some(rest) = strip_prefix_ci(name, PREFIX) {
        let (key, k) = rest.rsplit_once('_')?;
        // Only the chunk number as `set` writes it: `_gc_watch_00` is someone else's name, not
        // chunk 0 under another spelling, so it is neither read nor in the way of `_gc_watch_0`.
        let canonical = !k.is_empty() && k.len() <= 9 && k.bytes().all(|b| b.is_ascii_digit()) && (k == "0" || !k.starts_with('0'));
        if key.is_empty() || !canonical {
            return None;
        }
        return k.parse().ok().map(|i| (key, Some(i)));
    }
    strip_prefix_ci(name, LEGACY_PREFIX).filter(|k| !k.is_empty()).map(|k| (k, None))
 }
 fn strip_prefix_ci<'a>(s: &'a str, prefix: &str) -> Option<&'a str> {
    let head = s.get(..prefix.len())?;
    head.eq_ignore_ascii_case(prefix).then(|| s.get(prefix.len()..)).flatten()
 }
 fn check_key(key: &str) -> Result<()> {
    let ok = !key.is_empty() && key.len() <= MAX_KEY && key.bytes().all(|b| b.is_ascii_alphanumeric() || b == b'_' || b == b'.');
    if ok { Ok(()) } else { Err(EngineError::Other(format!("`{key}` can't name workbook data: use letters, digits, `_` and `.`"))) }
 }
 /// `text` as name formulas: string literals of at most 255 characters joined with `&`, each formula
 /// at most 8,192 characters, with the characters XML can't carry escaped (see [`ESCAPE`]).
 /// Concatenating [`string_literals`] of each and turning the escapes back gives `text` back.
 pub fn chunk_formulas(text: &str) -> Vec<String> {
    let mut formulas = Vec::new();
    let (mut formula, mut units) = (String::new(), 0usize);
    let (mut literal, mut lit_units) = (String::from("\""), 0usize);
    let mut flush_literal = |literal: &mut String, lit_units: &mut usize, formula: &mut String, units: &mut usize| {
        literal.push('"');
        let cost = literal.encode_utf16().count() + usize::from(!formula.is_empty());
        if *units + cost > FORMULA_UNITS && !formula.is_empty() {
            formulas.push(std::mem::take(formula));
            *units = 0;
        }
        if !formula.is_empty() {
            formula.push('&');
            *units += 1;
        }
        *units += literal.encode_utf16().count();
        formula.push_str(literal);
        *literal = String::from("\"");
        *lit_units = 0;
    };
    for ch in text.chars() {
        // An escaped character is the marker and four digits, kept in one literal.
        let escaped = needs_escape(ch);
        let cost = if escaped { ESCAPE.len_utf16() + 4 } else { ch.len_utf16() };
        if lit_units + cost > LITERAL_UNITS {
            flush_literal(&mut literal, &mut lit_units, &mut formula, &mut units);
        }
        lit_units += cost;
        if escaped {
            literal.push(ESCAPE);
            let _ = write!(literal, "{:04X}", u32::from(ch));
        } else {
            if ch == '"' {
                literal.push('"');
            }
            literal.push(ch);
        }
    }
    if lit_units > 0 {
        flush_literal(&mut literal, &mut lit_units, &mut formula, &mut units);
    }
    if !formula.is_empty() {
        formulas.push(formula);
    }
    formulas
 }
 /// Concatenates the string literals of a `"a"&"b""c"` formula (anything outside them is ignored).
 pub fn string_literals(f: &str) -> String {
    let mut out = String::new();
    let mut it = f.chars().peekable();
    let mut in_str = false;
    while let Some(c) = it.next() {
        if !in_str {
            if c == '"' {
                in_str = true;
            }
            continue;
        }
        if c == '"' {
            if it.peek() == Some(&'"') {
                it.next();
                out.push('"');
            } else {
                in_str = false;
            }
        } else {
            out.push(c);
        }
    }
    out
 }
 #[cfg(test)]
 mod tests {
    use super::*;
    fn name(n: &str, formula: &str) -> DefinedName {
        DefinedName { name: n.into(), scope: None, formula: formula.into(), comment: String::new(), hidden: true }
    }
    fn excel_limits_hold(wb: &Workbook) {
        for n in &wb.names {
            assert!(n.formula.encode_utf16().count() <= FORMULA_UNITS, "{} is {} long", n.name, n.formula.len());
            // Every literal (quotes undoubled) is at most 255 characters.
            for lit in n.formula.split("\"&\"") {
                let inner = lit.trim_start_matches('"').trim_end_matches('"').replace("\"\"", "\"");
                assert!(inner.encode_utf16().count() <= LITERAL_UNITS, "{}", inner.len());
            }
        }
    }
    #[test]
    fn long_values_split_over_names_and_come_back() {
        let mut wb = Workbook::new();
        // Quotes double when written; characters outside the BMP count twice.
        let text: String = (0..30_000).map(|i| ['a', '"', 'é', '\u{1D11E}', '&', '\n'][i % 6]).collect();
        set(&mut wb, "big", &text).unwrap();
        let names: Vec<&str> = wb.names.iter().map(|n| n.name.as_str()).collect();
        assert!(names.len() > 5, "{names:?}");
        assert_eq!(names[0], "_gc_big_0");
        assert!(wb.names.iter().all(|n| n.hidden && n.scope.is_none()));
        excel_limits_hold(&wb);
        assert_eq!(get(&wb, "big").as_deref(), Some(text.as_str()));
        assert_eq!(get(&wb, "BIG").as_deref(), Some(text.as_str()), "names are case-insensitive");
        // Shorter again: the extra chunks go.
        set(&mut wb, "big", "short").unwrap();
        assert_eq!(wb.names.len(), 1);
        assert_eq!(wb.names[0].formula, "\"short\"");
        set(&mut wb, "big", "").unwrap();
        assert!(wb.names.is_empty());
        assert_eq!(get(&wb, "big"), None);
    }
    #[test]
    fn chunks_and_literals_respect_the_boundaries() {
        for len in [0, 1, 254, 255, 256, 8_000, 8_192, 8_193, 20_000] {
            let text = "q".repeat(len);
            let fs = chunk_formulas(&text);
            assert_eq!(fs.iter().map(|f| string_literals(f)).collect::<String>(), text, "{len}");
            assert!(fs.iter().all(|f| f.len() <= FORMULA_UNITS), "{len}");
        }
        // All quotes: each literal doubles in the formula.
        let text = "\"".repeat(9_000);
        let fs = chunk_formulas(&text);
        assert_eq!(fs.iter().map(|f| string_literals(f)).collect::<String>(), text);
        assert!(fs.iter().all(|f| f.len() <= FORMULA_UNITS));
    }
    #[test]
    fn the_old_single_name_still_reads_and_is_replaced_on_write() {
        let mut wb = Workbook::new();
        wb.names.push(name("_sc_scripts", "\"{\"\"A\"\":[1]}\""));
        wb.names.push(name("_sc_scenarios", "\"[1,\"&\"2]\""));
        assert_eq!(get_json(&wb, "scripts"), Some(serde_json::json!({"A": [1]})));
        assert_eq!(get_json(&wb, "scenarios"), Some(serde_json::json!([1, 2])));
        set_json(&mut wb, "scripts", &serde_json::json!({"B": []})).unwrap();
        let names: Vec<&str> = wb.names.iter().map(|n| n.name.as_str()).collect();
        assert_eq!(names, ["_sc_scenarios", "_gc_scripts_0"]);
        assert_eq!(get_json(&wb, "scripts"), Some(serde_json::json!({"B": []})));
    }
    #[test]
    fn hostile_names_read_safely() {
        let mut wb = Workbook::new();
        // A gap: chunk 2 without chunk 1.
        wb.names.push(name("_gc_gap_0", "\"a\""));
        wb.names.push(name("_gc_gap_2", "\"c\""));
        assert_eq!(get(&wb, "gap").as_deref(), Some("a"));
        // Only a later chunk: no item, not listed, and the legacy name is still read.
        wb.names.push(name("_gc_orphan_2", "\"c\""));
        assert_eq!(get(&wb, "orphan"), None);
        assert_eq!(keys(&wb, "orphan"), Vec::<String>::new());
        wb.names.push(name("_sc_orphan", "\"old\""));
        assert_eq!(get(&wb, "orphan").as_deref(), Some("old"));
        assert_eq!(keys(&wb, "orphan"), ["orphan"]);
        // Chunks out of order, a duplicate, junk around the literals, an unterminated literal.
        wb.names.push(name("_gc_mix_1", "\"b\"&A1&"));
        wb.names.push(name("_gc_mix_0", "SUM(\"a\")"));
        wb.names.push(name("_gc_mix_0", "\"ignored\""));
        wb.names.push(name("_gc_mix_2", "\"c"));
        assert_eq!(get(&wb, "mix").as_deref(), Some("abc"));
        // Names that only look like chunks.
        for odd in ["_gc_", "_gc__0", "_gc_x_", "_gc_x_-1", "_gc_x_99999999999999999999", "_sc_", "_gcx_0"] {
            wb.names.push(name(odd, "\"zzz\""));
        }
        assert_eq!(get(&wb, "x"), None);
        assert_eq!(get(&wb, ""), None);
        // Not JSON, or JSON nested deeper than the parser allows.
        wb.names.push(name("_gc_notjson_0", "\"{\""));
        assert_eq!(get_json(&wb, "notjson"), None);
        let deep = format!("\"{}{}\"", "[".repeat(10_000), "]".repeat(10_000));
        wb.names.push(name("_gc_deep_0", &deep));
        assert_eq!(get_json(&wb, "deep"), None);
        // Sheet-scoped names are someone else's.
        wb.names.push(DefinedName { scope: Some(0), ..name("_gc_scoped_0", "\"s\"") });
        assert_eq!(get(&wb, "scoped"), None);
        // Bad keys are refused.
        for bad in ["", "has space", "quote\"", "a/b", &"k".repeat(201)] {
            assert!(set(&mut wb, bad, "v").is_err(), "{bad}");
        }
        assert!(set(&mut wb, "big", &"x".repeat(MAX_ITEM_CHARS + 1)).is_err());
    }
    #[test]
    fn oversized_items_are_not_read() {
        let mut wb = Workbook::new();
        let chunk = format!("\"{}\"", "x".repeat(250));
        let big = vec![chunk.as_str(); 32].join("&");
        for i in 0..(MAX_ITEM_CHARS / 8_000 + 2) {
            wb.names.push(name(&format!("_gc_huge_{i}"), &big));
        }
        assert_eq!(get(&wb, "huge"), None);
    }
    #[test]
    fn a_visible_name_of_the_item_shape_is_not_an_item() {
        // Someone's own visible `_gc_watch_0` is not storage: it is not read or listed, and
        // writing or removing the item leaves it alone.
        let mut wb = Workbook::new();
        let own = DefinedName { hidden: false, ..name("_gc_watch_0", "\"mine\"") };
        wb.names.push(own.clone());
        assert_eq!(get(&wb, "watch"), None);
        assert!(keys(&wb, "").is_empty());
        // Writing the item would put a hidden name of the same name beside it, and an xlsx file
        // keeps only one of them: refused, with the names as they were.
        let err = set(&mut wb, "watch", "theirs").unwrap_err().to_string();
        assert!(err.contains("_gc_watch_0"), "{err}");
        assert_eq!(wb.names, vec![own.clone()]);
        assert_eq!(get(&wb, "watch"), None);
        set(&mut wb, "other", "theirs").unwrap();
        assert_eq!(get(&wb, "other").as_deref(), Some("theirs"));
        remove(&mut wb, "watch");
        remove(&mut wb, "other");
        assert_eq!(wb.names, vec![own]);
    }
    #[test]
    fn a_chunk_number_with_leading_zeros_is_another_name() {
        // `_gc_watch_00` is not chunk 0 under another spelling: a hidden one is not read, and a
        // visible one is not in the way of writing `_gc_watch_0`.
        let mut wb = Workbook::new();
        wb.names.push(name("_gc_watch_00", "\"theirs\""));
        assert_eq!(get(&wb, "watch"), None);
        assert!(keys(&wb, "").is_empty());
        let own = DefinedName { hidden: false, ..name("_gc_watch_00", "\"mine\"") };
        wb.names.push(own.clone());
        set(&mut wb, "watch", "ours").unwrap();
        assert_eq!(get(&wb, "watch").as_deref(), Some("ours"));
        assert_eq!(wb.names.len(), 3, "both other names stay");
        remove(&mut wb, "watch");
        assert_eq!(wb.names, vec![name("_gc_watch_00", "\"theirs\""), own]);
    }
    #[test]
    fn keys_list_items_by_prefix() {
        let mut wb = Workbook::new();
        set(&mut wb, "macro_2", "b").unwrap();
        set(&mut wb, "macro_1", &"a".repeat(9_000)).unwrap();
        set(&mut wb, "scripts", "{}").unwrap();
        assert_eq!(keys(&wb, "macro_"), ["macro_1", "macro_2"]);
        assert_eq!(item_key("_gc_macro_1_3").as_deref(), Some("macro_1"));
        assert_eq!(item_key("_SC_Scripts").as_deref(), Some("scripts"));
        assert_eq!(item_key("Total"), None);
    }
    #[test]
    fn listing_many_items_takes_one_pass_and_is_capped() {
        // 20,000 hidden items, as a file can carry: a `get` per key looked at every name for each
        // key (400 million visits); `items` looks at each name once, and lists at most MAX_ITEMS.
        let mut wb = Workbook::new();
        let total = 20_000;
        for i in 0..total {
            wb.names.push(name(&format!("_gc_macro_{i:05}_0"), &format!("\"m{i}\"")));
        }
        set(&mut wb, "macro_big", &"b".repeat(9_000)).unwrap();
        wb.names.push(name("_sc_macro_legacy", "\"old\""));
        wb.names.push(name("_gc_macro_orphan_1", "\"no chunk 0\""));
        wb.names.push(name("_gc_other_0", "\"not a macro\""));
        NAME_VISITS.with(|v| v.set(0));
        let all = items(&wb, "MACRO_");
        assert_eq!(NAME_VISITS.with(|v| v.get()), wb.names.len(), "one pass over the names");
        assert_eq!(all.len(), MAX_ITEMS);
        let first: Vec<&String> = all.keys().take(2).collect();
        assert_eq!(first, ["macro_00000", "macro_00001"]);
        assert_eq!(all.get("macro_09999").map(String::as_str), Some("m9999"));
        assert!(!all.contains_key("macro_10000"), "past the cap");
        NAME_VISITS.with(|v| v.set(0));
        let listed = keys(&wb, "macro_");
        assert_eq!(NAME_VISITS.with(|v| v.get()), wb.names.len());
        assert_eq!(listed, all.keys().cloned().collect::<Vec<_>>(), "keys and items agree");
        // Under the cap every item is there, read as `get` reads it.
        wb.names.retain(|n| !n.name.starts_with("_gc_macro_0") && !n.name.starts_with("_gc_macro_1"));
        let few = items(&wb, "macro_");
        let want: BTreeMap<String, String> =
            [("macro_big", "b".repeat(9_000)), ("macro_legacy", "old".into())].into_iter().map(|(k, t)| (k.to_string(), t)).collect();
        assert_eq!(few, want);
        for (k, text) in &few {
            assert_eq!(get(&wb, k).as_ref(), Some(text));
        }
        assert_eq!(keys(&wb, "macro_"), ["macro_big", "macro_legacy"]);
        assert_eq!(items(&wb, "").len(), 3, "the other item too");
    }
    #[test]
    fn items_round_trip_through_xlsx() {
        let mut wb = Workbook::new();
        let text: String = (0..20_000).map(|i| ['x', '"', 'ü', '\u{1D11E}', ' '][i % 5]).collect();
        set(&mut wb, "blob", &text).unwrap();
        wb.names.push(name("_sc_watch", "\"[\"\"A1\"\"]\""));
        let bytes = gridcraft_xlsx::write_xlsx(&wb).unwrap();
        let (back, warnings) = crate::io::open_bytes("data.xlsx", &bytes).unwrap();
        assert!(warnings.is_empty(), "{warnings:?}");
        assert_eq!(get(&back, "blob").as_deref(), Some(text.as_str()));
        assert_eq!(get_json(&back, "watch"), Some(serde_json::json!(["A1"])));
        // Characters XML can't carry, and the escape marker itself, come back too, in text and
        // in JSON (which leaves U+FFFE and U+FFFF unescaped).
        let mut wb = Workbook::new();
        let odd: String = (0u32..0x20).filter_map(char::from_u32).chain(['\u{FFFE}', '\u{FFFF}', ESCAPE, 'a', '\u{7F}', '\u{FDD1}']).collect();
        let text: String = odd.chars().cycle().take(odd.chars().count() * 300).collect();
        set(&mut wb, "odd", &text).unwrap();
        excel_limits_hold(&wb);
        let json = serde_json::json!({"s": "x\u{FFFF}y\u{1}z\u{FDD0}0041"});
        set_json(&mut wb, "json", &json).unwrap();
        // All escapes: each literal holds whole escapes, within the limits.
        let controls = "\u{1}".repeat(9_000);
        set(&mut wb, "controls", &controls).unwrap();
        excel_limits_hold(&wb);
        let bytes = gridcraft_xlsx::write_xlsx(&wb).unwrap();
        let (back, warnings) = crate::io::open_bytes("data.xlsx", &bytes).unwrap();
        assert!(warnings.is_empty(), "{warnings:?}");
        assert_eq!(get(&back, "odd").as_deref(), Some(text.as_str()));
        assert_eq!(get_json(&back, "json"), Some(json));
        assert_eq!(get(&back, "controls").as_deref(), Some(controls.as_str()));
    }
    #[test]
    fn escapes_count_against_the_limits_and_odd_markers_read_as_they_are() {
        // Excel's limits hold however many characters are escaped, and the longest item of
        // characters that all need escaping still reads.
        for len in [1, 50, 51, 52, 1_638, 1_639, 5_000] {
            let text = "\u{2}".repeat(len);
            let fs = chunk_formulas(&text);
            assert_eq!(unescape(&fs.iter().map(|f| string_literals(f)).collect::<String>()), text, "{len}");
            assert!(fs.iter().all(|f| f.encode_utf16().count() <= FORMULA_UNITS), "{len}");
        }
        let mut wb = Workbook::new();
        let longest = "\u{0}".repeat(MAX_ITEM_CHARS);
        set(&mut wb, "longest", &longest).unwrap();
        excel_limits_hold(&wb);
        assert_eq!(get(&wb, "longest").map(|t| t.len()), Some(MAX_ITEM_CHARS));
        // A marker in a hand-made name that is not an escape stays as it is.
        let mut wb = Workbook::new();
        wb.names.push(name("_gc_hand_0", "\"a\u{FDD0}zz\u{FDD0}D800\u{FDD0}004\u{FDD0}0041\u{FDD0}\""));
        assert_eq!(get(&wb, "hand").as_deref(), Some("a\u{FDD0}zz\u{FDD0}D800\u{FDD0}004A\u{FDD0}"));
    }
 }
@@ -19,6 +19,7 @@ pub mod outline;
 pub mod paper;
 pub mod pivot;
 pub mod pivot_calc;
 pub mod record;
 pub mod sample;
 pub mod selection;
 pub mod tables;
@@ -66,6 +67,51 @@ pub struct HistoryEntry {
    pub retained_bytes: usize,
 }
 /// An undo group opened with [`Session::group_begin`]. Hand it back to [`Session::group_end`]
 /// (keep the changes as one undo step) or [`Session::group_rollback`] (undo them all).
 #[derive(Debug, PartialEq, Eq)]
 #[must_use = "an undo group stays open until it is ended or rolled back"]
 pub struct GroupToken {
    id: u64,
    doc: u64,
 }
 impl GroupToken {
    /// The uid of the document the group belongs to.
    pub fn doc(&self) -> u64 {
        self.doc
    }
 }
 /// An open undo group: what runs on `doc` until it ends becomes one undo step.
 #[derive(Clone, Debug)]
 struct OpenGroup {
    id: u64,
    doc: u64,
    label: String,
    /// Undo depth when the group began; the group's own steps are cut back to it.
    start: usize,
    wb: Arc<Workbook>,
    selection: Selection,
    /// The redo stack when the group began (a rollback puts it back).
    redo: Vec<HistoryEntry>,
 }
 /// Where the last [`Session::group_end`] or [`Session::group_rollback`] left its document: the
 /// workbook and selection it ended at, the undo length then, and whether it made a step. A
 /// command that ended the group tells its own later changes from the group's step by it, and
 /// keeps the group's name only when the group's step is exactly its own (the entry holds the
 /// workbook the step started from). Dropped when the outermost command finishes, so it keeps no
 /// workbook alive between commands.
 #[derive(Debug)]
 struct GroupStep {
    doc: u64,
    after: Arc<Workbook>,
    selection: Selection,
    len: usize,
    stepped: bool,
 }
 /// The clipboard: a block of cells (with formulas and styles) or marching-ants reference.
 #[derive(Clone, Debug)]
 pub struct Clipboard {
@@ -84,6 +130,34 @@ pub struct Clipboard {
    /// A multi-area copy: the areas as selected (for the marquee). `wb` then holds them slid
    /// together into one block at `range`. Empty for a single-range copy.
    pub areas: Vec<RangeRef>,
    /// Trust of the source document: pasting content from a file someone else made carries it.
    pub trust: Trust,
 }
 /// Whether a document's active content (macros) may run without asking the person first. There
 /// is no default: whoever makes a document says where it came from ([`DocState::new`]), so a new
 /// way of building one from bytes can't come out trusted by omission.
 #[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize)]
 #[serde(rename_all = "camelCase")]
 pub enum Trust {
    /// Made in this session: a new workbook or a sample.
    Local,
    /// Opened from a file, or holding content pasted from one: active content asks before it
    /// runs.
    FromFile,
 }
 impl Trust {
    /// Whether active content may run without asking.
    pub fn allows_code(self) -> bool {
        self == Trust::Local
    }
    /// The trust of a document after it receives content from a document with trust `source`:
    /// content from an untrusted file leaves the receiver untrusted.
    pub fn receive(self, source: Trust) -> Trust {
        if source == Trust::FromFile { Trust::FromFile } else { self }
    }
 }
 /// In-cell edit mode as shown in the status bar.
@@ -120,6 +194,11 @@ pub struct DocState {
    /// user trusts it in this session (`automate.trustScripts`); one with no scripts starts
    /// trusted, since any script it gains later was written here.
    pub scripts_trusted: bool,
    /// Where the workbook's content came from: whether its active content may run without
    /// asking. Unlike `scripts_trusted`, this is provenance, not consent: it is set when the
    /// workbook is opened from a file, carried by content pasted from such a workbook, and never
    /// changed by a trust decision.
    pub trust: Trust,
 }
 static NEXT_UID: std::sync::atomic::AtomicU64 = std::sync::atomic::AtomicU64::new(1);
@@ -160,17 +239,31 @@ fn push_history_with_budget(
    selection: Selection,
    byte_budget: usize,
 ) {
    push_entry(history, label, wb, next, selection);
    trim_to_budget(history, byte_budget);
 }
 /// Adds a step without applying the limits: inside a command they wait for the outermost
 /// command to collapse its steps (see [`Session::trim_history`]).
 fn push_entry(history: &mut Vec<HistoryEntry>, label: String, wb: Arc<Workbook>, next: &Workbook, selection: Selection) {
    let retained_bytes = history_retained_bytes(&wb, next);
    history.push(HistoryEntry { label, wb, selection, retained_bytes });
 }
 /// Drops the oldest steps past [`UNDO_LIMIT`] or `byte_budget`, always keeping the latest one
 /// (even if that one edit exceeds the budget).
 fn trim_to_budget(history: &mut Vec<HistoryEntry>, byte_budget: usize) {
    let mut total = history.iter().fold(0usize, |sum, entry| sum.saturating_add(entry.retained_bytes));
    // Always preserve the latest action, even if that one edit exceeds the budget.
    while history.len() > 1 && (history.len() > UNDO_LIMIT || total > byte_budget) {
        total = total.saturating_sub(history.remove(0).retained_bytes);
    }
 }
 impl DocState {
-    pub fn new(mut wb: Workbook, path: Option<String>, title: String) -> DocState {
+    /// A document for `wb`, which came from where `trust` says: [`Trust::FromFile`] for anything
    /// read from bytes (a file, a download, a recovery copy), [`Trust::Local`] only for a workbook
    /// made in this session.
    pub fn new(mut wb: Workbook, path: Option<String>, title: String, trust: Trust) -> DocState {
        let mut calc = Calc::new();
        calc.recalc_all(&mut wb);
        let scripts_trusted = !cmd::extra::has_scripts(&wb);
@@ -191,6 +284,7 @@ impl DocState {
            unlocked_ranges: vec![],
            content_kind: None,
            scripts_trusted,
            trust,
        }
    }
    pub fn is_dirty(&self) -> bool {
@@ -307,8 +401,13 @@ pub struct Session {
    pub last_find: Option<Json>,
    /// View › Show › Ruler is off (rulers in Page Layout view; an application option).
    pub hide_ruler: bool,
-    /// Journal position where action recording started.
+    /// Journal position where Automate › Record Actions started.
    pub recording: Option<usize>,
    /// The recording buffer while a recorder runs ([`Session::start_recording`]): top-level
    /// commands with the place they ran in, kept apart from the journal.
    pub recorder: Option<record::Recorder>,
    /// How many `execute` calls are running (0 between top-level commands).
    depth: u32,
    /// Windows hidden with View › Hide.
    pub hidden_windows: Vec<usize>,
    /// Draw tab tool: "" (select), "pen" or "eraser"; pen colour and width.
@@ -320,6 +419,17 @@ pub struct Session {
    /// Review › Notes › Show All Notes: every note is displayed. An application display setting
    /// (like Excel's comment indicator option), so it's not saved in the file.
    pub show_all_notes: bool,
    /// Open undo groups, innermost last.
    groups: Vec<OpenGroup>,
    next_group: u64,
    /// Counts group begins and ends, so `execute` can tell that a command opened or closed one.
    group_epoch: u64,
    /// Where the last group ended, so `execute` can tell a command's own changes from its group's.
    group_step: Option<GroupStep>,
    /// For each running command, innermost last: its document and that document's undo length
    /// when it began. Steps before that length are not touched while the command runs (see
    /// [`Session::bound_tail`]).
    marks: Vec<(u64, usize)>,
    /// Measures cell text for AutoFit Column Width. Without it (CLI, MCP) AutoFit uses
    /// [`cmd::format::approx_text_width`].
    pub text_width: Option<TextWidth>,
@@ -359,7 +469,8 @@ impl Session {
    }
    pub fn close_document(&mut self, i: usize) {
        if i < self.docs.len() {
-            self.docs.remove(i);
+            let d = self.docs.remove(i);
            self.groups.retain(|g| g.doc != d.uid);
            if self.active >= self.docs.len() {
                self.active = self.docs.len().saturating_sub(1);
            }
@@ -373,7 +484,7 @@ impl Session {
            let name = wb.next_sheet_name();
            wb.sheets.push(Arc::new(gridcraft_model::Sheet::new(name)));
        }
-        self.add_document(DocState::new(wb, None, format!("Book{n}")))
+        self.add_document(DocState::new(wb, None, format!("Book{n}"), Trust::Local))
    }
    /// Journals a command, then trims the oldest entries past either cap. A recording in progress
@@ -412,7 +523,8 @@ impl Session {
        command_specs().iter().map(|c| c.info(self)).collect()
    }
-    /// Runs a command by id. Undoable commands record a history step when the workbook changed.
+    /// Runs a command by id. Undoable commands record a history step when the workbook changed,
    /// unless an undo group is open on the document (the group then makes the step).
    /// Panics inside commands are caught and reported; the workbook is restored.
    pub fn execute(&mut self, id: &str, params: Json) -> Result<Json> {
        let spec = find_command(id).ok_or_else(|| EngineError::UnknownCommand(id.to_string()))?;
@@ -421,36 +533,352 @@ impl Session {
        }
        let before = self.active().map(|d| (d.uid, d.wb.clone(), d.selection.clone()));
        let params = if params.is_null() { Json::Object(Default::default()) } else { params };
        let (first_group, group_epoch) = (self.next_group, self.group_epoch);
        // Whether a group was open on the document before the command, and how long its history was.
        let start = before.as_ref().and_then(|(uid, ..)| self.docs.iter().find(|d| d.uid == *uid).map(|d| (self.in_group(*uid), d.undo.len())));
        // A command that panics leaves the history as it found it: the steps commands nested in it
        // made or undid, and the redo history they cleared, come back. A length is not enough,
        // because a nested `edit.undo` removes entries. A query runs nothing that changes the
        // history (`every_query_leaves_the_history_alone` runs each one), so it needs no
        // copy; front ends run queries all the time.
        let query = !spec.journal && !spec.undoable;
        let history_before = before.as_ref().filter(|_| !query).and_then(|(uid, ..)| {
            #[cfg(test)]
            tests::HISTORY_COPIES.with(|n| n.set(n.get().saturating_add(1)));
            self.docs.iter().find(|d| d.uid == *uid).map(|d| (d.undo.clone(), d.redo.clone()))
        });
        // The groups open on the document before the command (usually none), for the same reason.
        let groups_before: Vec<(u64, String, Arc<Workbook>, Selection)> = match &before {
            Some((uid, ..)) => {
                self.groups.iter().filter(|g| g.doc == *uid).map(|g| (g.id, g.label.clone(), g.wb.clone(), g.selection.clone())).collect()
            }
            None => Vec::new(),
        };
        // The recorder keeps top-level calls with the place they ran in.
        let place = (self.depth == 0 && self.recorder.is_some()).then(|| match self.active() {
            Some(d) => (d.uid, d.wb.active_sheet, d.wb.active().map(|sh| sh.name.clone()).unwrap_or_default(), d.selection.clone()),
            None => (0, 0, String::new(), Selection::default()),
        });
        let doc_uid = before.as_ref().map(|(uid, ..)| *uid);
        let requests_before = self.ui_requests.len();
        let marked = doc_uid.zip(start).map(|(uid, (_, len))| (uid, len));
        self.marks.extend(marked);
        self.depth = self.depth.saturating_add(1);
        let result = std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| (spec.run)(self, &params)));
        self.depth = self.depth.saturating_sub(1);
        if marked.is_some() {
            self.marks.pop();
        }
        let result = match result {
            Ok(r) => r,
            Err(p) => {
                let msg =
                    p.downcast_ref::<&str>().map(|s| s.to_string()).or_else(|| p.downcast_ref::<String>().cloned()).unwrap_or_else(|| "panic".into());
-                // Restore the workbook as it was.
+                // Restore the workbook and its history as they were, and drop the undo groups the
                // command opened.
                self.groups.retain(|g| g.id < first_group);
                let group_open = before.as_ref().is_some_and(|(uid, ..)| self.groups.iter().any(|g| g.doc == *uid));
                if let Some((uid, wb, sel)) = &before
                    && let Some(d) = self.docs.iter_mut().find(|d| d.uid == *uid)
                {
                    d.wb = wb.clone();
                    d.selection = sel.clone();
                    if let Some((undo, redo)) = history_before {
                        d.undo = undo;
                        d.redo = redo;
                    }
                    // A group open before the command and ended or rolled back inside it stays
                    // ended (its token went with the command), and keeps a step from its start to
                    // the restored workbook, so Undo still returns to the state before the group.
                    if !group_open
                        && let Some((_, label, wb, selection)) = groups_before.into_iter().min_by_key(|g| g.0)
                        && !Arc::ptr_eq(&wb, &d.wb)
                    {
                        push_entry(&mut d.undo, label, wb, &d.wb, selection);
                        d.redo.clear();
                    }
                    d.calc.rebuild(&d.wb);
                }
                if self.depth == 0 {
                    self.trim_history();
                    self.group_step = None;
                }
                return Err(EngineError::Internal(id.to_string(), msg));
            }
        };
        // A command that fails leaves none of its own undo groups open (a `?` between
        // `group_begin` and `group_end`): each is rolled back as `group_rollback` does. Only a
        // command that succeeds keeps a group it opened (a debugger's start).
        if result.is_err() {
            self.rollback_groups_from(first_group);
        }
        if spec.journal && result.is_ok() {
            // A command that started recording is not part of the recording; one that stopped it
            // finds no recorder. A menu-style call that only opened a dialog (`file.open` with no
            // file, `home.formatCells` with no style) is not recorded either: the dialog's own
            // call is, so playing the recording back runs the command once, with its parameters.
            let opened_dialog = self.ui_requests.get(requests_before..).is_some_and(|new| new.iter().any(|q| matches!(q, UiRequest::Dialog(..))));
            if let Some((doc, sheet, sheet_name, selection)) = place.filter(|_| !opened_dialog)
                && let Some(rec) = self.recorder.as_mut()
            {
                rec.push(record::RecordedStep { doc, sheet, sheet_name, selection, id: id.to_string(), params: cmd::journal_params(&params) });
            }
            self.push_journal(id, cmd::journal_params(&params));
        }
        // Inside an undo group the group owns the step. A command that ended a group open before
        // it leaves the group its step and makes one of its own for what it changed after the end.
        // A command that opened and closed its own groups makes one step of its own, which
        // replaces the steps those groups made.
        let epoch_changed = self.group_epoch != group_epoch;
        let in_group_now = before.as_ref().is_some_and(|(uid, ..)| self.in_group(*uid));
        let was_open = start.is_some_and(|(was_open, _)| was_open);
        if spec.undoable
            && let Some((uid, wb, sel)) = before
            && let Some(d) = self.docs.iter_mut().find(|d| d.uid == uid)
            && !Arc::ptr_eq(&d.wb, &wb)
        {
-            push_history(&mut d.undo, spec.label.trim_end_matches('…').to_string(), wb, &d.wb, sel);
+            let label = spec.label.trim_end_matches('…').to_string();
            if in_group_now {
                // A group this command opened and left open (a debugger's start) takes the
                // command's start as its own, so what the command changed before opening it is
                // part of the group's step and not a step of its own.
                if !was_open
                    && let Some((_, len)) = start
                    && let Some(g) = self.groups.iter_mut().filter(|g| g.doc == uid && g.id >= first_group).min_by_key(|g| g.id)
                {
                    g.start = len;
                    g.wb = wb;
                    g.selection = sel;
                }
            } else if epoch_changed && was_open {
                // The group it ended made its step; changes after the end, whether direct or by
                // nested commands, are the command's own step from where the group ended.
                if let Some(step) = self.group_step.as_ref().filter(|g| g.doc == uid)
                    && (d.undo.len() > step.len || !Arc::ptr_eq(&step.after, &d.wb))
                {
                    d.undo.truncate(step.len);
                    push_entry(&mut d.undo, label, step.after.clone(), &d.wb, step.selection.clone());
                    d.redo.clear();
                }
            } else {
                let mut label = label;
                if epoch_changed && let Some((_, len)) = start {
                    // A command whose only step is its group's keeps that name ("Run Macro: Totals").
                    // That is so only when the one entry the command added is a group's step from
                    // the command's own start to its own result: an entry a nested command made,
                    // a group step of an earlier command (undone since), or a group's step that
                    // the command edited past all name the step after the command instead.
                    if d.undo.len() == len + 1
                        && let Some(last) = d.undo.last()
                        && Arc::ptr_eq(&last.wb, &wb)
                        && self.group_step.as_ref().is_some_and(|g| g.doc == uid && g.stepped && Arc::ptr_eq(&g.after, &d.wb))
                    {
                        label = last.label.clone();
                    }
                    d.undo.truncate(len);
                }
                push_entry(&mut d.undo, label, wb, &d.wb, sel);
                d.redo.clear();
            }
            // Inside a group the redo history waits for the group: `group_end` clears it when the
            // group becomes a step, and `group_rollback` puts it back as it was.
            d.revision += 1;
        }
        // The history limit applies once the outermost command has collapsed its steps, so the
        // lengths it compared stay true. Meanwhile the steps made inside it are bounded on their own.
        if self.depth == 0 {
            self.trim_history();
            self.group_step = None;
        } else if let Some(uid) = doc_uid {
            self.bound_tail(uid);
        }
        result
    }
    /// Runs `f` as one undo step labelled `label` on the active document: whatever commands `f`
    /// runs, one Undo brings back the workbook as it was before. If `f` fails, every change it made
    /// is rolled back and its error is returned. Groups nest; the outermost one makes the step.
    pub fn grouped<R>(&mut self, label: &str, f: impl FnOnce(&mut Session) -> Result<R>) -> Result<R> {
        let token = self.group_begin(label)?;
        let doc = token.doc();
        // A panic in `f` rolls the group back before it goes on, so a caller that catches it
        // (outside `execute`, which drops a command's groups itself) finds no group left open.
        match std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| f(self))) {
            Ok(Ok(r)) => match self.group_end(token) {
                Ok(_) => Ok(r),
                // `f` closed the group's document (`file.close`, or `file.open` taking the place of
                // an untouched new workbook), and the group went with it: nothing is left to undo.
                Err(_) if !self.docs.iter().any(|d| d.uid == doc) => Ok(r),
                Err(e) => Err(e),
            },
            Ok(Err(e)) => {
                // The error from `f` is the one to report. A rollback fails only when the group
                // has already ended, and then there is nothing left to undo.
                let _ = self.group_rollback(token);
                Err(e)
            }
            Err(panic) => {
                let _ = self.group_rollback(token);
                std::panic::resume_unwind(panic)
            }
        }
    }
    /// Opens an undo group on the active document that can span several calls (for example a
    /// debugger that runs one step per call). Until [`Session::group_end`] or
    /// [`Session::group_rollback`], undoable commands on that document add no undo steps of their
    /// own, and Undo and Redo are unavailable there.
    pub fn group_begin(&mut self, label: &str) -> Result<GroupToken> {
        let d = self.doc()?;
        let g = OpenGroup {
            id: self.next_group,
            doc: d.uid,
            label: label.trim_end_matches('…').to_string(),
            start: d.undo.len(),
            wb: d.wb.clone(),
            selection: d.selection.clone(),
            redo: d.redo.clone(),
        };
        let token = GroupToken { id: g.id, doc: g.doc };
        self.next_group = self.next_group.saturating_add(1);
        self.group_epoch = self.group_epoch.wrapping_add(1);
        self.groups.push(g);
        Ok(token)
    }
    /// Ends an undo group. If the workbook changed, the group becomes one undo step, unless it is
    /// nested in another open group on the same document, which then owns the step. Groups opened
    /// inside it and still open end with it. Returns whether the workbook changed.
    pub fn group_end(&mut self, token: GroupToken) -> Result<bool> {
        let g = self.take_group(&token)?;
        let outer = self.in_group(g.doc);
        let Some(d) = self.docs.iter_mut().find(|d| d.uid == g.doc) else { return Ok(false) };
        // Steps pushed directly while the group was open fold into the group's step.
        d.undo.truncate(g.start);
        let changed = !Arc::ptr_eq(&d.wb, &g.wb);
        if changed && !outer {
            push_entry(&mut d.undo, g.label, g.wb, &d.wb, g.selection);
            d.redo.clear();
            d.revision += 1;
        }
-        result
+        if !outer {
            self.group_step =
                Some(GroupStep { doc: g.doc, after: d.wb.clone(), selection: d.selection.clone(), len: d.undo.len(), stepped: changed });
        }
        // Inside a command, the outermost command applies the history limit when it finishes.
        if self.depth == 0 {
            self.trim_history();
        }
        Ok(changed)
    }
    /// Stops the running action on the document with uid `doc`: every undo group open on it is
    /// rolled back as [`Session::group_rollback`] does, putting back the workbook, selection, undo
    /// and redo history as they were when the outermost one began. Their tokens are then spent
    /// (ending or rolling one back reports that it has already ended). Returns whether a group
    /// was open. `automate.stopAction` runs it on the active document.
    pub fn abort_groups(&mut self, doc: u64) -> bool {
        let Some(id) = self.groups.iter().filter(|g| g.doc == doc).map(|g| g.id).min() else { return false };
        // Rolling back the outermost group ends the ones opened inside it.
        self.group_rollback(GroupToken { id, doc }).is_ok()
    }
    /// Rolls back every open undo group numbered `first` or later (the groups a failed command
    /// opened), outermost first on each document.
    fn rollback_groups_from(&mut self, first: u64) {
        let opened: Vec<(u64, u64)> = self.groups.iter().filter(|g| g.id >= first).map(|g| (g.id, g.doc)).collect();
        for (id, doc) in opened {
            // A group inside one rolled back before it is already gone.
            if self.groups.iter().any(|g| g.id == id) {
                let _ = self.group_rollback(GroupToken { id, doc });
            }
        }
    }
    /// Bounds the undo steps pushed while a command runs (a script of many steps, a subtotal per
    /// group): at most [`UNDO_LIMIT`] of them within [`UNDO_BYTES_LIMIT`], dropping the oldest.
    /// Only steps after the latest mark go: a running command's start, an open group's start and
    /// the end of the last group are positions the command or group collapses its steps by when
    /// it finishes, so what is before them stays as it is until [`Session::trim_history`].
    fn bound_tail(&mut self, uid: u64) {
        let Some(d) = self.docs.iter_mut().find(|d| d.uid == uid) else { return };
        let marks = self.marks.iter().filter(|(doc, _)| *doc == uid).map(|(_, len)| *len);
        let groups = self.groups.iter().filter(|g| g.doc == uid).map(|g| g.start);
        let step = self.group_step.as_ref().filter(|g| g.doc == uid).map(|g| g.len);
        let mark = marks.chain(groups).chain(step).max().unwrap_or(0).min(d.undo.len());
        let mut bytes = d.undo.iter().skip(mark).fold(0usize, |sum, e| sum.saturating_add(e.retained_bytes));
        while d.undo.len() > mark + 1 && (d.undo.len() - mark > UNDO_LIMIT || bytes > UNDO_BYTES_LIMIT) {
            bytes = bytes.saturating_sub(d.undo.remove(mark).retained_bytes);
        }
    }
    /// Drops the oldest undo steps past [`UNDO_LIMIT`] or [`UNDO_BYTES_LIMIT`]. A document with
    /// an open group waits for the group to end, because the group remembers where its steps start.
    fn trim_history(&mut self) {
        let groups = &self.groups;
        for d in self.docs.iter_mut().filter(|d| !groups.iter().any(|g| g.doc == d.uid)) {
            trim_to_budget(&mut d.undo, UNDO_BYTES_LIMIT);
        }
    }
    /// Ends an undo group by putting back the workbook, selection, undo and redo history as they
    /// were when it began.
    pub fn group_rollback(&mut self, token: GroupToken) -> Result<()> {
        let g = self.take_group(&token)?;
        let Some(d) = self.docs.iter_mut().find(|d| d.uid == g.doc) else { return Ok(()) };
        if !Arc::ptr_eq(&d.wb, &g.wb) {
            d.wb = g.wb;
            d.calc.rebuild(&d.wb);
        }
        d.selection = g.selection;
        d.undo.truncate(g.start);
        d.redo = g.redo;
        d.revision += 1;
        // The record of the last group step stays when the document is back exactly where that
        // step left it (this group began there); otherwise the rollback is where the group ended.
        let kept = self.group_step.as_ref().is_some_and(|st| st.doc == g.doc && st.len == g.start && Arc::ptr_eq(&st.after, &d.wb));
        if !kept && !self.groups.iter().any(|o| o.doc == g.doc) {
            self.group_step = Some(GroupStep { doc: g.doc, after: d.wb.clone(), selection: d.selection.clone(), len: g.start, stepped: false });
        }
        Ok(())
    }
    /// Starts recording top-level commands into an empty buffer, replacing any recording in
    /// progress. Queries, failed commands and commands run by other commands are not recorded.
    pub fn start_recording(&mut self) {
        self.recorder = Some(record::Recorder::default());
    }
    /// Stops recording and returns what was recorded (`None` when nothing was recording).
    pub fn stop_recording(&mut self) -> Option<record::Recorder> {
        self.recorder.take()
    }
    /// Whether the recording buffer is collecting commands.
    pub fn is_recording(&self) -> bool {
        self.recorder.is_some()
    }
    /// How many commands are running: 0 between top-level commands, 1 inside one, 2 inside a
    /// command run by a command, and so on.
    pub fn depth(&self) -> u32 {
        self.depth
    }
    /// Whether an undo group is open on the document with this uid.
    pub fn in_group(&self, doc: u64) -> bool {
        self.groups.iter().any(|g| g.doc == doc)
    }
    /// Removes the token's group and any group on the same document opened after it.
    fn take_group(&mut self, token: &GroupToken) -> Result<OpenGroup> {
        let ended = || EngineError::Other("That undo group has already ended.".into());
        let at = self.groups.iter().position(|g| g.id == token.id).ok_or_else(ended)?;
        let mut later = self.groups.split_off(at).into_iter();
        let g = later.next().ok_or_else(ended)?;
        self.groups.extend(later.filter(|o| o.doc != g.doc));
        self.group_epoch = self.group_epoch.wrapping_add(1);
        Ok(g)
    }
    pub fn run(&mut self, id: &str, params: Json) -> std::result::Result<Json, String> {
@@ -468,6 +896,8 @@ impl Session {
        let r = self.execute(id, params);
        let requests = self.take_ui_requests();
        let asked_for_file = requests.iter().any(|q| matches!(q, UiRequest::Dialog(name, _) if name == "open" || name == "saveAs"));
        // A call that only opened a dialog is not recorded (see `execute`), so the recording
        // has no step to take back here.
        if r.is_ok() && asked_for_file {
            let what = match id {
                "file.open" => "`path` or `base64`",
@@ -0,0 +1,66 @@
 //! The recording buffer: the commands a person (or an agent) ran while recording, each with the
 //! document, sheet and selection it ran in.
 //!
 //! Only top-level calls are kept. A command that runs other commands (Custom Views › Show, a
 //! script) is one step, so playing the recording back does not run the inner commands twice. The
 //! buffer is separate from the journal, so trimming the journal never loses recorded steps, and
 //! secret parameters are left out as they are in the journal ([`crate::cmd::journal_params`]).
 use serde::Serialize;
 use serde_json::Value as Json;
 use crate::Selection;
 /// The most steps one recording keeps; later ones are counted in [`Recorder::dropped`].
 pub const RECORD_LIMIT: usize = 100_000;
 /// The most bytes (steps serialized as JSON) one recording keeps. A step keeps its full
 /// parameters so it can be played back, and a `file.open` holds the whole file as base64, so
 /// without a size cap a recording of a few opens of a large workbook keeps tens of MB alive.
 pub const RECORD_MAX_BYTES: usize = 64 * 1024 * 1024;
 /// One recorded command and where it ran.
 #[derive(Clone, Debug, PartialEq, Serialize)]
 #[serde(rename_all = "camelCase")]
 pub struct RecordedStep {
    /// Uid of the document that was active when the command ran (0 when none was open).
    pub doc: u64,
    /// That document's active sheet (index and name) just before the command ran.
    pub sheet: usize,
    pub sheet_name: String,
    /// That document's selection just before the command ran.
    pub selection: Selection,
    /// The command id and its parameters, without secrets.
    pub id: String,
    pub params: Json,
 }
 /// The steps recorded since recording started.
 #[derive(Clone, Debug, Default)]
 pub struct Recorder {
    pub steps: Vec<RecordedStep>,
    /// Steps not kept because the recording reached [`RECORD_LIMIT`] or [`RECORD_MAX_BYTES`].
    /// Once a step is dropped, every later one is too, so `steps` is always the beginning of
    /// what ran, never a sequence with gaps.
    pub dropped: usize,
    /// The size of `steps` serialized as JSON.
    bytes: usize,
 }
 impl Recorder {
    /// Adds a step, or counts it as dropped once the buffer is full.
    pub fn push(&mut self, step: RecordedStep) {
        // Once a step has been dropped, or the step count is full, the rest are counted without
        // being serialized (a `file.open` step holds a whole file).
        if self.dropped > 0 || self.steps.len() >= RECORD_LIMIT {
            self.dropped = self.dropped.saturating_add(1);
            return;
        }
        let size = serde_json::to_vec(&step).map_or(0, |v| v.len());
        if self.bytes.saturating_add(size) <= RECORD_MAX_BYTES {
            self.bytes = self.bytes.saturating_add(size);
            self.steps.push(step);
        } else {
            self.dropped = self.dropped.saturating_add(1);
        }
    }
 }
@@ -26,7 +26,7 @@ pub fn build(name: &str) -> Option<Workbook> {
            _ => return None,
        };
    }
-    s.add_document(DocState::new(wb, None, title(name)));
+    s.add_document(DocState::new(wb, None, title(name), crate::Trust::Local));
    let ok = match name {
        "budget" => budget(&mut s),
        "sales" => sales(&mut s),
@@ -3,6 +3,11 @@ use serde_json::json;
 use crate::Session;
 thread_local! {
    /// Copies of a document's undo and redo history `execute` has taken on this thread.
    pub(crate) static HISTORY_COPIES: std::cell::Cell<usize> = const { std::cell::Cell::new(0) };
 }
 fn s() -> Session {
    let mut s = Session::new();
    s.new_workbook();
@@ -4599,3 +4604,4 @@ fn html_export_without_pictures_or_charts_has_no_fixed_geometry() {
    let html = crate::io::to_html(&s.doc().unwrap().wb, 0).unwrap();
    assert!(!html.contains("<colgroup>") && !html.contains("table-layout") && !html.contains("<svg") && !html.contains("<img"), "{html}");
 }
 mod seams;
@@ -26,7 +26,7 @@ fn opened() -> Session {
    let bytes = io::save_bytes(&wb, "dynamic.xlsx").unwrap();
    let (back, _) = io::open_bytes("dynamic.xlsx", &bytes).unwrap();
    let mut s = Session::new();
-    s.add_document(DocState::new(back, None, "dynamic".into()));
+    s.add_document(DocState::new(back, None, "dynamic".into(), gridcraft_engine::Trust::FromFile));
    s
 }
@@ -78,7 +78,7 @@ fn longest_flat_chains_survive_editing_saving_and_reopening() {
        let bytes = io::save_bytes(wb, "chains.xlsx").expect("save");
        let (reopened, _) = io::open_bytes("chains.xlsx", &bytes).expect("open");
        let mut session = Session::new();
-        session.add_document(DocState::new(reopened, None, "chains".into()));
+        session.add_document(DocState::new(reopened, None, "chains".into(), gridcraft_engine::Trust::FromFile));
        session.execute("formulas.calculateNow", json!({})).expect("recalc");
        assert_eq!(value(&session, "C2"), Value::Number(4096.0));
        assert_eq!(value(&session, "C3"), Value::Number(-4094.0));
@@ -6,7 +6,8 @@ const NOT_OBJECTS: [&str; 4] = ["\"[1,2]\"", "\"7\"", "\"true\"", "\"\"\"hi\"\"\
 fn with_name(name: &str, refers_to: &str) -> Session {
    let mut s = Session::new();
    s.new_workbook();
-    s.execute("formulas.defineName", json!({"name": name, "refersTo": refers_to})).unwrap();
+    // `force`: the name commands refuse GridCraft's own data names otherwise.
    s.execute("formulas.defineName", json!({"name": name, "refersTo": refers_to, "force": true})).unwrap();
    s
 }
@@ -74,15 +74,23 @@ pub fn title_bar(app: &mut SheetApp, ui: &mut Ui) {
            {
                app.run_or_alert("file.save", json!({}));
            }
-            let can_undo = app.session.active().is_some_and(|d| !d.undo.is_empty());
+            // The commands' own availability: there must be a step, and no undo group may be open on
-            let can_redo = app.session.active().is_some_and(|d| !d.redo.is_empty());
+            // the document (an action that spans several calls is still running).
-            if icon_button(ui, Icon::Undo, if can_undo { t.text_dim } else { t.text_disabled }, "Undo", vec2(26.0, ch)).clicked() && can_undo {
+            let can_undo = gridcraft_engine::cmd::can_undo(&app.session).is_ok();
            let can_redo = gridcraft_engine::cmd::can_redo(&app.session).is_ok();
            // Named and marked enabled or not for assistive technology (and the UI tests).
            let undo = icon_button(ui, Icon::Undo, if can_undo { t.text_dim } else { t.text_disabled }, "Undo", vec2(26.0, ch));
            undo.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, can_undo, "Undo"));
            if undo.clicked() && can_undo {
                app.run_or_alert("edit.undo", json!({}));
            }
            let undo_list = icon_button(ui, Icon::Chevron, t.text_dim, "Undo list", vec2(14.0, ch));
            egui::Popup::menu(&undo_list).show(|ui| {
-                let labels: Vec<String> =
+                let labels: Vec<String> = if can_undo {
-                    app.session.active().map(|d| d.undo.iter().rev().take(20).map(|e| e.label.clone()).collect()).unwrap_or_default();
+                    app.session.active().map(|d| d.undo.iter().rev().take(20).map(|e| e.label.clone()).collect()).unwrap_or_default()
                } else {
                    Vec::new()
                };
                if labels.is_empty() {
                    ui.label("Can't Undo");
                }
@@ -92,7 +100,9 @@ pub fn title_bar(app: &mut SheetApp, ui: &mut Ui) {
                    }
                }
            });
-            if icon_button(ui, Icon::Redo, if can_redo { t.text_dim } else { t.text_disabled }, "Redo", vec2(26.0, ch)).clicked() && can_redo {
+            let redo = icon_button(ui, Icon::Redo, if can_redo { t.text_dim } else { t.text_disabled }, "Redo", vec2(26.0, ch));
            redo.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, can_redo, "Redo"));
            if redo.clicked() && can_redo {
                app.run_or_alert("edit.redo", json!({}));
            }
            let more = icon_button(ui, Icon::More, t.text_dim, "More commands", vec2(26.0, ch));
@@ -85,7 +85,7 @@ fn horizontal_scrollbar_pages_and_drags_across_a_wide_sheet() {
    // Column A frozen: a page is the scrolling part only.
    sh.freeze = Some((0, 1));
    let mut s = Session::new();
-    s.add_document(gridcraft_engine::DocState::new(wb, None, "Book1".into()));
+    s.add_document(gridcraft_engine::DocState::new(wb, None, "Book1".into(), gridcraft_engine::Trust::Local));
    let mut h = harness(s);
    let track = h.state().grid.hscroll.expect("the tab bar has a horizontal scrollbar");
    assert!(track.width() >= 200.0, "the scrollbar gets a usable share of the tab bar: {track:?}");
@@ -85,6 +85,7 @@ mod touch_pan;
 mod trace_navigation;
 mod translated_form_fields;
 mod ui_clock;
 mod undo_while_grouping;
 mod validation_alert;
 mod validation_input_message;
 mod wheel_zoom;
@@ -18,7 +18,7 @@ fn harness(freeze: Option<(u32, u32)>) -> Harness {
    sh.view_active = CellRef::parse("A31").unwrap();
    sh.freeze = freeze;
    let mut session = Session::new();
-    session.add_document(DocState::new(wb, None, "Book1".into()));
+    session.add_document(DocState::new(wb, None, "Book1".into(), gridcraft_engine::Trust::Local));
    let mut h = egui_kittest::Harness::builder().with_size(egui::vec2(1200.0, 800.0)).build_ui_state(
        |ui, app: &mut SheetApp| {
            app.logic(ui.ctx());
@@ -0,0 +1,57 @@
 //! Undo and Redo on the Quick Access Toolbar follow the commands' own availability: while an undo
 //! group is open on the document (an action that spans several calls is still running), both
 //! buttons are off, and a click neither runs the command nor raises its refusal.
 use egui_kittest::kittest::{NodeT as _, Queryable as _};
 use gridcraft_engine::Session;
 use gridcraft_ui_egui::SheetApp;
 use serde_json::json;
 type Harness = egui_kittest::Harness<'static, SheetApp>;
 fn harness() -> Harness {
    let mut s = Session::new();
    s.new_workbook();
    s.execute("cell.set", json!({"cell": "A1", "input": "1"})).unwrap();
    s.execute("cell.set", json!({"cell": "A1", "input": "2"})).unwrap();
    s.execute("edit.undo", json!({})).unwrap();
    let mut h = egui_kittest::Harness::builder().with_size(egui::vec2(1200.0, 800.0)).build_ui_state(
        |ui, app: &mut SheetApp| {
            app.logic(ui.ctx());
            app.ui(ui);
        },
        SheetApp::new(s, Default::default()),
    );
    h.run_steps(4);
    h
 }
 fn history(h: &Harness) -> (usize, usize) {
    let d = h.state().session.active().unwrap();
    (d.undo.len(), d.redo.len())
 }
 #[test]
 fn undo_and_redo_wait_while_an_undo_group_is_open() {
    let mut h = harness();
    assert_eq!(history(&h), (1, 1));
    let token = h.state_mut().session.group_begin("Long action").unwrap();
    h.run_steps(2);
    for button in ["Undo", "Redo"] {
        assert!(h.get_by_label(button).accesskit_node().is_disabled(), "{button} is off while the group is open");
        h.get_by_label(button).click();
        h.run_steps(2);
        assert!(h.state().message.is_none(), "{button}: no refusal is raised while the group is open");
        assert_eq!(history(&h), (1, 1), "{button}: the history is as it was");
    }
    h.state_mut().session.group_end(token).unwrap();
    h.run_steps(2);
    assert!(!h.get_by_label("Undo").accesskit_node().is_disabled() && !h.get_by_label("Redo").accesskit_node().is_disabled());
    // With the group ended, the buttons work again.
    h.get_by_label("Undo").click();
    h.run_steps(2);
    assert_eq!(history(&h), (0, 2));
    h.get_by_label("Redo").click();
    h.run_steps(2);
    assert_eq!(history(&h), (1, 1));
 }
@@ -1,6 +1,6 @@
 # Architecture
-> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-14 · **Change:** minor (bound Undo's retained cell storage) · **Target:** Microsoft Excel (Microsoft 365)
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-24 · **Change:** minor (engine building blocks for multi-command actions) · **Target:** Microsoft Excel (Microsoft 365)
 How GridCraft is built today. Rules for contributors are in [`AGENTS.md`](../AGENTS.md).
@@ -33,7 +33,10 @@ including tests, 2026-10-10.
   `Session::execute(id, params)`. Commands are `CommandSpec { id, label, menu, shortcut, params,
   enabled, run, journal, undoable }`; ids follow Excel's ribbon (`home.bold`, `insert.chart`,
   `data.sortAscending`) plus primitives (`cell.set`, `selection.set`, `range.setValues`).
-   `Session::execute` catches escaped panics and restores the workbook (never-crash guard).
+   `Session::execute` catches escaped panics and restores the workbook, its selection and its
   undo and redo history as they were before the command (never-crash guard); a group that was
   open before the command and that the command ended or rolled back stays ended and keeps a
   step from its start to the restored workbook, so Undo still returns to the state before it.
 2. **Edits** change the model through copy-on-write bands; undo keeps the previous snapshot.
   Undo retains at most 100 steps and trims older steps when its estimated retained cell storage
   exceeds 128 MiB. The newest step remains undoable even if that step alone exceeds the budget.
@@ -46,6 +49,49 @@ including tests, 2026-10-10.
 5. **Files**: `engine/io.rs` sniffs content (XLSX, XLSB, ODS) before trusting the extension and
   dispatches to `crates/xlsx`; imports that lose data return warnings shown to the user.
 ## Engine building blocks for multi-command actions
 Actions made of many commands (macros, a debugger that runs one step per call) use these parts of
 `Session` and the engine:
 - **Undo groups.** `Session::grouped(label, f)` runs `f` as one undo step and rolls every change
  back if `f` fails; `group_begin`, `group_end` and `group_rollback` do the same across calls.
  While a group is open on a document, its commands add no undo steps of their own and Undo and
  Redo are disabled there. Groups nest; the outermost one makes the step. A command that opens and
  closes its own groups still makes one undo step for itself, covering its edits inside and outside
  the groups. A command that ends a group open before it leaves the group its step and makes one
  of its own for what it changes after the end; a group a command opens and leaves open starts
  where the command did, but only when the command succeeds: a command that fails rolls back
  every group it opened, as `group_rollback` does. `Session::abort_groups(doc)`, and the command
  `automate.stopAction` on the active workbook, roll back the groups left open on a document (a
  debugger the person abandons, a caller that dropped its token), so Undo works there again. The
  history limit is applied when the outermost command finishes; until then the steps made inside
  it are bounded on their own.
 - **Recording buffer** (`record.rs`). `Session::start_recording` collects each successful
  top-level command with the document, sheet and selection it ran in, without secret parameters.
  Commands run by other commands are not recorded, nor is a menu-style call that only opened a
  dialog (the dialog's confirming call is the step), and the buffer is independent of the journal
  (Automate › Record Actions still records through the journal).
 - **Document trust.** `DocState::trust` is `Local` for workbooks made in the session and
  `FromFile` for workbooks opened from a file. `Trust` has no default: `DocState::new` takes it,
  so every way of making a document says where its content came from. It is also `FromFile` for
  workbooks that received a paste from one that writes formulas or validation: Paste, Paste
  Special › All, All Except Borders, Formulas, Formulas and Number Formats or Validation, and any
  linked paste other than column widths or notes. Values, formats, column widths and notes carry
  nothing active. Active content in a `FromFile` workbook asks before it runs. This is provenance,
  which no decision changes; `DocState::scripts_trusted` is the separate per-session consent for
  stored `automate.*` scripts (`automate.trustScripts`).
 - **Workbook data in hidden names** (`cmd/stash.rs`). An item is split over hidden
  workbook-scope names `_gc_<key>_0`, `_gc_<key>_1`, … of string literals within Excel's 255- and
  8,192-character limits, so it survives an xlsx round trip. Characters XML can't carry (controls
  other than tab, line feed and carriage return, U+FFFE, U+FFFF) are stored as the noncharacter
  U+FDD0 and four hex digits, as is U+FDD0 itself, and read back as they were. `stash::items`
  and `stash::keys` list the items under a key prefix in one pass over the names, at most
  10,000 of them (`stash::MAX_ITEMS`). The older single-name `_sc_<key>` items are read as well.
  `formulas.defineName` and `formulas.deleteName` refuse a name the workbook holds such an item
  under (a hidden workbook-scope name of either shape; a visible one is the person's own), and
  `formulas.createFromSelection` skips such labels, unless `force: true` is passed.
 ## Agent control
 - Desktop control channel: `gridcraft --control 7979`, JSON lines on localhost
@@ -71,5 +117,6 @@ rpm, tarball), FreeBSD, and web (WASM; WebGPU or WebGL2). Release workflows in
 | Date | Change | Summary |
 |---|---|---|
 | 2026-10-24 | minor | Engine building blocks for multi-command actions: undo groups, recording buffer, document trust, chunked hidden-name storage |
 | 2026-10-14 | minor | Document Undo's retained-cell-storage budget and latest-step guarantee |
 | 2026-10-10 | major | Created from the code on main: crates, layers, data flow, agent control, known gaps |