Merge origin/main into pr/form-controls

Conflicts:
- crates/xlsx/src/read.rs: main's names.unique() kept with this branch's
  (sheet, read_controls) result from read_sheet.
- crates/ui-egui/tests/it/keytips_generated.rs: regenerated with
  cargo xtask keytips from the merged keytips.json (413 sequences).
- docs/file-format-parity.md, docs/ui-parity.md: header and revision
  history keep main's entries and this branch's form-controls entries.

crates/engine/src/cmd/data/filter.rs

@@ -270,6 +270,7 @@ pub(crate) fn apply_filter(wb: &mut Workbook, sheet: usize) {
 
 pub(super) fn clear_filter(s: &mut Session, _: &Json) -> Result<Json> {
     let sheet = s.doc()?.wb.active_sheet();
+    crate::cmd::refuse_unless_allowed(s, sheet, "Filtering", |p| p.autofilter)?;
     edit(s, |cx| {
         let sh = cx.sheet_mut(sheet)?;
         if let Some(a) = sh.autofilter.as_mut() {
@@ -283,6 +284,7 @@ pub(super) fn clear_filter(s: &mut Session, _: &Json) -> Result<Json> {
 
 pub(super) fn reapply(s: &mut Session, _: &Json) -> Result<Json> {
     let sheet = s.doc()?.wb.active_sheet();
+    crate::cmd::refuse_unless_allowed(s, sheet, "Filtering", |p| p.autofilter)?;
     edit(s, |cx| {
         apply_filter(&mut cx.wb, sheet);
         cx.structural = true;

crates/engine/src/cmd/data/grouping.rs

@@ -21,6 +21,15 @@ fn outline_lines(s: &Session, p: &Json) -> Result<(bool, u32, u32)> {
     }
 }
 
+/// Outline commands change line visibility and grouping: a protected sheet must allow formatting that axis.
+fn refuse_unless_outline_allowed(s: &Session, sheet: usize, rows: bool) -> Result<()> {
+    if rows {
+        crate::cmd::refuse_unless_allowed(s, sheet, "Formatting rows", |p| p.format_rows)
+    } else {
+        crate::cmd::refuse_unless_allowed(s, sheet, "Formatting columns", |p| p.format_columns)
+    }
+}
+
 pub(super) fn group(s: &mut Session, p: &Json, on: bool) -> Result<Json> {
     let si = target_sheet(s, p)?;
     // The selection belongs to the active sheet, so another sheet needs its lines.
@@ -28,6 +37,7 @@ pub(super) fn group(s: &mut Session, p: &Json, on: bool) -> Result<Json> {
         return Err(bad(if on { "data.group" } else { "data.ungroup" }, "missing `rows` or `cols`: the selection is on the active sheet"));
     }
     let (rows, a, b) = outline_lines(s, p)?;
+    refuse_unless_outline_allowed(s, si, rows)?;
     edit(s, |cx| {
         let sh = cx.sheet_mut(si)?;
         let before = outline::summary_before(sh, rows);
@@ -58,6 +68,7 @@ pub(super) fn group(s: &mut Session, p: &Json, on: bool) -> Result<Json> {
 /// + button, saved to XLSX); showing keeps inner groups that were collapsed on their own collapsed.
 pub(super) fn detail(s: &mut Session, p: &Json, hide: bool) -> Result<Json> {
     let (rows, a, b) = outline_lines(s, p)?;
+    refuse_unless_outline_allowed(s, s.doc()?.wb.active_sheet(), rows)?;
     let want = p.get("level").and_then(Json::as_u64).map(|l| l.min(outline::MAX_LEVEL as u64) as u8);
     edit(s, |cx| {
         let si = cx.sheet_index();
@@ -123,6 +134,12 @@ pub(super) fn show_levels(s: &mut Session, p: &Json) -> Result<Json> {
             msg: "give `rows` or `cols`: the outline level to show (1 = top-level summaries only)".into(),
         });
     }
+    let active = s.doc()?.wb.active_sheet();
+    for (n, is_rows) in [(rows, true), (cols, false)] {
+        if n.is_some() {
+            refuse_unless_outline_allowed(s, active, is_rows)?;
+        }
+    }
     edit(s, |cx| {
         let si = cx.sheet_index();
         let sh = cx.sheet_mut(si)?;

crates/engine/src/cmd/data/tests.rs

@@ -480,6 +480,45 @@ fn a_list_typed_without_quotes_is_saved_as_a_quoted_list() {
     assert_eq!(sheet_xml(&reopened), xml, "a second save writes the same rules");
 }
 
+#[test]
+fn a_relative_list_source_is_read_from_the_cell_being_checked() {
+    // As in Excel, `=$B1:$B2` on A3:A4,A1:A2 is written for A1 (the top-left cell of all the
+    // areas) and lists B4:B5 at A4. It used to list B1:B2 in every cell.
+    let mut s = Session::new();
+    s.new_workbook();
+    s.execute("range.setValues", json!({"range": "B1:B5", "values": [["a"], ["b"], ["c"], ["d"], ["e"]]})).unwrap();
+    s.execute("data.validation", json!({"range": "A3:A4,A1:A2", "type": "list", "formula1": "=$B1:$B2"})).unwrap();
+    let wb = s.doc().unwrap().wb.clone();
+    let dv = wb.active().unwrap().validations[0].clone();
+    for (cell, items) in [("A1", ["a", "b"]), ("A2", ["b", "c"]), ("A3", ["c", "d"]), ("A4", ["d", "e"])] {
+        let at = CellRef::parse(cell).unwrap();
+        assert_eq!(list_items(&wb, 0, at, &dv), items, "{cell}");
+        for v in ["a", "b", "c", "d", "e"] {
+            assert_eq!(check_validation(&wb, 0, at, v).is_none(), items.contains(&v), "{cell} with {v}");
+        }
+    }
+}
+
+#[test]
+fn a_list_source_that_takes_in_the_cell_does_not_list_the_value_being_typed() {
+    // `=$A1:$A2` on A2:A3 is A1:A2 at A2 and A2:A3 at A3. The list is the one before the entry, as
+    // in Excel; a new value used to land in its own source and pass.
+    let mut s = Session::new();
+    s.new_workbook();
+    s.execute("range.setValues", json!({"range": "A1:A2", "values": [["x"], ["y"]]})).unwrap();
+    s.execute("data.validation", json!({"range": "A2:A3", "type": "list", "formula1": "=$A1:$A2"})).unwrap();
+    let wb = &s.doc().unwrap().wb;
+    for (cell, accepted, refused) in [("A2", &["x", "y"][..], &["new"][..]), ("A3", &["y"], &["x", "new"])] {
+        let at = CellRef::parse(cell).unwrap();
+        for v in accepted {
+            assert!(check_validation(wb, 0, at, v).is_none(), "{cell} refuses {v}");
+        }
+        for v in refused {
+            assert!(check_validation(wb, 0, at, v).is_some(), "{cell} accepts {v}");
+        }
+    }
+}
+
 #[test]
 fn a_rule_with_an_unknown_type_operator_or_error_style_is_refused() {
     // A typo used to give a rule that validates nothing (`type="none"`) or the wrong check,

crates/engine/src/cmd/data/validation.rs

@@ -38,11 +38,18 @@ fn subtract_range(r: RangeRef, cut: &RangeRef) -> Vec<RangeRef> {
 }
 
 /// Removes the cells of `cuts` from every validation, keeping the rest of each rule's ranges.
+/// When the rule's top-left cell goes, its relative formulas are rewritten for the new top-left
+/// cell, so the cells left keep checking the same cells.
 pub(in super::super) fn remove_validation_cells(validations: &mut Vec<Validation>, cuts: &[RangeRef]) {
     for dv in validations.iter_mut() {
+        let before = RangeRef::top_left(&dv.ranges);
         for cut in cuts {
             dv.ranges = dv.ranges.iter().flat_map(|r| subtract_range(*r, cut)).collect();
         }
+        if let (Some(from), Some(to)) = (before, RangeRef::top_left(&dv.ranges)) {
+            dv.f1 = move_rule_formula(&dv.f1, from, to);
+            dv.f2 = dv.f2.take().map(|f| move_rule_formula(&f, from, to));
+        }
     }
     validations.retain(|d| !d.ranges.is_empty());
 }
@@ -145,8 +152,10 @@ fn list_source(f: &str) -> String {
     format!("\"{}\"", t.replace('"', "\"\""))
 }
 
-/// List entries of a list validation (literal or from a range).
-pub fn list_items(wb: &Workbook, sheet: usize, dv: &Validation) -> Vec<String> {
+/// List entries of a list validation (literal or from a range) for the cell `at`. A relative
+/// source is written for the rule's top-left cell and read from `at`, as in Excel (`=$B1:$B3` on
+/// A1:A9 lists B5:B7 at A5).
+pub fn list_items(wb: &Workbook, sheet: usize, at: CellRef, dv: &Validation) -> Vec<String> {
     let f = dv.f1.trim();
     if is_literal_list(f) {
         // A quoted list is a string literal: `""` inside stands for one `"`.
@@ -156,8 +165,8 @@ pub fn list_items(wb: &Workbook, sheet: usize, dv: &Validation) -> Vec<String> {
         };
         return items.split(',').map(|x| x.trim().to_string()).filter(|x| !x.is_empty()).collect();
     }
-    let at = dv.ranges.first().map(|r| r.start).unwrap_or_default();
-    match gridcraft_calc::evaluate(wb, sheet, at, f) {
+    let first = RangeRef::top_left(&dv.ranges).unwrap_or(at);
+    match gridcraft_calc::evaluate(wb, sheet, at, &formula_at(f, first, at)) {
         Value::Array(a) => a.data.iter().filter(|v| !v.is_empty()).map(Value::display).collect(),
         v if !v.is_empty() && !v.is_error() => vec![v.display()],
         _ => vec![],
@@ -175,9 +184,10 @@ pub fn check_validation(wb: &Workbook, sheet: usize, at: CellRef, input: &str) -
         return None;
     }
     let v = gridcraft_core::parse::parse_input(input, wb.date_system).value;
-    // The formulas are written for the first cell of the range and see the value being entered,
+    // The formulas are written for the top-left cell of all the areas and see the value being entered,
     // as in Excel (a custom `=A1>10` on A1:A9 checks A5's new value at A5).
-    let first = dv.ranges.first().map(|r| r.start).unwrap_or(at);
+    let first = RangeRef::top_left(&dv.ranges).unwrap_or(at);
+    let original = wb;
     let entered;
     let wb = if sh.value(at) == v {
         wb
@@ -193,7 +203,9 @@ pub fn check_validation(wb: &Workbook, sheet: usize, at: CellRef, input: &str) -
     let eval = |f: &str| gridcraft_calc::evaluate(wb, sheet, at, &formula_at(f, first, at));
     let num = |f: &str| eval(f).to_number().ok();
     let ok = match dv.kind {
-        ValidationKind::List => list_items(wb, sheet, dv).iter().any(|x| x.eq_ignore_ascii_case(input)),
+        // The list is the one the dropdown showed before the entry, as in Excel: a source that takes
+        // in the cell itself (`=$A1:$A2` on A2:A3 is A2:A3 at A3) doesn't list the value being typed.
+        ValidationKind::List => list_items(original, sheet, at, dv).iter().any(|x| x.eq_ignore_ascii_case(input)),
         ValidationKind::Custom => eval(&dv.f1).to_bool().unwrap_or(false),
         ValidationKind::TextLength => {
             let n = input.chars().count() as f64;

crates/engine/src/cmd/edit.rs

@@ -23,7 +23,7 @@ use cell::{cell_set, range_fill, range_set_values};
 pub(crate) use cell::{check_arg_counts, input_to_cell, is_formula_input, json_to_input, parse_typed_formula};
 #[cfg(test)]
 pub(crate) use clipboard::parse_tsv;
-use clipboard::{clear_clipboard, copy, cut, paste};
+use clipboard::{clear_clipboard, copy, cut, paste, range_move};
 use fill::{auto_fill, fill_dir, fill_series, flash_fill};
 #[cfg(test)]
 use find::replace_ci;
@@ -36,7 +36,7 @@ use go_to::go_to_special;
 use go_to::{GO_TO_MAX_AREAS, GO_TO_RECENT, reference_parts};
 use paste_special::paste_special;
 pub(crate) use paste_special::{rewrite_all_formulas, rewrite_cell_links, rewrite_python_refs};
-use selection::{select_all, select_col, select_region, select_row, selection_move, selection_next, selection_set};
+use selection::{select_all, select_col, select_region, select_row, selection_move, selection_next, selection_next_corner, selection_set};
 
 pub fn specs() -> Vec<CommandSpec> {
     vec![
@@ -62,6 +62,15 @@ pub fn specs() -> Vec<CommandSpec> {
         cmd!(noundo "selection.set", "Select", [], None, "{range: \"A1:B2,D4\" | cell, active?: \"A1\", sheet?}", has_doc, selection_set),
         cmd!(noundo "selection.move", "Move Selection", [], None, "{dr, dc, extend?: bool, jump?: bool (Ctrl+arrow), page?: bool}", has_doc, selection_move),
         cmd!(noundo "selection.next", "Next Cell in Selection", [], None, "{forward?: true, byRow?: false} (Enter/Tab inside a selection)", has_doc, selection_next),
+        cmd!(
+            noundo "selection.nextCorner",
+            "Next Corner of Selection",
+            [],
+            Some("Ctrl+."),
+            "{} (the active cell moves clockwise to the next corner of the selected area, which stays selected)",
+            has_doc,
+            selection_next_corner
+        ),
         cmd!(noundo "edit.selectAll", "Select All", ["Edit"], Some("Cmd+A"), "{} (current region first, then the whole sheet)", has_doc, select_all),
         cmd!(noundo "selection.currentRegion", "Select Current Region", [], Some("Ctrl+Shift+8"), "{}", has_doc, select_region),
         cmd!(noundo "selection.row", "Select Entire Row", [], Some("Shift+Space"), "{}", has_doc, select_row),
@@ -81,6 +90,15 @@ pub fn specs() -> Vec<CommandSpec> {
             has_doc,
             paste
         ),
+        cmd!(
+            "range.move",
+            "Drag and Drop",
+            [],
+            None,
+            "{range?, to: \"C3\", overwrite?: bool} (drag the selection's border: a cut and paste that asks before replacing data unless overwrite)",
+            has_doc,
+            range_move
+        ),
         CommandSpec {
             shortcut_mac: Some("Ctrl+Cmd+V"),
             ..cmd!(
@@ -126,13 +144,13 @@ pub fn specs() -> Vec<CommandSpec> {
             fill_series
         ),
         cmd!("edit.flashFill", "Flash Fill", ["Home", "Editing", "Fill"], Some("Ctrl+E"), "{range?}", has_doc, flash_fill),
-        cmd!(noundo "edit.find", "Find…", ["Home", "Editing", "Find & Select"], Some("Cmd+F"), "{what, matchCase?, wholeCell?, lookIn?: formulas|values, byColumns?, all?: bool, within?: sheet|workbook}", has_doc, find),
+        cmd!(noundo "edit.find", "Find…", ["Home", "Editing", "Find & Select"], Some("Cmd+F"), "{what, matchCase?, wholeCell?, lookIn?: formulas|values, byColumns?, all?: bool, within?: sheet|workbook|selection} (selection: only the selected cells; Find Next keeps them selected and moves the active cell)", has_doc, find),
         cmd!(
             "edit.replace",
             "Replace…",
             ["Home", "Editing", "Find & Select"],
             Some("Ctrl+H"),
-            "{what, with, matchCase?, wholeCell?, all?: true, within?: sheet|workbook} → {replaced, skipped?} (in a Python cell the code is edited; skipped counts Python cells whose code would no longer fit)",
+            "{what, with, matchCase?, wholeCell?, all?: true, within?: sheet|workbook|selection} → {replaced, skipped?} (in a Python cell the code is edited; skipped counts Python cells whose code would no longer fit)",
             has_doc,
             replace
         ),
@@ -244,21 +262,36 @@ fn clear(s: &mut Session, p: &Json, what: &str) -> Result<Json> {
             })
         })
     };
+    // Notes and links aren't cell contents, so the cell comparison that guards a protected sheet
+    // doesn't see them go: a locked cell's are refused here, stored cell or not.
+    if matches!(what, "all" | "comments" | "hyperlinks") {
+        let d = s.doc()?;
+        if let Some(sh) = d.wb.sheet(sheet).filter(|sh| sh.is_protected()) {
+            for &whole in &ranges {
+                let skip = filtered_rows(sh, whole);
+                let notes = matches!(what, "all" | "comments").then(|| sh.comments.keys()).into_iter().flatten();
+                let links = matches!(what, "all" | "hyperlinks").then(|| sh.hyperlinks.keys()).into_iter().flatten();
+                for &c in notes.chain(links).filter(|c| whole.contains(**c) && !skip.contains(&c.row)) {
+                    if d.wb.styles.get(sh.style_id(c)).protection.locked
+                        && let Some(m) = locked_cell_error(sh, c, &d.unlocked_ranges)
+                    {
+                        return Err(EngineError::Other(m));
+                    }
+                }
+            }
+        }
+    }
     edit(s, |cx| {
-        for r in &ranges {
-            let r = match cx.wb.sheet(sheet).and_then(|sh| sh.used_range()) {
-                Some(u) => match r.intersection(&u) {
-                    Some(x) => x,
-                    None => continue,
-                },
-                None => continue,
+        for &whole in &ranges {
+            // Cells are only stored inside the used range. Notes and links are kept apart from
+            // them, so they are cleared over the whole range: one from a file can sit on a cell
+            // with nothing stored in it.
+            let used = cx.wb.sheet(sheet).and_then(|sh| sh.used_range()).and_then(|u| whole.intersection(&u));
+            let skip = cx.wb.sheet(sheet).map(|sh| filtered_rows(sh, whole)).unwrap_or_default();
+            let cells: Vec<(CellRef, Cell)> = match (cx.wb.sheet(sheet), used) {
+                (Some(sh), Some(r)) => sh.cells.iter_range(r).filter(|(c, _)| !skip.contains(&c.row)).map(|(c, x)| (c, x.clone())).collect(),
+                _ => Vec::new(),
             };
-            let skip = cx.wb.sheet(sheet).map(|sh| filtered_rows(sh, r)).unwrap_or_default();
-            let cells: Vec<(CellRef, Cell)> = cx
-                .wb
-                .sheet(sheet)
-                .map(|sh| sh.cells.iter_range(r).filter(|(c, _)| !skip.contains(&c.row)).map(|(c, x)| (c, x.clone())).collect())
-                .unwrap_or_default();
             // Report every stored cell we touch, even beyond a million coordinates in a sparse
             // selection. Removed formula anchors must also reach calc so their spills disappear.
             cx.changed.extend(cells.iter().map(|(c, _)| (sheet, *c)));
@@ -278,6 +311,18 @@ fn clear(s: &mut Session, p: &Json, what: &str) -> Result<Json> {
                     }
                 }
             }
+            let cleared = |c: CellRef| whole.contains(c) && !skip.contains(&c.row);
+            // A removed note or link changes its cell even with nothing stored there.
+            let metadata: Vec<CellRef> = cx
+                .wb
+                .sheet(sheet)
+                .map(|sh| {
+                    let notes = matches!(what, "all" | "comments").then(|| sh.comments.keys()).into_iter().flatten();
+                    let links = matches!(what, "all" | "hyperlinks").then(|| sh.hyperlinks.keys()).into_iter().flatten();
+                    notes.chain(links).copied().filter(|c| cleared(*c)).collect()
+                })
+                .unwrap_or_default();
+            cx.changed.extend(metadata.into_iter().map(|c| (sheet, c)));
             let sh = cx.sheet_mut(sheet)?;
             for (c, mut cell) in cells {
                 match what {
@@ -294,14 +339,15 @@ fn clear(s: &mut Session, p: &Json, what: &str) -> Result<Json> {
                     _ => {}
                 }
             }
-            let cleared = |c: CellRef| r.contains(c) && !skip.contains(&c.row);
             if matches!(what, "all" | "comments") {
                 sh.comments.retain(|c, _| !cleared(*c));
             }
             if matches!(what, "all" | "hyperlinks") {
                 sh.hyperlinks.retain(|c, _| !cleared(*c));
             }
-            if matches!(what, "all" | "formats") {
+            if let Some(r) = used
+                && matches!(what, "all" | "formats")
+            {
                 let mut unmerged = false;
                 sh.merges.retain(|m| {
                     let keep = !r.contains_range(m) || skip.range(m.start.row..=m.end.row).next().is_some();

crates/engine/src/cmd/edit/clipboard.rs

@@ -1,7 +1,8 @@
 use super::cell::input_to_cell;
 use super::paste_special::paste_special;
 use super::{
-    Cell, Clipboard, EngineError, Json, RangeRef, Result, Session, Value, cell_param_on, edit, json, ok, str_param, target_ranges, target_sheet,
+    Cell, Clipboard, EngineError, Json, RangeRef, Result, Session, Value, bad, bool_param, cell_param_on, edit, json, ok, str_param, target_ranges,
+    target_sheet,
 };
 
 // ---------------------------------------------------------------- clipboard
@@ -163,6 +164,40 @@ pub(super) fn paste(s: &mut Session, p: &Json) -> Result<Json> {
     paste_special(s, &json!({"what": "all", "at": p.get("at").cloned().unwrap_or(Json::Null)}))
 }
 
+/// Drag and drop (dragging the selection's border): moves `range` so its top-left cell lands on
+/// `to`, as Cut and Paste would. Like Excel, it asks before replacing cells that hold data or show a
+/// spilled value (other than the moved cells themselves); run it again with `overwrite: true` to replace them. A
+/// refused or failed move leaves the clipboard as it was.
+pub(super) fn range_move(s: &mut Session, p: &Json) -> Result<Json> {
+    let sheet = target_sheet(s, p)?;
+    let to = cell_param_on(s, p, "to", sheet)?.ok_or_else(|| bad("range.move", "missing `to`"))?;
+    let kept = s.clipboard.take();
+    let moved = cut(s, p).and_then(|_| {
+        let src = s.clipboard.as_ref().map(|c| c.range).unwrap_or_default();
+        let dest = to.offset(i64::from(src.height()) - 1, i64::from(src.width()) - 1).map(|end| RangeRef::new(to, end));
+        if bool_param(p, "overwrite") != Some(true)
+            && let Some(dest) = dest
+            && let Some(sh) = s.doc()?.wb.sheet(sheet)
+            && (sh.cells.iter_range(dest).any(|(c, cell)| !src.contains(c) && cell.has_content())
+                || sh.spill.range(dest.start..=dest.end).any(|(c, v)| dest.contains(*c) && !src.contains(*c) && *v != Value::Empty))
+        {
+            return Err(EngineError::Confirm("There's already data here. Do you want to replace it?".into()));
+        }
+        // On the range's sheet, which `paste` would leave to the active one. The selection
+        // belongs to the active sheet: it follows the moved cells only when they are on it.
+        let selection = s.doc()?.selection.clone();
+        let pasted = paste_special(s, &json!({"what": "all", "at": to.a1(), "sheet": sheet}))?;
+        if sheet != s.doc()?.wb.active_sheet() {
+            s.doc_mut()?.selection = selection;
+        }
+        Ok(pasted)
+    });
+    if moved.is_err() {
+        s.clipboard = kept;
+    }
+    moved
+}
+
 fn paste_text(s: &mut Session, p: &Json, text: &str) -> Result<Json> {
     let sheet = target_sheet(s, p)?;
     let at = cell_param_on(s, p, "at", sheet)?.unwrap_or(s.doc()?.selection.current().start);
@@ -226,16 +261,55 @@ pub(crate) fn parse_tsv(text: &str) -> Vec<Vec<String>> {
     let mut row = Vec::new();
     let mut field = String::new();
     let mut chars = text.chars().peekable();
+    // Text read again as unquoted, ahead of the rest of the input: a field that opened with a
+    // quote but turned out not to be quoted.
+    let mut replay: std::collections::VecDeque<char> = std::collections::VecDeque::new();
+    // Text is replayed at most as much as the input is long; past that, quotes are text, so
+    // hostile input full of fields that only look quoted reads in linear time.
+    let mut replay_budget = text.len();
     let mut quoted = false;
     let mut at_start = true;
-    while let Some(c) = chars.next() {
+    // A quoted field's text as it stands in the input, for a field that turns out not to be one.
+    let mut raw = String::new();
+    loop {
+        let c = match replay.pop_front().or_else(|| chars.next()) {
+            Some(c) => c,
+            // A quote that never closes: the field is its text as written.
+            None if quoted => {
+                quoted = false;
+                field.clear();
+                field.push('"');
+                replay_budget = replay_budget.saturating_sub(raw.len());
+                replay.extend(raw.chars().skip(1));
+                raw.clear();
+                continue;
+            }
+            None => break,
+        };
         if quoted {
+            raw.push(c);
             if c == '"' {
-                if chars.peek() == Some(&'"') {
+                let next = replay.front().copied().or_else(|| chars.peek().copied());
+                if next == Some('"') {
                     field.push('"');
-                    chars.next();
+                    raw.push('"');
+                    if replay.pop_front().is_none() {
+                        chars.next();
+                    }
                 } else {
                     quoted = false;
+                    // A field is quoted only when its closing quote ends it, as Excel reads it:
+                    // `"hi" there` is that text, quotes included, and a tab or line break inside
+                    // it still ends the cell, as if the leading quote weren't there.
+                    if !matches!(next, None | Some('\t' | '\n' | '\r')) {
+                        field.clear();
+                        field.push('"');
+                        replay_budget = replay_budget.saturating_sub(raw.len());
+                        let rest: Vec<char> = std::mem::take(&mut raw).chars().skip(1).collect();
+                        for ch in rest.into_iter().rev() {
+                            replay.push_front(ch);
+                        }
+                    }
                 }
             } else {
                 field.push(c);
@@ -243,9 +317,10 @@ pub(crate) fn parse_tsv(text: &str) -> Vec<Vec<String>> {
             continue;
         }
         match c {
-            '"' if at_start => {
+            '"' if at_start && replay_budget > 0 => {
                 quoted = true;
                 at_start = false;
+                raw = String::from('"');
             }
             '\t' => {
                 row.push(std::mem::take(&mut field));

crates/engine/src/cmd/edit/find.rs

@@ -62,6 +62,8 @@ pub(super) fn find(s: &mut Session, p: &Json) -> Result<Json> {
     let by_cols = bool_param(p, "byColumns").unwrap_or(false);
     let all = bool_param(p, "all").unwrap_or(false);
     let workbook = str_param(p, "within") == Some("workbook");
+    // `selection`: only the selected cells of the active sheet, as Excel searches a selected range.
+    let in_selection = str_param(p, "within") == Some("selection");
     s.last_find = Some(p.clone());
     let d = s.doc()?;
     let sheets: Vec<usize> = if workbook { (0..d.wb.sheets.len()).collect() } else { vec![d.wb.active_sheet()] };
@@ -71,6 +73,7 @@ pub(super) fn find(s: &mut Session, p: &Json) -> Result<Json> {
         let mut cells: Vec<(CellRef, String)> = sh
             .cells
             .iter()
+            .filter(|(c, _)| !in_selection || d.selection.contains(*c))
             .filter_map(|(c, cell)| {
                 let text = if values || cell.formula.is_none() || crate::display::formula_hidden(&d.wb, sh, c) {
                     crate::display::cell_text(&d.wb, sh, c)
@@ -100,7 +103,12 @@ pub(super) fn find(s: &mut Session, p: &Json) -> Result<Json> {
     let Some((si, c, t)) = next else { return Err(EngineError::Other("not found".into())) };
     let dd = s.doc_mut()?;
     dd.wb_switch_sheet(si);
-    dd.selection = crate::Selection::at(c);
+    if in_selection {
+        // The range stays selected and the active cell moves through it, as in Excel.
+        dd.selection.active = c;
+    } else {
+        dd.selection = crate::Selection::at(c);
+    }
     Ok(json!({"cell": c.a1(), "sheet": si, "value": t, "count": hits.len()}))
 }
 
@@ -114,6 +122,7 @@ pub(super) fn replace(s: &mut Session, p: &Json) -> Result<Json> {
     let whole = bool_param(p, "wholeCell").unwrap_or(false);
     let all = bool_param(p, "all").unwrap_or(true);
     let workbook = str_param(p, "within") == Some("workbook");
+    let selection = (str_param(p, "within") == Some("selection")).then(|| s.doc().map(|d| d.selection.clone())).transpose()?;
     let active = s.doc()?.selection.active;
     let mut skipped = 0usize;
     let n = edit(s, |cx| {
@@ -123,7 +132,7 @@ pub(super) fn replace(s: &mut Session, p: &Json) -> Result<Json> {
             let cells: Vec<(CellRef, String)> =
                 cx.wb.sheet(si).map(|sh| sh.cells.iter().map(|(c, _)| (c, sh.input_text(c))).collect()).unwrap_or_default();
             for (c, text) in cells {
-                if !all && c != active {
+                if (!all && c != active) || selection.as_ref().is_some_and(|sel| !sel.contains(c)) {
                     continue;
                 }
                 if !matches(&text, &what, case, whole) {

crates/engine/src/cmd/edit/paste_special.rs

@@ -284,7 +284,7 @@ pub(super) fn paste_special(s: &mut Session, p: &Json) -> Result<Json> {
                 crate::cmd::data::remove_validation_cells(&mut sh.validations, &[RangeRef::new(dest, dest)]);
                 if let Some(mut dv) = rule {
                     // Relative references move with the rule, as pasted formulas do.
-                    let first = dv.ranges.first().map_or(sc, |r| r.start);
+                    let first = RangeRef::top_left(&dv.ranges).unwrap_or(sc);
                     dv.f1 = crate::cmd::data::move_rule_formula(&dv.f1, first, dest);
                     dv.f2 = dv.f2.map(|f| crate::cmd::data::move_rule_formula(&f, first, dest));
                     dv.ranges = vec![RangeRef::new(dest, dest)];

crates/engine/src/cmd/edit/selection.rs

@@ -137,6 +137,23 @@ pub(super) fn selection_next(s: &mut Session, p: &Json) -> Result<Json> {
     Ok(json!({"active": d.selection.active.a1()}))
 }
 
+pub(super) fn selection_next_corner(s: &mut Session, _: &Json) -> Result<Json> {
+    let d = s.doc_mut()?;
+    let Some(sheet) = d.wb.active() else { return Err(EngineError::NoDocument) };
+    // A corner in a merged cell lands on its top-left cell. One in a hidden row or column, one
+    // the sheet's protection doesn't let you select, and a merged cell that starts outside the
+    // selected area are skipped.
+    let area = d.selection.current();
+    let stop = |c: CellRef| {
+        Some(sheet.merge_at(c).map_or(c, |m| m.start))
+            .filter(|c| area.contains(*c) && !sheet.is_row_hidden(c.row) && !sheet.is_col_hidden(c.col) && cell_selectable(&d.wb, sheet, *c))
+    };
+    let mut next = d.selection.clone();
+    next.next_corner_by(stop);
+    d.selection = next;
+    Ok(json!({"active": d.selection.active.a1(), "selection": d.selection.a1()}))
+}
+
 pub(super) fn select_all(s: &mut Session, _: &Json) -> Result<Json> {
     let d = s.doc_mut()?;
     let Some(sheet) = d.wb.active() else { return Err(EngineError::NoDocument) };

crates/engine/src/cmd/edit/tests.rs

@@ -307,6 +307,9 @@ fn tsv() {
     assert_eq!(parse_tsv("a\tb\n1\t2\n"), vec![vec!["a", "b"], vec!["1", "2"]]);
     assert_eq!(parse_tsv("\"x\ty\"\tz"), vec![vec!["x\ty", "z"]]);
     assert_eq!(parse_tsv("\"he said \"\"hi\"\"\""), vec![vec!["he said \"hi\""]]);
+    // #2225: a quote that doesn't close the field leaves it as written, as Excel pastes it.
+    assert_eq!(parse_tsv("\"hi\" there\tx\n"), vec![vec!["\"hi\" there", "x"]]);
+    assert_eq!(parse_tsv("say \"hi\"\n"), vec![vec!["say \"hi\""]]);
 }
 
 #[test]
@@ -353,6 +356,74 @@ fn cut_paste_that_overflows_the_grid_moves_nothing() {
     assert_eq!(get(&mut s, "XFD2")["value"], json!(2.0));
 }
 
+#[test]
+fn drag_and_drop_asks_before_replacing_data() {
+    // #3136: dragging column B's border onto column A replaced A without asking.
+    let mut s = Session::new();
+    s.new_workbook();
+    s.execute("range.setValues", json!({"range": "A1:B3", "values": [["Apple", "Kiwi"], ["Pear", "Plum"], ["Fig", "Lime"]]})).unwrap();
+    s.execute("edit.copy", json!({"range": "D9"})).unwrap();
+    let text = |s: &mut Session, a: &str| s.execute("cell.get", json!({"cell": a})).unwrap()["input"].clone();
+    let r = s.execute("range.move", json!({"range": "B:B", "to": "A1"}));
+    let Err(EngineError::Confirm(q)) = r else { panic!("{r:?}") };
+    assert_eq!(q, "There's already data here. Do you want to replace it?");
+    // Nothing moved, and the copy made before is still on the clipboard.
+    assert_eq!(text(&mut s, "A1"), json!("Apple"));
+    assert_eq!(text(&mut s, "B1"), json!("Kiwi"));
+    assert!(s.clipboard.as_ref().is_some_and(|c| !c.cut && c.range.a1() == "D9"));
+    // Confirmed, column B replaces column A.
+    s.execute("range.move", json!({"range": "B:B", "to": "A1", "overwrite": true})).unwrap();
+    assert_eq!(text(&mut s, "A1"), json!("Kiwi"));
+    assert_eq!(text(&mut s, "A3"), json!("Lime"));
+    assert_eq!(text(&mut s, "B1"), json!(""));
+    // Onto empty cells, or overlapping only the moved cells themselves, nothing is asked.
+    s.execute("range.move", json!({"range": "A1:A3", "to": "A2"})).unwrap();
+    assert_eq!(text(&mut s, "A4"), json!("Lime"));
+    s.execute("range.move", json!({"range": "A2:A4", "to": "C2"})).unwrap();
+    assert_eq!(text(&mut s, "C2"), json!("Kiwi"));
+    assert!(s.execute("range.move", json!({"range": "C2"})).is_err(), "`to` is required");
+}
+
+#[test]
+fn drag_and_drop_asks_before_replacing_spilled_values() {
+    // Cells showing a dynamic array's spilled values hold no cell of their own, but they are data.
+    let mut s = Session::new();
+    s.new_workbook();
+    s.execute("cell.set", json!({"cell": "A1", "input": "=SEQUENCE(3)"})).unwrap();
+    s.execute("range.setValues", json!({"range": "C2:C3", "values": [["Kiwi"], ["Plum"]]})).unwrap();
+    let r = s.execute("range.move", json!({"range": "C2:C3", "to": "A2"}));
+    let Err(EngineError::Confirm(q)) = r else { panic!("{r:?}") };
+    assert_eq!(q, "There's already data here. Do you want to replace it?");
+    let sh = s.doc().unwrap().wb.active().unwrap();
+    assert_eq!(sh.value(CellRef::new(2, 2)), Value::text("Plum"));
+    s.execute("range.move", json!({"range": "C2:C3", "to": "A2", "overwrite": true})).unwrap();
+    let sh = s.doc().unwrap().wb.active().unwrap();
+    assert_eq!(sh.value(CellRef::new(1, 0)), Value::text("Kiwi"));
+}
+
+#[test]
+fn drag_and_drop_on_another_sheet_stays_on_that_sheet() {
+    // The move was checked on the range's sheet but pasted on the active one, replacing its data
+    // without asking.
+    let mut s = Session::new();
+    s.new_workbook();
+    s.execute("home.insertSheet", json!({"name": "Two"})).unwrap();
+    s.execute("range.setValues", json!({"range": "B1:B2", "values": [["Kiwi"], ["Plum"]]})).unwrap();
+    s.execute("sheet.activate", json!({"sheet": 0})).unwrap();
+    s.execute("cell.set", json!({"cell": "A1", "input": "Keep"})).unwrap();
+    s.execute("selection.set", json!({"range": "C5"})).unwrap();
+    s.execute("range.move", json!({"range": "Two!B1:B2", "to": "A1"})).unwrap();
+    // Sheet1 stays active with its own selection; the moved cells are on Two.
+    assert_eq!(s.doc().unwrap().wb.active_sheet(), 0);
+    assert_eq!(s.doc().unwrap().selection.a1(), "C5");
+    let wb = &s.doc().unwrap().wb;
+    let two = wb.sheet_index("Two").unwrap();
+    assert_eq!(wb.sheet(0).unwrap().value(CellRef::new(0, 0)), Value::text("Keep"));
+    assert_eq!(wb.sheet(two).unwrap().value(CellRef::new(0, 0)), Value::text("Kiwi"));
+    assert_eq!(wb.sheet(two).unwrap().value(CellRef::new(1, 0)), Value::text("Plum"));
+    assert_eq!(wb.sheet(two).unwrap().value(CellRef::new(0, 1)), Value::Empty);
+}
+
 #[test]
 fn replace_case_insensitive() {
     assert_eq!(replace_ci("Apple apple APPLE", "apple", "pear"), "pear pear pear");
@@ -371,3 +442,141 @@ fn replace_case_insensitive_keeps_text_when_folding_moves_boundaries() {
     let sh = s.doc().unwrap().wb.active().unwrap();
     assert_eq!(sh.value(CellRef::new(0, 0)), Value::text(text));
 }
+
+#[test]
+fn next_corner_of_selection_goes_clockwise_and_anchors_there() {
+    // #1442, as Excel does it: B2 → D2 → D4 → B4 → B2, the area stays selected, and Shift+arrows
+    // then move the corner opposite the new active cell.
+    let mut s = Session::new();
+    s.new_workbook();
+    s.execute("selection.set", json!({"range": "B2:D4", "active": "B2"})).unwrap();
+    let mut seen = Vec::new();
+    for _ in 0..4 {
+        let r = s.execute("selection.nextCorner", json!({})).unwrap();
+        assert_eq!(r["selection"], "B2:D4");
+        seen.push(r["active"].as_str().unwrap().to_string());
+    }
+    assert_eq!(seen, ["D2", "D4", "B4", "B2"]);
+    s.execute("selection.nextCorner", json!({})).unwrap();
+    s.execute("selection.nextCorner", json!({})).unwrap();
+    s.execute("selection.move", json!({"dr": 0, "dc": 1, "extend": true})).unwrap();
+    assert_eq!(s.doc().unwrap().selection.current().a1(), "C2:D4");
+    // One row goes end to end; a single cell stays.
+    s.execute("selection.set", json!({"range": "B2:D2", "active": "B2"})).unwrap();
+    assert_eq!(s.execute("selection.nextCorner", json!({})).unwrap()["active"], "D2");
+    assert_eq!(s.execute("selection.nextCorner", json!({})).unwrap()["active"], "B2");
+    s.execute("selection.set", json!({"range": "C5"})).unwrap();
+    assert_eq!(s.execute("selection.nextCorner", json!({})).unwrap()["active"], "C5");
+}
+
+#[test]
+fn next_corner_skips_corners_the_sheet_protection_does_not_let_you_select() {
+    // With locked cells unselectable, Ctrl+. goes on to the next corner it may select.
+    let mut s = Session::new();
+    s.new_workbook();
+    s.execute("home.lockCell", json!({"range": "B2:C3", "on": false})).unwrap();
+    s.execute("selection.set", json!({"range": "B2:D3", "active": "B2"})).unwrap();
+    s.execute("review.protectSheet", json!({"selectLockedCells": false})).unwrap();
+    let r = s.execute("selection.nextCorner", json!({})).unwrap();
+    assert_eq!((r["active"].as_str(), r["selection"].as_str()), (Some("B3"), Some("B2:D3")), "D2 and D3 are locked");
+    assert_eq!(s.execute("selection.nextCorner", json!({})).unwrap()["active"], "B2");
+}
+
+#[test]
+fn next_corner_stops_once_on_a_merged_corner_at_its_top_left_cell() {
+    // A corner inside a merged cell is that merged cell, whose active cell is its top-left one.
+    let mut s = Session::new();
+    s.new_workbook();
+    s.execute("home.mergeCells", json!({"range": "C2:D2"})).unwrap();
+    s.execute("selection.set", json!({"range": "B2:D3", "active": "B2"})).unwrap();
+    let seen: Vec<String> = (0..4).map(|_| s.execute("selection.nextCorner", json!({})).unwrap()["active"].as_str().unwrap().to_string()).collect();
+    assert_eq!(seen, ["C2", "D3", "B3", "B2"]);
+    // A selection that is one merged cell has no other corner.
+    s.execute("selection.set", json!({"range": "C2:D2", "active": "C2"})).unwrap();
+    assert_eq!(s.execute("selection.nextCorner", json!({})).unwrap()["active"], "C2");
+}
+
+#[test]
+fn next_corner_skips_hidden_corners_and_stays_inside_the_selected_area() {
+    // A corner in a hidden column is passed over, as keyboard moves pass over hidden cells.
+    let mut s = Session::new();
+    s.new_workbook();
+    s.execute("home.hideColumns", json!({"cols": "D:D"})).unwrap();
+    s.execute("selection.set", json!({"range": "B2:D3", "active": "B2"})).unwrap();
+    assert_eq!(s.execute("selection.nextCorner", json!({})).unwrap()["active"], "B3");
+    // Column C selected with B1:C1 merged: its top corner's merged cell starts in column B,
+    // outside the selection, so the active cell doesn't go there.
+    let mut s = Session::new();
+    s.new_workbook();
+    s.execute("home.mergeCells", json!({"range": "B1:C1"})).unwrap();
+    s.execute("selection.set", json!({"cell": "C5"})).unwrap();
+    s.execute("selection.column", json!({})).unwrap();
+    let r = s.execute("selection.nextCorner", json!({})).unwrap();
+    assert_eq!((r["active"].as_str(), r["selection"].as_str()), (Some("C1048576"), Some("C:C")));
+}
+
+#[test]
+fn copy_quotes_only_cells_with_tabs_or_line_breaks() {
+    // #2225: a cell holding a quote was wrapped in quotes on copy; Excel quotes only text with a
+    // tab or line break, and pastes the result back as the same cells.
+    let mut s = Session::new();
+    s.new_workbook();
+    for (cell, input) in [("A1", "say \"hi\""), ("A2", "plain"), ("A3", "\"hi\" there"), ("A4", "x \"q\"\ny"), ("A5", "tab\tinside")] {
+        s.execute("cell.set", json!({"cell": cell, "input": input})).unwrap();
+    }
+    let text = s.execute("edit.copy", json!({"range": "A1:A5"})).unwrap()["text"].as_str().unwrap().to_string();
+    assert_eq!(text, "say \"hi\"\nplain\n\"hi\" there\n\"x \"\"q\"\"\ny\"\n\"tab\tinside\"\n");
+    let rows = parse_tsv(&text);
+    let cells: Vec<&str> = rows.iter().map(|r| r[0].as_str()).collect();
+    assert_eq!(cells, ["say \"hi\"", "plain", "\"hi\" there", "x \"q\"\ny", "tab\tinside"]);
+}
+
+#[test]
+fn a_field_that_is_not_really_quoted_keeps_its_separators() {
+    // A field opening with a quote is quoted only if a closing quote ends it; when it doesn't (or
+    // never closes), the text is read as written, and the tabs and line breaks inside it still
+    // separate cells, as they would have without the leading quote.
+    assert_eq!(parse_tsv("\"a\tb\"x\tc"), vec![vec!["\"a", "b\"x", "c"]]);
+    assert_eq!(parse_tsv("\"a\tb\nc"), vec![vec!["\"a", "b"], vec!["c"]]);
+    assert_eq!(parse_tsv("\"a\tb\tc\n"), vec![vec!["\"a", "b", "c"]]);
+    // Cells copied without quotes (they hold no tab or line break) read back as the same cells.
+    let mut s = Session::new();
+    s.new_workbook();
+    for (cell, input) in [("A1", "'\"a"), ("B1", "b\"x"), ("C1", "c")] {
+        s.execute("cell.set", json!({"cell": cell, "input": input})).unwrap();
+    }
+    let text = s.execute("edit.copy", json!({"range": "A1:C1"})).unwrap()["text"].as_str().unwrap().to_string();
+    assert_eq!(parse_tsv(&text), vec![vec!["\"a", "b\"x", "c"]], "{text:?}");
+    // Many fields that only look quoted: each is replayed at most once (the replay budget is the
+    // input's length), and every one is still its own cell.
+    let hostile = "\"x\t".repeat(50_000);
+    assert_eq!(parse_tsv(&hostile).first().map(Vec::len), Some(50_001));
+}
+
+/// `within: selection` searches only the selected cells, as Excel does with a range selected
+/// (#3224): Find All lists them, Find Next moves the active cell through them and keeps the range
+/// selected, and Replace changes only them.
+#[test]
+fn find_and_replace_within_the_selection() {
+    let mut s = Session::new();
+    s.new_workbook();
+    s.execute("range.setValues", json!({"range": "A1:B4", "values": [["pear", "pear"], ["plum", "pear"], ["pear", "fig"], ["pear", "pear"]]}))
+        .unwrap();
+    s.execute("selection.set", json!({"range": "B1:B4"})).unwrap();
+    let all = s.execute("edit.find", json!({"what": "pear", "all": true, "within": "selection"})).unwrap();
+    let cells: Vec<&str> = all["results"].as_array().unwrap().iter().filter_map(|r| r["cell"].as_str()).collect();
+    assert_eq!(cells, ["B1", "B2", "B4"], "only column B");
+    assert_eq!(s.execute("edit.find", json!({"what": "pear", "within": "selection"})).unwrap()["cell"], "B2");
+    assert_eq!(s.execute("edit.find", json!({"what": "pear", "within": "selection"})).unwrap()["cell"], "B4");
+    assert_eq!(s.execute("edit.find", json!({"what": "pear", "within": "selection"})).unwrap()["cell"], "B1", "wraps inside the range");
+    let sel = &s.doc().unwrap().selection;
+    assert_eq!((sel.a1(), sel.active.a1()), ("B1:B4".to_string(), "B1".to_string()), "the range stays selected");
+    assert!(s.execute("edit.find", json!({"what": "plum", "within": "selection"})).is_err(), "A2 is outside the range");
+    assert_eq!(s.execute("edit.replace", json!({"what": "pear", "with": "kiwi", "within": "selection"})).unwrap()["replaced"], 3);
+    let sh = s.doc().unwrap().wb.active().unwrap();
+    let at = |a: &str| sh.value(CellRef::parse(a).unwrap());
+    assert_eq!((at("A1"), at("B1"), at("B4"), at("A4")), (Value::text("pear"), Value::text("kiwi"), Value::text("kiwi"), Value::text("pear")));
+    // The sheet scope is unchanged.
+    let all = s.execute("edit.find", json!({"what": "pear", "all": true})).unwrap();
+    assert_eq!(all["count"], 3, "A1, A3 and A4 on the whole sheet");
+}

crates/engine/src/cmd/format/sizes.rs

@@ -9,6 +9,17 @@ use super::{
 /// sheet is `sheet`, else the prefix, else the active one. The selection belongs to the active
 /// sheet, so another sheet needs explicit lines.
 fn line_targets(s: &Session, p: &Json, rows: bool) -> Result<(usize, Vec<(u32, u32)>)> {
+    let (sheet, lines) = resolve_lines(s, p, rows)?;
+    // Sizes and visibility are formatting of the line, which a protected sheet must allow.
+    if rows {
+        crate::cmd::refuse_unless_allowed(s, sheet, "Formatting rows", |p| p.format_rows)?;
+    } else {
+        crate::cmd::refuse_unless_allowed(s, sheet, "Formatting columns", |p| p.format_columns)?;
+    }
+    Ok((sheet, lines))
+}
+
+fn resolve_lines(s: &Session, p: &Json, rows: bool) -> Result<(usize, Vec<(u32, u32)>)> {
     let key = if rows { "rows" } else { "cols" };
     let mut sheet = target_sheet(s, p)?;
     if let Some(t) = str_param(p, key) {

crates/engine/src/cmd/insert.rs

@@ -1100,6 +1100,10 @@ fn insert_picture(s: &mut Session, p: &Json) -> Result<Json> {
         .unwrap_or_else(|| if data.starts_with(&[0x89, b'P', b'N', b'G']) { "image/png".into() } else { "image/jpeg".into() });
     let (w, h) = crate::io::image_size(&data).unwrap_or((320, 240));
     let d = s.doc()?;
+    // Sheet protection locks drawing objects, as for a text box's text.
+    if d.wb.active().is_some_and(|sh| sh.is_protected()) {
+        return Err(EngineError::Other(PROTECTED.into()));
+    }
     let id = d.wb.next_object_id();
     let at = cell_param(s, p, "at")?.unwrap_or(d.selection.active);
     let scale = (640.0 / w.max(1) as f32).min(1.0);
@@ -1736,7 +1740,13 @@ fn clear_cf(s: &mut Session, p: &Json) -> Result<Json> {
             sh.cond_formats.clear();
         } else {
             for cf in sh.cond_formats.iter_mut() {
+                let before = RangeRef::top_left(&cf.ranges);
                 cf.ranges.retain(|r| !ranges.iter().any(|x| x.intersects(r)));
+                // The relative formulas are written for the top-left cell: when it goes, they're
+                // rewritten for the new one, so the areas left keep reading the same cells.
+                if let (Some(from), Some(to)) = (before, RangeRef::top_left(&cf.ranges)) {
+                    rebase_cf_formulas(&mut cf.rule, from, to);
+                }
             }
             sh.cond_formats.retain(|c| !c.ranges.is_empty());
         }
@@ -1744,6 +1754,19 @@ fn clear_cf(s: &mut Session, p: &Json) -> Result<Json> {
     })
 }
 
+/// Moves the relative references of a rule's per-cell formulas written for `from` to `to`.
+fn rebase_cf_formulas(rule: &mut CfRule, from: CellRef, to: CellRef) {
+    let mv = |f: &str| crate::cmd::data::move_rule_formula(f, from, to);
+    match rule {
+        CfRule::CellIs { a, b, .. } => {
+            *a = mv(a);
+            *b = b.as_deref().map(mv);
+        }
+        CfRule::Expression { formula, .. } => *formula = mv(formula),
+        _ => {}
+    }
+}
+
 fn manage_cf(s: &mut Session, p: &Json) -> Result<Json> {
     let sheet = target_sheet(s, p)?;
     if p.get("delete").is_none() && p.get("moveUp").is_none() && p.get("moveDown").is_none() {

crates/engine/src/cmd/pivot/create.rs

@@ -67,9 +67,6 @@ fn field_list(v: Option<&Json>) -> Vec<Json> {
 }
 
 pub(super) fn insert_pivot(s: &mut Session, p: &Json) -> Result<Json> {
-    if s.doc()?.wb.protected_structure && matches!(str_param(p, "destination"), None | Some("new")) {
-        return Err(other("The workbook is protected and cannot be changed."));
-    }
     let source = source_param(s, p)?;
     let active = s.doc()?.wb.active_sheet();
     // Validate the source now (header names, size).
@@ -98,6 +95,10 @@ pub(super) fn insert_pivot(s: &mut Session, p: &Json) -> Result<Json> {
         let at = RangeRef::parse(body).map(|r| r.start).ok_or_else(|| bad("insert.pivotTable", format!("not a cell: `{dest}`")))?;
         Some((si, at))
     };
+    // Decided on the resolved destination: `New`, ` new ` and an empty one all make a sheet.
+    if target.is_none() && s.doc()?.wb.protected_structure {
+        return Err(other("The workbook is protected and cannot be changed."));
+    }
     let replace = bool_param(p, "replace").unwrap_or(false);
     let rows = field_list(p.get("rows"));
     let columns = field_list(p.get("columns"));

crates/engine/src/cmd/pivot/fields.rs

@@ -507,9 +507,13 @@ pub(super) fn value_settings(s: &mut Session, p: &Json) -> Result<Json> {
         let mut v = cur.clone();
         if let Some(f) = func {
             v.func = f;
-            // An automatic caption follows the function.
-            let auto = auto_name(cur.func, &cur.source_col);
-            if cur.name.eq_ignore_ascii_case(&auto) || cur.name.strip_prefix(auto.as_str()).is_some_and(|r| r.chars().all(|c| c.is_ascii_digit())) {
+            // An automatic caption follows the function. Count Numbers was captioned "Count
+            // Numbers of …" before it took Excel's "Count of …", and saved workbooks still carry it.
+            let is_auto = |base: &str| {
+                cur.name.eq_ignore_ascii_case(base) || cur.name.strip_prefix(base).is_some_and(|r| r.chars().all(|c| c.is_ascii_digit()))
+            };
+            let legacy = cur.func == PivotFunc::CountNumbers && is_auto(&format!("Count Numbers of {}", cur.source_col));
+            if is_auto(&auto_name(cur.func, &cur.source_col)) || legacy {
                 v.name = unique_value_name(pt, &auto_name(f, &cur.source_col), Some(i));
             }
         }

crates/engine/src/cmd/pivot/tests.rs

@@ -168,6 +168,19 @@ fn filters_and_report_filter_rows() {
     assert!(s.execute("pivot.filter", json!({"field": "Product", "selected": []})).is_err());
 }
 
+/// A selection of the most labels allowed (100,000) is looked up once per record, not scanned: the
+/// report still filters case-insensitively.
+#[test]
+fn a_huge_filter_selection_is_matched_through_a_set() {
+    let mut s = sales();
+    s.execute("insert.pivotTable", json!({"rows": ["Product"], "values": ["Sales"], "filters": ["Region"]})).unwrap();
+    let mut selected: Vec<String> = (0..99_999).map(|i| format!("Region {i}")).collect();
+    selected.push("EAST".into());
+    s.execute("pivot.filter", json!({"field": "Region", "selected": selected})).unwrap();
+    let gt = find_row(&s, "Grand Total").unwrap();
+    assert_eq!(val(&s, &CellRef::new(gt, 1).a1()), Value::Number(415.0));
+}
+
 #[test]
 fn show_values_as() {
     let mut s = sales();
@@ -1013,3 +1026,36 @@ fn detail_cells_are_the_cells_show_details_takes() {
     let pt = &d.wb.active().unwrap().pivots[0];
     assert!(crate::pivot::detail_cells(&d.wb, pt, d.wb.active_sheet()).unwrap_err().contains("out of date"));
 }
+
+#[test]
+fn rank_ties_are_dense_and_count_numbers_is_captioned_count_of() {
+    // #1448 items 10 and 12: Excel ranks 5, 4, 3, 3, 4 as 1, 2, 3, 3, 2 (GridCraft gave 1, 2, 4,
+    // 4, 2), and captions a Count Numbers field "Count of Val".
+    let mut s = Session::new();
+    s.new_workbook();
+    let rows = json!([["Key", "Val"], ["A", 5], ["B", 4], ["C", 3], ["D", 3], ["E", 4]]);
+    s.execute("range.setValues", json!({"range": "A1", "values": rows})).unwrap();
+    s.execute("insert.pivotTable", json!({"source": "Sheet1!$A$1:$B$6", "destination": "Sheet1!D3", "rows": ["Key"], "values": ["Val"]})).unwrap();
+    s.execute("pivot.valueSettings", json!({"index": 0, "showAs": "rank"})).unwrap();
+    let ranks: Vec<Value> = ["E4", "E5", "E6", "E7", "E8"].iter().map(|a| val(&s, a)).collect();
+    assert_eq!(ranks, [1.0, 2.0, 3.0, 3.0, 2.0].map(Value::Number));
+    s.execute("pivot.valueSettings", json!({"index": 0, "showAs": "normal", "func": "countNumbers"})).unwrap();
+    assert_eq!(text(&s, "E3"), "Count of Val");
+}
+
+#[test]
+fn legacy_count_numbers_caption_follows_the_function() {
+    // Workbooks saved before Count Numbers was captioned "Count of" carry "Count Numbers of Val";
+    // that is still an automatic caption, so it follows a new function. A custom name stays.
+    let mut s = Session::new();
+    s.new_workbook();
+    let rows = json!([["Key", "Val"], ["A", 5], ["B", 4]]);
+    s.execute("range.setValues", json!({"range": "A1", "values": rows})).unwrap();
+    s.execute("insert.pivotTable", json!({"source": "Sheet1!$A$1:$B$3", "destination": "Sheet1!D3", "rows": ["Key"], "values": ["Val"]})).unwrap();
+    for (legacy, after) in [("Count Numbers of Val", "Sum of Val"), ("Count Numbers of Val2", "Sum of Val"), ("Numbers counted", "Numbers counted")] {
+        s.execute("pivot.valueSettings", json!({"index": 0, "func": "countNumbers", "name": legacy})).unwrap();
+        assert_eq!(text(&s, "E3"), legacy);
+        s.execute("pivot.valueSettings", json!({"index": 0, "func": "sum"})).unwrap();
+        assert_eq!(text(&s, "E3"), after, "{legacy}");
+    }
+}

crates/engine/src/cmd/print/header_footer.rs

@@ -153,6 +153,17 @@ pub struct HfSection {
     pub size: Option<f32>,
 }
 
+/// Most bytes one section's expanded text may hold. A code like `&A` adds the whole sheet name
+/// (or file path) each time it appears, and a JSON workbook's names have no length limit.
+const MAX_SECTION_BYTES: usize = 64 * 1024;
+
+/// Appends `s` unless the section would pass [`MAX_SECTION_BYTES`]; what doesn't fit is left out.
+fn push_field(text: &mut String, s: &str) {
+    if text.len().saturating_add(s.len()) <= MAX_SECTION_BYTES {
+        text.push_str(s);
+    }
+}
+
 /// Expands a header/footer string into its left, centre and right sections.
 pub fn expand_header_footer(spec: &str, cx: &HfContext) -> [HfSection; 3] {
     let mut out: [HfSection; 3] = Default::default();
@@ -187,14 +198,14 @@ pub fn expand_header_footer(spec: &str, cx: &HfContext) -> [HfSection; 3] {
                         i += 1 + digits.len();
                     }
                 }
-                sec.text.push_str(&n.to_string());
+                push_field(&mut sec.text, &n.to_string());
             }
-            'N' | 'n' => sec.text.push_str(&cx.pages.to_string()),
-            'D' | 'd' => sec.text.push_str(&cx.date),
-            'T' | 't' => sec.text.push_str(&cx.time),
-            'A' | 'a' => sec.text.push_str(&cx.sheet),
-            'F' | 'f' => sec.text.push_str(&cx.file),
-            'Z' | 'z' => sec.text.push_str(&cx.path),
+            'N' | 'n' => push_field(&mut sec.text, &cx.pages.to_string()),
+            'D' | 'd' => push_field(&mut sec.text, &cx.date),
+            'T' | 't' => push_field(&mut sec.text, &cx.time),
+            'A' | 'a' => push_field(&mut sec.text, &cx.sheet),
+            'F' | 'f' => push_field(&mut sec.text, &cx.file),
+            'Z' | 'z' => push_field(&mut sec.text, &cx.path),
             '&' => sec.text.push('&'),
             'B' | 'b' => sec.bold = !sec.bold,
             'I' | 'i' => sec.italic = !sec.italic,

crates/engine/src/cmd/print/tests.rs

@@ -414,6 +414,12 @@ fn pdf_contains_text_and_header_codes_expand() {
     assert_eq!(r.text, "P4/9 9:00 AM");
     assert_eq!(expand_header_footer("plain", &cx)[1].text, "plain");
     assert_eq!(expand_header_footer("&", &cx)[1].text, "");
+    // A megabyte sheet name repeated by 5,000 `&A` codes stops at the section's 64 KiB.
+    let long = HfContext { sheet: "S".repeat(1024 * 1024), ..cx };
+    let [_, c, _] = expand_header_footer(&"&A".repeat(5_000), &long);
+    assert!(c.text.is_empty(), "the name alone is over the limit");
+    let short = HfContext { sheet: "S".repeat(1000), ..Default::default() };
+    assert_eq!(expand_header_footer(&"&A".repeat(5_000), &short)[1].text.len(), 65_000);
 }
 
 #[test]
@@ -695,6 +701,79 @@ fn bands_unit() {
     assert!(w.len() > 2);
 }
 
+/// The wrapper `wrap_lines` replaced, re-measuring strings, as the reference for its lines.
+fn wrap_lines_remeasuring(text: &str, font: Font, size: f32, width: f32) -> Vec<String> {
+    let mut out = Vec::new();
+    for para in text.split('\n') {
+        let mut line = String::new();
+        for word in para.split(' ') {
+            let cand = if line.is_empty() { word.to_string() } else { format!("{line} {word}") };
+            if line.is_empty() || gridcraft_pdf::text_width(font, size, &cand) <= width {
+                line = cand;
+            } else {
+                out.push(std::mem::take(&mut line));
+                line = word.to_string();
+            }
+            while gridcraft_pdf::text_width(font, size, &line) > width && line.chars().count() > 1 {
+                let chars: Vec<char> = line.chars().collect();
+                let (mut lo, mut hi) = (1usize, chars.len());
+                while lo < hi {
+                    let mid = lo + (hi - lo).div_ceil(2);
+                    let cut: String = chars[..mid].iter().collect();
+                    if gridcraft_pdf::text_width(font, size, &cut) <= width {
+                        lo = mid;
+                    } else {
+                        hi = mid - 1;
+                    }
+                }
+                if lo == chars.len() {
+                    break;
+                }
+                out.push(chars[..lo].iter().collect());
+                line = chars[lo..].iter().collect();
+            }
+            if out.len() > 2000 {
+                return out;
+            }
+        }
+        out.push(line);
+    }
+    out
+}
+
+#[test]
+fn wrap_lines_matches_the_remeasuring_wrapper() {
+    let texts = [
+        "the quick brown fox jumps",
+        "Supercalifragilistic",
+        "a  b   c\n\nverylongwordthatneedsbreaking short\nend ",
+        "Wide WWWWWWWWWW words, iiiiiiii narrow ones; mixed MMMMiiiiMMMM",
+        "€ ü ß — unicode Ünïcödé text",
+        "",
+        " ",
+    ];
+    for text in texts {
+        for font in [Font::Helvetica, Font::HelveticaBold, Font::Courier] {
+            for (size, width) in [(10.0, 50.0), (10.0, 20.0), (11.0, 1.0), (8.0, 300.0), (12.0, 0.0)] {
+                assert_eq!(wrap_lines(text, font, size, width), wrap_lines_remeasuring(text, font, size, width), "{text:?} {font:?} {size} {width}");
+            }
+        }
+    }
+}
+
+#[test]
+fn wrapping_a_long_word_in_a_narrow_box_stops_at_the_line_limit() {
+    // One character per line: the old wrapper re-measured and copied the rest of the word for
+    // each of the 100,000 lines before checking the limit.
+    let word = "w".repeat(100_000);
+    let lines = wrap_lines(&word, Font::Helvetica, 10.0, 1.0);
+    assert!(lines.len() <= 2002, "{}", lines.len());
+    assert!(lines.iter().all(|l| l == "w"));
+    // A long paragraph in a very wide box is one line.
+    let para = vec!["word"; 50_000].join(" ");
+    assert_eq!(wrap_lines(&para, Font::Helvetica, 10.0, 1.0e9), vec![para.clone()]);
+}
+
 #[test]
 fn center_across_spans_following_empty_center_across_cells() {
     let mut styles = StyleTable::default();

crates/engine/src/cmd/print/text.rs

@@ -3,42 +3,57 @@ use super::{CellRef, Color, Font, HAlign, MAX_COLS, Page, Point, RangeRef, Sheet
 
 const PAD_PX: f32 = 2.0;
 
+/// Most lines [`wrap_lines`] returns (it may return one more, the rest of a paragraph).
+const MAX_WRAP_LINES: usize = 2000;
+
 /// Word-wraps `text` to `width` points.
+///
+/// Widths are kept as running sums of glyph widths (the sum `text_width` makes), so each
+/// character is measured once: re-measuring the line for every word, or the rest of an
+/// over-long word for every piece cut from it, made a long paragraph or word quadratic.
 pub(super) fn wrap_lines(text: &str, font: Font, size: f32, width: f32) -> Vec<String> {
+    let units_of = |s: &str| -> u64 { s.chars().map(|c| u64::from(font.char_width(c))).sum() };
+    let fits = |units: u64| units as f32 * size / 1000.0 <= width;
+    let space = units_of(" ");
     let mut out = Vec::new();
     for para in text.split('\n') {
         let mut line = String::new();
+        let mut line_units: u64 = 0;
         for word in para.split(' ') {
-            let cand = if line.is_empty() { word.to_string() } else { format!("{line} {word}") };
-            if line.is_empty() || gridcraft_pdf::text_width(font, size, &cand) <= width {
-                line = cand;
+            let word_units = units_of(word);
+            if line.is_empty() {
+                line.push_str(word);
+                line_units = word_units;
+            } else if fits(line_units + space + word_units) {
+                line.push(' ');
+                line.push_str(word);
+                line_units += space + word_units;
             } else {
                 out.push(std::mem::take(&mut line));
-                line = word.to_string();
+                line.push_str(word);
+                line_units = word_units;
             }
-            // Break a single over-long word by characters. The cut that fits is found by binary
-            // search (each try measures one candidate prefix), so an over-long word costs
-            // O(n log n) measurements instead of re-measuring the whole cut per character for
-            // every emitted line (`a` × 100k pasted text would be cubic worst case).
-            while gridcraft_pdf::text_width(font, size, &line) > width && line.chars().count() > 1 {
-                let chars: Vec<char> = line.chars().collect();
-                let (mut lo, mut hi) = (1usize, chars.len());
-                while lo < hi {
-                    let mid = lo + (hi - lo).div_ceil(2);
-                    let cut: String = chars[..mid].iter().collect();
-                    if gridcraft_pdf::text_width(font, size, &cut) <= width {
-                        lo = mid;
-                    } else {
-                        hi = mid - 1;
+            // Break a single over-long word by characters: each piece is the longest that fits
+            // (at least one character).
+            if !fits(line_units) && line.chars().nth(1).is_some() {
+                let mut piece = String::new();
+                let mut units: u64 = 0;
+                for c in line.chars() {
+                    let w = u64::from(font.char_width(c));
+                    if !piece.is_empty() && !fits(units + w) {
+                        out.push(std::mem::take(&mut piece));
+                        units = 0;
+                        if out.len() > MAX_WRAP_LINES {
+                            return out;
+                        }
                     }
+                    piece.push(c);
+                    units += w;
                 }
-                if lo == chars.len() {
-                    break;
-                }
-                out.push(chars[..lo].iter().collect());
-                line = chars[lo..].iter().collect();
+                line = piece;
+                line_units = units;
             }
-            if out.len() > 2000 {
+            if out.len() > MAX_WRAP_LINES {
                 return out;
             }
         }

crates/engine/src/cmd/sheet.rs

@@ -398,10 +398,10 @@ fn move_columns(s: &mut Session, p: &Json) -> Result<Json> {
     {
         return Err(EngineError::Other("To prevent possible loss of data, columns cannot be shifted off of the worksheet.".into()));
     }
-    // The checks must authorize the sheet this command modifies (`target_sheet`), not whatever
-    // sheet is active: both carry the command's own `sheet` parameter on.
-    check_lines_protection(s, &json!({"cols": RangeRef::cols(before, before).a1(), "sheet": p.get("sheet")}), Axis::Cols, before, count, true)?;
-    check_lines_protection(s, &json!({"cols": RangeRef::cols(from, end - 1).a1(), "sheet": p.get("sheet")}), Axis::Cols, from, count, false)?;
+    // The checks must authorize the sheet this command modifies, not whatever sheet is active:
+    // both get the index `target_sheet` resolved (from `sheet`, or a `Sheet!` range or cell).
+    check_lines_protection(s, &json!({"cols": RangeRef::cols(before, before).a1(), "sheet": sheet}), Axis::Cols, before, count, true)?;
+    check_lines_protection(s, &json!({"cols": RangeRef::cols(from, end - 1).a1(), "sheet": sheet}), Axis::Cols, from, count, false)?;
 
     let moved_from = if before <= from { from + count } else { from };
     if moved_from.checked_add(count).is_none_or(|end| end > MAX_COLS) {

crates/engine/src/cmd/view.rs

@@ -40,6 +40,27 @@ pub fn specs() -> Vec<CommandSpec> {
         cmd!("view.showZeros", "Show Zeros", [], None, "{on?}", has_doc, |s, p| sheet_flag(s, p, "zeros")),
         cmd!("view.showOutlineSymbols", "Show Outline Symbols", [], Some("Ctrl+8"), "{on?}", has_doc, |s, p| sheet_flag(s, p, "outlineSymbols")),
         cmd!("view.showObjects", "Show Objects", [], Some("Ctrl+6"), "{on?}", has_doc, show_objects),
+        cmd!(
+            "view.showSheetTabs",
+            "Show Sheet Tabs",
+            [],
+            None,
+            "{on?} (File › Options › Advanced, this workbook; toggles without `on`)",
+            has_doc,
+            |s, p| { workbook_view_flag(s, p, "sheetTabs") }
+        ),
+        cmd!(
+            "view.showHorizontalScrollBar",
+            "Show Horizontal Scroll Bar",
+            [],
+            None,
+            "{on?} (this workbook; toggles without `on`)",
+            has_doc,
+            |s, p| { workbook_view_flag(s, p, "horizontal") }
+        ),
+        cmd!("view.showVerticalScrollBar", "Show Vertical Scroll Bar", [], None, "{on?} (this workbook; toggles without `on`)", has_doc, |s, p| {
+            workbook_view_flag(s, p, "vertical")
+        }),
         cmd!("view.rightToLeft", "Sheet Right-to-Left", ["Page Layout", "Sheet Options"], None, "{on?}", has_doc, |s, p| sheet_flag(s, p, "rtl")),
         cmd!("view.zoom", "Zoom", ["View", "Zoom"], None, "{percent: 10..400}", has_doc, zoom),
         cmd!("view.zoom100", "100%", ["View", "Zoom"], None, "{}", has_doc, |s, _| zoom(s, &json!({"percent": 100}))),
@@ -189,6 +210,21 @@ fn sheet_flag(s: &mut Session, p: &Json, which: &str) -> Result<Json> {
     })
 }
 
+/// File › Options › Advanced › Display options for this workbook: the sheet tabs and the two
+/// scroll bars, saved with the workbook (`<workbookView showSheetTabs … />`).
+fn workbook_view_flag(s: &mut Session, p: &Json, which: &str) -> Result<Json> {
+    edit(s, |cx| {
+        let view = &mut cx.wb.view;
+        let slot = match which {
+            "sheetTabs" => &mut view.show_sheet_tabs,
+            "horizontal" => &mut view.show_horizontal_scroll,
+            _ => &mut view.show_vertical_scroll,
+        };
+        *slot = bool_param(p, "on").unwrap_or(!*slot);
+        Ok(json!({"on": *slot}))
+    })
+}
+
 /// Ctrl+6: hides every object, or shows them again. Placeholders (from a file) count as shown.
 fn show_objects(s: &mut Session, p: &Json) -> Result<Json> {
     use gridcraft_model::ShowObjects;