diff --git a/Cargo.lock b/Cargo.lock
index f3b1e6426..0855bf06e 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1522,12 +1522,14 @@ version = "0.1.0"
 dependencies = [
  "egui",
  "egui_kittest",
+ "epaint_default_fonts",
  "gridcraft-chart",
  "gridcraft-engine",
  "image",
  "log",
  "serde",
  "serde_json",
+ "skrifa",
  "toml",
 ]
 
diff --git a/Cargo.toml b/Cargo.toml
index a7f99e0cb..e87627dda 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -43,6 +43,10 @@ eframe = { version = "0.36", default-features = false }
 egui_kittest = "0.36"
 rfd = "0.17"
 arboard = { version = "3.6", default-features = false }
+# Font name-table reading. The same version epaint already depends on, so it adds no new build.
+skrifa = "0.44"
+# Real font bytes for tests (Ubuntu Light, compiled into epaint).
+epaint_default_fonts = "0.36"
 
 [workspace.lints.rust]
 unsafe_code = "forbid"
diff --git a/crates/core/src/date.rs b/crates/core/src/date.rs
index 7fba23fe5..d27ee15f3 100644
--- a/crates/core/src/date.rs
+++ b/crates/core/src/date.rs
@@ -97,7 +97,7 @@ pub fn serial_from_ymd(sys: DateSystem, year: i64, month: i64, day: i64) -> Opti
 
 /// Date/time from a serial. `None` for negative or too-large serials.
 pub fn datetime_from_serial(sys: DateSystem, serial: f64) -> Option<DateTime> {
-    if !serial.is_finite() || serial < 0.0 || serial >= 2_958_466.0 {
+    if !(0.0..2_958_466.0).contains(&serial) {
         return None;
     }
     let mut day = serial.floor() as i64;
diff --git a/crates/engine/src/cmd/file.rs b/crates/engine/src/cmd/file.rs
index 37a58dd63..34b957cce 100644
--- a/crates/engine/src/cmd/file.rs
+++ b/crates/engine/src/cmd/file.rs
@@ -48,7 +48,7 @@ fn open(s: &mut Session, p: &Json) -> Result<Json> {
     };
     let (wb, warnings) = crate::io::open_bytes(&name, &bytes)?;
     let title = std::path::Path::new(&name).file_name().and_then(|n| n.to_str()).unwrap_or("Book").to_string();
-    let path = str_param(p, "path").map(str::to_string).filter(|p| crate::io::FileKind::from_path(p) == Some(crate::io::FileKind::Xlsx) || true);
+    let path = str_param(p, "path").map(str::to_string);
     // Replace an untouched blank Book1 like Excel does.
     if s.documents().len() == 1
         && s.active().is_some_and(|d| d.path.is_none() && !d.is_dirty() && d.undo.is_empty() && d.wb.sheets.iter().all(|sh| sh.cells.is_empty()))
diff --git a/crates/engine/src/cmd/spelling.rs b/crates/engine/src/cmd/spelling.rs
index 10892bc31..e14912061 100644
--- a/crates/engine/src/cmd/spelling.rs
+++ b/crates/engine/src/cmd/spelling.rs
@@ -21,17 +21,23 @@ pub fn specs() -> Vec<CommandSpec> {
 fn dictionary() -> &'static HashSet<String> {
     static DICT: OnceLock<HashSet<String>> = OnceLock::new();
     DICT.get_or_init(|| {
-        let mut set = HashSet::new();
+        #[cfg(target_arch = "wasm32")]
+        {
+            HashSet::new()
+        }
         #[cfg(not(target_arch = "wasm32"))]
-        for path in ["/usr/share/dict/words", "/usr/share/dict/american-english", "/usr/share/dict/british-english"] {
-            if let Ok(text) = std::fs::read_to_string(path) {
-                for w in text.lines().take(2_000_000) {
-                    set.insert(w.trim().to_lowercase());
+        {
+            let mut set = HashSet::new();
+            for path in ["/usr/share/dict/words", "/usr/share/dict/american-english", "/usr/share/dict/british-english"] {
+                if let Ok(text) = std::fs::read_to_string(path) {
+                    for w in text.lines().take(2_000_000) {
+                        set.insert(w.trim().to_lowercase());
+                    }
+                    break;
                 }
-                break;
             }
+            set
         }
-        set
     })
 }
 
diff --git a/crates/functions/src/math.rs b/crates/functions/src/math.rs
index 3a0bab385..654395f4b 100644
--- a/crates/functions/src/math.rs
+++ b/crates/functions/src/math.rs
@@ -487,7 +487,7 @@ fn integer_args(a: &[Arg]) -> R<Vec<u64>> {
     v.iter()
         .map(|x| {
             let t = x.trunc();
-            if t < 0.0 || t >= 9.007_199_254_740_992e15 { Err(CellError::Num) } else { Ok(t as u64) }
+            if !(0.0..9.007_199_254_740_992e15).contains(&t) { Err(CellError::Num) } else { Ok(t as u64) }
         })
         .collect()
 }
diff --git a/crates/functions/src/stat.rs b/crates/functions/src/stat.rs
index abdb4e731..51a5f3272 100644
--- a/crates/functions/src/stat.rs
+++ b/crates/functions/src/stat.rs
@@ -1185,7 +1185,7 @@ fn binom_dist_range(a: &[Arg], _: C) -> R<Value> {
     let p = num(a, 1)?;
     let s1 = num(a, 2)?.trunc();
     let s2 = if has(a, 3) { num(a, 3)?.trunc() } else { s1 };
-    if n < 0.0 || n > 1e15 || !(0.0..=1.0).contains(&p) || s1 < 0.0 || s1 > n || s2 < s1 || s2 > n {
+    if !(0.0..=1e15).contains(&n) || !(0.0..=1.0).contains(&p) || s1 < 0.0 || s1 > n || s2 < s1 || s2 > n {
         return Err(CellError::Num);
     }
     if s2 - s1 > 10_000.0 {
diff --git a/crates/functions/src/util.rs b/crates/functions/src/util.rs
index fca5dc42a..fbd664931 100644
--- a/crates/functions/src/util.rs
+++ b/crates/functions/src/util.rs
@@ -51,7 +51,7 @@ pub(crate) fn arg(args: &[Arg], i: usize) -> R<&Arg> {
 
 /// Whether argument `i` was supplied (present and not an empty literal like `F(1,)`).
 pub(crate) fn has(args: &[Arg], i: usize) -> bool {
-    matches!(args.get(i), Some(a) if !(matches!(a.value, Value::Empty) && !a.from_ref))
+    matches!(args.get(i), Some(a) if !matches!(a.value, Value::Empty) || a.from_ref)
 }
 
 /// Number coercion for a scalar parameter: empty = 0, TRUE = 1, numeric text parses.
diff --git a/crates/numfmt/src/render.rs b/crates/numfmt/src/render.rs
index 363dec1d3..523b77d53 100644
--- a/crates/numfmt/src/render.rs
+++ b/crates/numfmt/src/render.rs
@@ -58,7 +58,7 @@ pub(crate) fn render_general(sec: &Section, v: f64, width: usize) -> Out {
 
 /// Renders a date/time. `None` when the serial is outside the supported range.
 pub(crate) fn render_date(sec: &Section, v: f64, sys: DateSystem) -> Option<Out> {
-    if !v.is_finite() || v < 0.0 || v >= 2_958_466.0 {
+    if !(0.0..2_958_466.0).contains(&v) {
         return None;
     }
     let sub_digits = sec.toks.iter().filter_map(|t| if let Tok::Date(DatePart::SubSec(n)) = t { Some(*n) } else { None }).max().unwrap_or(0).min(3);
diff --git a/crates/ui-egui/Cargo.toml b/crates/ui-egui/Cargo.toml
index 01d7c0070..283d53fbe 100644
--- a/crates/ui-egui/Cargo.toml
+++ b/crates/ui-egui/Cargo.toml
@@ -16,9 +16,11 @@ serde = { workspace = true }
 serde_json = { workspace = true }
 log = { workspace = true }
 image = { workspace = true }
+skrifa = { workspace = true }
 
 [dev-dependencies]
 egui_kittest = { workspace = true, features = ["wgpu", "snapshot"] }
+epaint_default_fonts = { workspace = true }
 
 [build-dependencies]
 serde_json = { workspace = true }
diff --git a/crates/ui-egui/src/dialogs.rs b/crates/ui-egui/src/dialogs.rs
index b6c186d2d..e921cdcfa 100644
--- a/crates/ui-egui/src/dialogs.rs
+++ b/crates/ui-egui/src/dialogs.rs
@@ -1020,8 +1020,8 @@ fn format_cells(app: &mut SheetApp, ui: &mut egui::Ui, d: &mut Dialog, confirm:
         }
         "Font" => {
             egui::ComboBox::from_label("Font").selected_text(st.font.name.clone()).show_ui(ui, |ui| {
-                for f in crate::ribbon::FONTS {
-                    ui.selectable_value(&mut st.font.name, f.to_string(), *f);
+                for f in crate::fonts::families() {
+                    ui.selectable_value(&mut st.font.name, f.clone(), f.clone());
                 }
             });
             ui.add(egui::Slider::new(&mut st.font.size, 6.0..=72.0).text("Size"));
diff --git a/crates/ui-egui/src/fonts.rs b/crates/ui-egui/src/fonts.rs
new file mode 100644
index 000000000..940bca9ee
--- /dev/null
+++ b/crates/ui-egui/src/fonts.rs
@@ -0,0 +1,423 @@
+//! The fonts installed on the machine, so the font list can offer them and cells can render with
+//! them (#4).
+//!
+//! egui has no font discovery of its own and panics when asked for a family that was never bound
+//! to font data. So we do both halves: scan the platform's font folders for family names (a read
+//! of each font file's `name` table — damaged or unreadable files yield nothing, never a panic),
+//! and bind the files a workbook actually uses into the families
+//! [`theme::font_definitions`](crate::theme::font_definitions) assembles.
+//!
+//! Native only: on wasm there are no system fonts, every function here reports "nothing", and the
+//! font list is the standard [`crate::ribbon::FONTS`] set.
+
+use std::collections::HashSet;
+use std::path::PathBuf;
+use std::sync::OnceLock;
+
+/// A font file is skipped by the scan past this size: a catalog only needs each face's name, and a
+/// damaged or enormous file must not turn startup into a long read.
+#[cfg(not(target_arch = "wasm32"))]
+const MAX_FONT_FILE: u64 = 64 << 20;
+
+/// One face of one installed font file.
+#[derive(Clone, Debug)]
+pub struct Face {
+    /// Typographic family name, e.g. `"Segoe UI"`.
+    pub family: String,
+    /// The file the face lives in.
+    pub path: PathBuf,
+    /// Face index within the file (collections hold several, e.g. a family's Regular and Bold).
+    pub index: u32,
+    /// Weight implied by the face's style name (400 = regular).
+    pub weight: f32,
+    /// Whether the style name reads as italic or oblique.
+    pub italic: bool,
+}
+
+/// The font folders of the platform (the system's and the user's). Empty on wasm.
+pub fn system_font_dirs() -> Vec<PathBuf> {
+    #[cfg(target_arch = "wasm32")]
+    {
+        Vec::new()
+    }
+    #[cfg(not(target_arch = "wasm32"))]
+    {
+        let mut dirs: Vec<PathBuf> = Vec::new();
+        let home = std::env::var_os("HOME").or_else(|| std::env::var_os("USERPROFILE")).map(PathBuf::from);
+        if cfg!(target_os = "macos") {
+            dirs.extend(["/System/Library/Fonts", "/System/Library/Fonts/Supplemental", "/Library/Fonts"].map(Into::into));
+            if let Some(h) = &home {
+                dirs.push(h.join("Library/Fonts"));
+            }
+        } else if cfg!(windows) {
+            let root = std::env::var_os("WINDIR").map(PathBuf::from).unwrap_or_else(|| PathBuf::from("C:\\Windows"));
+            dirs.push(root.join("Fonts"));
+            if let Some(l) = std::env::var_os("LOCALAPPDATA") {
+                dirs.push(PathBuf::from(l).join("Microsoft\\Windows\\Fonts"));
+            }
+        } else {
+            dirs.extend(["/usr/share/fonts", "/usr/local/share/fonts", "/usr/share/fonts/TTF"].map(Into::into));
+            if let Some(h) = &home {
+                dirs.push(h.join(".fonts"));
+                dirs.push(h.join(".local/share/fonts"));
+            }
+        }
+        dirs
+    }
+}
+
+/// Weight implied by a style name (`"Bold"` → 700, `"Light"` → 300).
+#[cfg(not(target_arch = "wasm32"))]
+fn style_weight(style: &str) -> f32 {
+    let s: String = style.chars().filter(|c| c.is_alphanumeric()).flat_map(|c| c.to_lowercase()).collect();
+    const TABLE: &[(&str, f32)] = &[
+        ("hairline", 100.0),
+        ("thin", 100.0),
+        ("extralight", 200.0),
+        ("ultralight", 200.0),
+        ("light", 300.0),
+        ("medium", 500.0),
+        ("demibold", 600.0),
+        ("semibold", 600.0),
+        ("extrabold", 800.0),
+        ("ultrabold", 800.0),
+        ("bold", 700.0),
+        ("black", 900.0),
+        ("heavy", 900.0),
+    ];
+    TABLE.iter().find(|(k, _)| s.contains(k)).map(|(_, w)| *w).unwrap_or(400.0)
+}
+
+/// Whether a style name reads as italic or oblique.
+#[cfg(not(target_arch = "wasm32"))]
+fn style_italic(style: &str) -> bool {
+    let s: String = style.chars().filter(|c| c.is_alphanumeric()).flat_map(|c| c.to_lowercase()).collect();
+    s.contains("italic") || s.contains("oblique")
+}
+
+/// Every face in `data` as `(index, family, style)`. Damaged data yields nothing, never a panic.
+#[cfg(not(target_arch = "wasm32"))]
+fn file_faces(data: &[u8]) -> Vec<(u32, String, String)> {
+    use skrifa::raw::FileRef;
+    use skrifa::{MetadataProvider, string::StringId};
+    let count = match FileRef::new(data) {
+        Ok(FileRef::Font(_)) => 1,
+        Ok(FileRef::Collection(c)) => c.len(),
+        Err(_) => return Vec::new(),
+    };
+    let name = |f: &skrifa::FontRef<'_>, ids: &[StringId]| -> Option<String> {
+        ids.iter().find_map(|id| f.localized_strings(*id).english_or_first().map(|s| s.to_string()).filter(|s| !s.is_empty()))
+    };
+    (0..count)
+        .filter_map(|i| {
+            let f = skrifa::FontRef::from_index(data, i).ok()?;
+            let family = name(&f, &[StringId::TYPOGRAPHIC_FAMILY_NAME, StringId::FAMILY_NAME])?;
+            let style = name(&f, &[StringId::TYPOGRAPHIC_SUBFAMILY_NAME, StringId::SUBFAMILY_NAME]).unwrap_or_else(|| "Regular".into());
+            Some((i, family, style))
+        })
+        .collect()
+}
+
+/// Catalog every face under `dirs`, recursing into subfolders. A folder reached twice (through a
+/// symlink) is read once, so a link back to a parent ends the walk.
+#[cfg(not(target_arch = "wasm32"))]
+pub fn scan_dirs(dirs: &[PathBuf]) -> Vec<Face> {
+    let mut out: Vec<Face> = Vec::new();
+    let mut stack: Vec<PathBuf> = dirs.to_vec();
+    let mut seen_dirs: HashSet<PathBuf> = HashSet::new();
+    while let Some(dir) = stack.pop() {
+        let key = std::fs::canonicalize(&dir).unwrap_or_else(|_| dir.clone());
+        if !seen_dirs.insert(key) {
+            continue;
+        }
+        let Ok(entries) = std::fs::read_dir(&dir) else { continue };
+        for entry in entries.flatten() {
+            let path = entry.path();
+            if path.is_dir() {
+                stack.push(path);
+                continue;
+            }
+            let is_font =
+                path.extension().and_then(|e| e.to_str()).is_some_and(|e| matches!(e.to_ascii_lowercase().as_str(), "ttf" | "otf" | "ttc" | "otc"));
+            if !is_font || std::fs::metadata(&path).map(|m| m.len() > MAX_FONT_FILE).unwrap_or(true) {
+                continue;
+            }
+            let Ok(data) = std::fs::read(&path) else { continue };
+            for (index, family, style) in file_faces(&data) {
+                out.push(Face { family, path: path.clone(), index, weight: style_weight(&style), italic: style_italic(&style) });
+            }
+        }
+    }
+    out
+}
+
+#[cfg(target_arch = "wasm32")]
+pub fn scan_dirs(_dirs: &[PathBuf]) -> Vec<Face> {
+    Vec::new()
+}
+
+static CATALOG: OnceLock<Vec<Face>> = OnceLock::new();
+
+/// The catalog of installed faces, scanned on first use. Blocks until the scan finishes.
+pub fn catalog() -> &'static [Face] {
+    CATALOG.get_or_init(|| scan_dirs(&system_font_dirs()))
+}
+
+/// The catalog if the scan has finished, else `None` — never blocks, for use while painting.
+fn catalog_now() -> Option<&'static [Face]> {
+    CATALOG.get().map(Vec::as_slice)
+}
+
+/// Start cataloging the installed fonts on a background thread, so the first frame doesn't wait for
+/// it. A no-op on wasm and after the scan has started.
+pub fn start_scan() {
+    static STARTED: OnceLock<()> = OnceLock::new();
+    STARTED.get_or_init(|| {
+        #[cfg(not(target_arch = "wasm32"))]
+        if CATALOG.get().is_none() {
+            // A failed spawn leaves the scan to the first blocking lookup.
+            let _ = std::thread::Builder::new().name("font-scan".into()).spawn(|| {
+                catalog();
+            });
+        }
+    });
+}
+
+/// Whether the background scan has finished.
+pub fn scan_done() -> bool {
+    CATALOG.get().is_some()
+}
+
+/// The faces of one installed family, regular-weight first (the order roles pick from).
+pub fn faces_of(family: &str) -> Vec<Face> {
+    let Some(cat) = catalog_now() else { return Vec::new() };
+    let mut v: Vec<Face> = cat.iter().filter(|f| f.family.eq_ignore_ascii_case(family)).cloned().collect();
+    v.sort_by(|a, b| a.weight.total_cmp(&b.weight).then(a.italic.cmp(&b.italic)).then(a.index.cmp(&b.index)));
+    v
+}
+
+/// The subset of `names` that is installed, sorted and deduped. These are the families whose files
+/// get bound for a workbook.
+pub fn installed_among(names: &[String]) -> Vec<String> {
+    let Some(cat) = catalog_now() else { return Vec::new() };
+    let mut out: Vec<String> = Vec::new();
+    let mut seen: HashSet<String> = HashSet::new();
+    for wanted in names {
+        if !seen.insert(wanted.to_lowercase()) {
+            continue;
+        }
+        if let Some(f) = cat.iter().find(|f| f.family.eq_ignore_ascii_case(wanted)) {
+            out.push(f.family.clone());
+        }
+    }
+    out.sort_by_key(|a| a.to_lowercase());
+    out
+}
+
+/// The font list a combo box shows: the standard [`crate::ribbon::FONTS`] names first (what Excel
+/// offers, and what we substitute), then every other installed family A–Z. Never blocks: until the
+/// background scan finishes it returns just the standard names.
+pub fn families() -> Vec<String> {
+    let mut out: Vec<String> = crate::ribbon::FONTS.iter().map(|s| s.to_string()).collect();
+    let Some(cat) = catalog_now() else { return out };
+    let mut seen: HashSet<String> = out.iter().map(|s| s.to_lowercase()).collect();
+    let mut installed: Vec<String> = cat.iter().map(|f| f.family.clone()).collect();
+    installed.sort_by_key(|a| a.to_lowercase());
+    installed.dedup_by(|a, b| a.eq_ignore_ascii_case(b));
+    for f in installed {
+        if seen.insert(f.to_lowercase()) {
+            out.push(f);
+        }
+    }
+    out
+}
+
+/// The egui family name for one role of one family: `fnt:{family}:{b|n}{i|n}`.
+pub fn role_key(family: &str, bold: bool, italic: bool) -> String {
+    format!("fnt:{family}:{}{}", if bold { 'b' } else { 'n' }, if italic { 'i' } else { 'n' })
+}
+
+/// The face to use for a role, or `None` when the family has no faces. Missing bold/italic faces
+/// fall back to the family's regular face, so every bound role has data behind it.
+fn pick_face(faces: &[Face], bold: bool, italic: bool) -> Option<&Face> {
+    let regular = || faces.iter().find(|f| !f.italic && (f.weight - 400.0).abs() < 1.0);
+    let exact = |wanted_bold: bool, wanted_italic: bool| {
+        faces.iter().find(|f| f.italic == wanted_italic && if wanted_bold { f.weight >= 600.0 } else { f.weight < 600.0 })
+    };
+    (match (bold, italic) {
+        (true, true) => exact(true, true).or_else(|| exact(true, false)).or_else(|| exact(false, true)),
+        (true, false) => exact(true, false),
+        (false, true) => exact(false, true),
+        (false, false) => None,
+    })
+    .or_else(regular)
+    .or_else(|| faces.first())
+}
+
+/// A stable key for a face's font data, unique per file/index within the process.
+fn face_key(family: &str, face: &Face) -> String {
+    let file = face.path.file_name().and_then(|s| s.to_str()).unwrap_or("font");
+    format!("fnt-src:{family}:{file}:{}", face.index)
+}
+
+/// Bind one installed family's faces into `fonts`, one egui family per cell role, and return the
+/// role keys that are now bound. A role with no exact face chains to the family's regular face, so
+/// no role is ever left pointing at missing data (egui panics on that). A family with no faces
+/// binds nothing.
+///
+/// Each role's chain ends with egui's default proportional fonts, so glyphs the installed font
+/// lacks (emoji, a stray script) still render.
+pub fn bind_faces(fonts: &mut egui::FontDefinitions, family: &str, faces: &[Face]) -> Vec<String> {
+    if faces.is_empty() {
+        return Vec::new();
+    }
+    let base: Vec<String> = fonts.families.get(&egui::FontFamily::Proportional).cloned().unwrap_or_default();
+    let mut bound: Vec<String> = Vec::new();
+    for (bold, italic) in [(false, false), (true, false), (false, true), (true, true)] {
+        let Some(primary) = pick_face(faces, bold, italic) else { continue };
+        let mut chain: Vec<String> = Vec::new();
+        for face in [Some(primary), pick_face(faces, false, false)] {
+            let Some(face) = face else { continue };
+            let key = face_key(family, face);
+            if chain.contains(&key) {
+                continue;
+            }
+            let Ok(bytes) = std::fs::read(&face.path) else { continue };
+            let mut fd = egui::FontData::from_owned(bytes);
+            fd.index = face.index;
+            fonts.font_data.entry(key.clone()).or_insert_with(|| std::sync::Arc::new(fd));
+            chain.push(key);
+        }
+        if chain.is_empty() {
+            continue;
+        }
+        chain.extend(base.iter().cloned());
+        let role = role_key(family, bold, italic);
+        fonts.families.insert(egui::FontFamily::Name(role.clone().into()), chain);
+        bound.push(role);
+    }
+    bound
+}
+
+/// Bind every installed face of `family` (see [`bind_faces`]).
+pub fn bind_family(fonts: &mut egui::FontDefinitions, family: &str) -> Vec<String> {
+    bind_faces(fonts, family, &faces_of(family))
+}
+
+/// The role families currently bound to font data. `cell_family` consults this, so it never names a
+/// family egui hasn't been given.
+static BOUND: OnceLock<std::sync::RwLock<HashSet<String>>> = OnceLock::new();
+
+fn bound() -> &'static std::sync::RwLock<HashSet<String>> {
+    BOUND.get_or_init(|| std::sync::RwLock::new(HashSet::new()))
+}
+
+/// Record the role families a freshly built [`egui::FontDefinitions`] bound.
+pub fn set_bound(keys: impl IntoIterator<Item = String>) {
+    *bound().write().unwrap_or_else(|e| e.into_inner()) = keys.into_iter().collect();
+}
+
+/// Is this exact role family bound to font data?
+pub fn is_bound(role: &str) -> bool {
+    bound().read().unwrap_or_else(|e| e.into_inner()).contains(role)
+}
+
+/// Serializes tests that mutate the process-wide bound-family registry.
+#[cfg(test)]
+pub(crate) static TEST_LOCK: std::sync::Mutex<()> = std::sync::Mutex::new(());
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn style_names_map_to_weight_and_slant() {
+        assert_eq!(style_weight("Bold"), 700.0);
+        assert_eq!(style_weight("SemiBold Italic"), 600.0);
+        assert_eq!(style_weight("Regular"), 400.0);
+        assert_eq!(style_weight("Light Oblique"), 300.0);
+        assert!(style_italic("Bold Italic") && style_italic("Oblique"));
+        assert!(!style_italic("Bold"));
+        // The weight table is checked in order, so "extralight" wins over "light".
+        assert_eq!(style_weight("ExtraLight"), 200.0);
+    }
+
+    #[test]
+    fn role_keys_are_stable_and_distinct() {
+        assert_eq!(role_key("Segoe UI", false, false), "fnt:Segoe UI:nn");
+        assert_eq!(role_key("Segoe UI", true, false), "fnt:Segoe UI:bn");
+        assert_eq!(role_key("Segoe UI", false, true), "fnt:Segoe UI:ni");
+        assert_eq!(role_key("Segoe UI", true, true), "fnt:Segoe UI:bi");
+    }
+
+    #[test]
+    fn nothing_is_bound_until_font_definitions_says_so() {
+        let _g = TEST_LOCK.lock().unwrap_or_else(|e| e.into_inner());
+        // A role key is only safe to name after font_definitions bound it.
+        let k = role_key("Some Installed Font", true, false);
+        assert!(!is_bound(&k));
+        set_bound([k.clone()]);
+        assert!(is_bound(&k));
+        set_bound([]);
+        assert!(!is_bound(&k));
+    }
+
+    #[test]
+    fn damaged_or_non_font_files_contribute_nothing() {
+        assert!(file_faces(b"ttcf\x00\x01\x00\x00\xff\xff\xff\xff").is_empty());
+        assert!(file_faces(b"not a font at all").is_empty());
+        assert!(file_faces(&[]).is_empty());
+    }
+
+    #[cfg(not(target_arch = "wasm32"))]
+    #[test]
+    fn the_scan_catalogs_fonts_and_reads_each_folder_once() {
+        let dir = std::env::temp_dir().join(format!("gridcraft-fonts-scan-{}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&dir);
+        std::fs::create_dir_all(dir.join("Sub")).expect("temp dir");
+        std::fs::write(dir.join("Ubuntu-Light.ttf"), epaint_default_fonts::UBUNTU_LIGHT).expect("write");
+        std::fs::write(dir.join("damaged.ttf"), b"ttcf\x00\x01\x00\x00\xff\xff\xff\xff").expect("write");
+        std::fs::write(dir.join("readme.txt"), b"not a font").expect("write");
+        // The same folder listed twice (once through `Sub/..`) is read once.
+        let faces = scan_dirs(&[dir.clone(), dir.join("Sub/..")]);
+        let families: Vec<&str> = faces.iter().map(|f| f.family.as_str()).collect();
+        assert_eq!(families, ["Ubuntu"], "one face, family read from the name table");
+        assert_eq!(faces[0].weight, 300.0, "“Light” reads as weight 300");
+        assert!(!faces[0].italic);
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn a_link_back_to_a_parent_folder_ends_the_scan() {
+        let dir = std::env::temp_dir().join(format!("gridcraft-fonts-loop-{}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&dir);
+        std::fs::create_dir_all(dir.join("Sub")).expect("temp dir");
+        std::fs::write(dir.join("Sub/Ubuntu-Light.ttf"), epaint_default_fonts::UBUNTU_LIGHT).expect("write");
+        std::os::unix::fs::symlink(&dir, dir.join("Sub/loop")).expect("symlink");
+        assert_eq!(scan_dirs(&[dir.clone()]).len(), 1, "the loop doesn't multiply faces");
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
+    #[cfg(not(target_arch = "wasm32"))]
+    #[test]
+    fn binding_a_family_binds_all_four_roles_and_never_stores_missing_data() {
+        let dir = std::env::temp_dir().join(format!("gridcraft-fonts-bind-{}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&dir);
+        std::fs::create_dir_all(&dir).expect("temp dir");
+        let path = dir.join("Ubuntu-Light.ttf");
+        std::fs::write(&path, epaint_default_fonts::UBUNTU_LIGHT).expect("write");
+        let face = Face { family: "Ubuntu".into(), path, index: 0, weight: 300.0, italic: false };
+
+        let mut fonts = egui::FontDefinitions::default();
+        let bound = bind_faces(&mut fonts, "Ubuntu", std::slice::from_ref(&face));
+        assert_eq!(bound.len(), 4, "regular, bold, italic and bold-italic roles");
+        for key in &bound {
+            let chain = fonts.families.get(&egui::FontFamily::Name(key.as_str().into())).expect("role family");
+            assert!(chain.iter().all(|k| fonts.font_data.contains_key(k)), "every chained key has data");
+        }
+        // A family with no faces binds nothing and never touches the map.
+        assert!(bind_faces(&mut fonts, "No Such Font", &[]).is_empty());
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+}
diff --git a/crates/ui-egui/src/formula_bar.rs b/crates/ui-egui/src/formula_bar.rs
index 753585f10..48141c346 100644
--- a/crates/ui-egui/src/formula_bar.rs
+++ b/crates/ui-egui/src/formula_bar.rs
@@ -166,7 +166,7 @@ pub fn editor_widget(app: &mut SheetApp, ui: &mut egui::Ui, id: egui::Id, font:
             ed.caret_to_end = false;
             ed.sync_caret = true;
         }
-        if !ed.autocomplete.is_empty() && (tab || (enter && false)) {
+        if !ed.autocomplete.is_empty() && tab {
             ed.accept_autocomplete();
         } else if enter {
             action = Some((if shift { -1 } else { 1 }, 0, false, false));
diff --git a/crates/ui-egui/src/grid.rs b/crates/ui-egui/src/grid.rs
index 4b326cc36..4faf43a55 100644
--- a/crates/ui-egui/src/grid.rs
+++ b/crates/ui-egui/src/grid.rs
@@ -577,7 +577,7 @@ fn paint_quadrant(
         };
         let indent = st.align.indent as f32 * 9.0 * z;
         let pad = 2.5 * z;
-        if st.align.wrap || st.align.h == HAlign::Justify || text.contains('\n') && st.align.wrap {
+        if st.align.wrap || st.align.h == HAlign::Justify {
             let wrap_w = (rect.width() - 2.0 * pad - indent).max(4.0);
             let mut job = egui::text::LayoutJob::simple(text.clone(), font.clone(), color, wrap_w);
             job.halign = match halign {
@@ -1651,12 +1651,7 @@ fn filter_menu(app: &mut SheetApp, ui: &mut egui::Ui, geo: &Geo) {
     let Some(sh) = wb.sheet(si) else { return };
     let _ = geo;
     // Tables get an autofilter on demand.
-    let table_range = sh
-        .tables
-        .iter()
-        .find(|t| t.range.start.row <= at.y as u32 || true)
-        .filter(|t| col >= t.range.start.col && col <= t.range.end.col)
-        .map(|t| t.range);
+    let table_range = sh.tables.first().filter(|t| col >= t.range.start.col && col <= t.range.end.col).map(|t| t.range);
     if sh.autofilter.is_none()
         && let Some(r) = table_range
     {
diff --git a/crates/ui-egui/src/lib.rs b/crates/ui-egui/src/lib.rs
index 8eb1eca1a..fd08ba30d 100644
--- a/crates/ui-egui/src/lib.rs
+++ b/crates/ui-egui/src/lib.rs
@@ -11,6 +11,7 @@ pub mod control;
 pub mod credits;
 pub mod dialogs;
 pub mod editor;
+pub mod fonts;
 pub mod formula_bar;
 pub mod grid;
 pub mod icons;
@@ -104,6 +105,14 @@ pub struct SheetApp {
     pub perf: Perf,
     pub fonts_ready: bool,
     fonts_set: bool,
+    /// Workbook fonts bound into the current font set; a change rebinds (installed fonts only).
+    fonts_bound: Vec<String>,
+    /// The (doc uid, revision) `fonts_bound` was computed for, so the style table is walked only
+    /// when the workbook changes.
+    fonts_seen: (u64, u64),
+    /// Set while a font-set change is pending activation: skip this frame's paint, like the
+    /// startup `fonts_ready` gate (egui applies new definitions at the next pass).
+    fonts_rebind: bool,
     pub name_box: Option<String>,
     pub(crate) shots: control::Shots,
     /// Chart selected on the sheet (id).
@@ -133,6 +142,9 @@ impl SheetApp {
             perf: Perf::default(),
             fonts_ready: false,
             fonts_set: false,
+            fonts_bound: Vec::new(),
+            fonts_seen: (0, 0),
+            fonts_rebind: false,
             name_box: None,
             shots: control::Shots::default(),
             selected_chart: None,
@@ -140,12 +152,28 @@ impl SheetApp {
         }
     }
 
-    /// One-time context setup: fonts and visuals.
+    /// One-time context setup: start cataloging the machine's fonts, then install the fonts and
+    /// visuals. Workbook-specific fonts are bound later, once the scan is done (see [`logic`]).
+    ///
+    /// [`logic`]: SheetApp::logic
     pub fn setup_context(ctx: &egui::Context, dark: bool) {
-        ctx.set_fonts(theme::font_definitions());
+        fonts::start_scan();
+        ctx.set_fonts(theme::font_definitions(&[]));
         theme::apply(ctx, dark);
     }
 
+    /// The font names the active workbook uses: every style's font plus the theme's heading/body
+    /// fonts. These are the families [`fonts`] binds an installed file for.
+    pub fn used_fonts(&self) -> Vec<String> {
+        let mut names: Vec<String> = Vec::new();
+        if let Some(d) = self.session.active() {
+            names.extend(d.wb.styles.iter().map(|(_, s)| s.font.name.clone()));
+            names.push(d.wb.theme.major_font.clone());
+            names.push(d.wb.theme.minor_font.clone());
+        }
+        names
+    }
+
     /// Runs an engine command (or a UI command) and handles UI requests it makes.
     pub fn run(&mut self, id: &str, params: Json) -> Result<Json, String> {
         if let Some(r) = self.run_ui_command(id, &params) {
@@ -361,6 +389,24 @@ impl SheetApp {
                 self.fonts_set = true;
                 ctx.request_repaint();
             }
+        } else if self.fonts_rebind {
+            // A font-set change made last frame is active now.
+            self.fonts_rebind = false;
+        } else if fonts::scan_done() {
+            // Bind the workbook's installed fonts once the background scan has finished. Adding
+            // fonts re-applies the font set, which egui activates at the next pass, so skip this
+            // frame's paint (same one-frame cost as startup). Only when the workbook changed.
+            let seen = self.session.active().map(|d| (d.uid, d.revision)).unwrap_or((0, 0));
+            if seen != self.fonts_seen {
+                let used = self.used_fonts();
+                self.fonts_seen = seen;
+                if used != self.fonts_bound {
+                    ctx.set_fonts(theme::font_definitions(&used));
+                    self.fonts_bound = used;
+                    self.fonts_rebind = true;
+                    ctx.request_repaint();
+                }
+            }
         }
         if ctx.global_style().visuals.dark_mode != self.ui.dark {
             theme::apply(ctx, self.ui.dark);
@@ -394,7 +440,7 @@ impl SheetApp {
     /// Lays out the whole window.
     pub fn ui(&mut self, ui: &mut egui::Ui) {
         let ctx = ui.ctx().clone();
-        if !self.fonts_ready {
+        if !self.fonts_ready || self.fonts_rebind {
             ctx.request_repaint();
             return;
         }
diff --git a/crates/ui-egui/src/ribbon.rs b/crates/ui-egui/src/ribbon.rs
index 47c5432b4..6abe3f31e 100644
--- a/crates/ui-egui/src/ribbon.rs
+++ b/crates/ui-egui/src/ribbon.rs
@@ -688,9 +688,9 @@ fn font_combo(app: &mut SheetApp, ui: &mut Ui, st: &Style) {
     let mut name = st.font.name.clone();
     let before = name.clone();
     egui::ComboBox::from_id_salt("font_name").width(150.0).selected_text(egui::RichText::new(&name).font(theme::ui_font(12.5))).show_ui(ui, |ui| {
-        for f in FONTS {
-            let fam = theme::cell_family(f, false, false);
-            ui.selectable_value(&mut name, f.to_string(), egui::RichText::new(*f).font(egui::FontId::new(14.0, fam)));
+        for f in crate::fonts::families() {
+            let fam = theme::cell_family(&f, false, false);
+            ui.selectable_value(&mut name, f.clone(), egui::RichText::new(&f).font(egui::FontId::new(14.0, fam)));
         }
     });
     if name != before {
diff --git a/crates/ui-egui/src/theme.rs b/crates/ui-egui/src/theme.rs
index 2dbd8df7b..1b5155928 100644
--- a/crates/ui-egui/src/theme.rs
+++ b/crates/ui-egui/src/theme.rs
@@ -142,7 +142,16 @@ pub fn ui_bold(size: f32) -> FontId {
 }
 
 /// The font family to use for a cell font name and weight.
+///
+/// When the name is an installed font whose faces were bound by [`font_definitions`], that family
+/// is used; otherwise the name is bucketed to one of the built-in roles (mono/serif/cell). egui
+/// panics on a family that was never bound, so the installed branch is gated on
+/// [`crate::fonts::is_bound`] and never names a family egui hasn't been given.
 pub fn cell_family(name: &str, bold: bool, italic: bool) -> FontFamily {
+    let role = crate::fonts::role_key(name, bold, italic);
+    if crate::fonts::is_bound(&role) {
+        return FontFamily::Name(role.into());
+    }
     let lower = name.to_ascii_lowercase();
     if lower.contains("courier") || lower.contains("mono") || lower.contains("consolas") {
         return FontFamily::Name(MONO.into());
@@ -288,10 +297,16 @@ fn candidates(role: &str) -> Vec<(String, u32)> {
 }
 
 /// Builds the font set from system fonts (with egui's defaults as fallback).
-pub fn font_definitions() -> FontDefinitions {
+///
+/// `used` names the workbook's fonts (its styles' fonts and the theme's heading/body fonts). Any of
+/// them that is installed is bound by name, so cells set in it render with it; the rest fall back
+/// to the roles above. The set of bound role families is recorded in [`crate::fonts`] so
+/// [`cell_family`] only ever names a family egui has data for.
+pub fn font_definitions(used: &[String]) -> FontDefinitions {
     let mut fonts = FontDefinitions::default();
     let base_prop: Vec<String> = fonts.families.get(&FontFamily::Proportional).cloned().unwrap_or_default();
     let base_mono: Vec<String> = fonts.families.get(&FontFamily::Monospace).cloned().unwrap_or_default();
+    let mut bound: Vec<String> = Vec::new();
     for role in [UI, UI_BOLD, CELL, CELL_BOLD, CELL_ITALIC, CELL_BOLD_ITALIC, SERIF, MONO] {
         let paths = candidates(role);
         let refs: Vec<(&str, u32)> = paths.iter().map(|(p, i)| (p.as_str(), *i)).collect();
@@ -308,11 +323,17 @@ pub fn font_definitions() -> FontDefinitions {
         chain.extend(if role == MONO { base_mono.clone() } else { base_prop.clone() });
         chain.retain(|k| fonts.font_data.contains_key(k));
         fonts.families.insert(FontFamily::Name(role.into()), chain);
+        bound.push(role.to_string());
+    }
+    // Installed workbook fonts, so a cell's chosen font actually renders in it.
+    for family in crate::fonts::installed_among(used) {
+        bound.extend(crate::fonts::bind_family(&mut fonts, &family));
     }
     // Default proportional text in widgets uses the UI font.
     if let Some(ui) = fonts.families.get(&FontFamily::Name(UI.into())).cloned() {
         fonts.families.insert(FontFamily::Proportional, ui);
     }
+    crate::fonts::set_bound(bound);
     fonts
 }
 
@@ -351,3 +372,51 @@ pub fn apply(ctx: &egui::Context, dark: bool) {
 pub fn color32(rgb: [u8; 3]) -> Color32 {
     Color32::from_rgb(rgb[0], rgb[1], rgb[2])
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// The families [`font_definitions`] always binds, whatever is installed.
+    fn always_bound() -> Vec<String> {
+        [UI, UI_BOLD, CELL, CELL_BOLD, CELL_ITALIC, CELL_BOLD_ITALIC, SERIF, MONO].iter().map(|s| s.to_string()).collect()
+    }
+
+    #[test]
+    fn a_name_that_is_not_an_installed_font_gets_a_built_in_role() {
+        let _g = crate::fonts::TEST_LOCK.lock().unwrap_or_else(|e| e.into_inner());
+        // Nothing installed: every name buckets to a role that font_definitions bound.
+        crate::fonts::set_bound(always_bound());
+        for name in ["", "Calibri", "Courier New", "Times New Roman", "Grossly Missing Font", "\u{1F600}"] {
+            for (b, i) in [(false, false), (true, false), (false, true), (true, true)] {
+                let FontFamily::Name(fam) = cell_family(name, b, i) else { panic!("{name:?} should name a family") };
+                assert!(crate::fonts::is_bound(&fam), "{name:?} {b} {i} → unbound {fam:?}");
+            }
+        }
+    }
+
+    #[test]
+    fn a_bound_installed_font_is_used_by_name() {
+        let _g = crate::fonts::TEST_LOCK.lock().unwrap_or_else(|e| e.into_inner());
+        let role = crate::fonts::role_key("Ubuntu", true, false);
+        crate::fonts::set_bound(always_bound().into_iter().chain([role.clone()]));
+        assert!(matches!(cell_family("Ubuntu", true, false), FontFamily::Name(f) if *f == *role));
+        // The same family in a style that wasn't bound falls back to a built-in role that is.
+        let FontFamily::Name(fallback) = cell_family("Ubuntu", false, true) else { panic!("should name a family") };
+        assert!(crate::fonts::is_bound(&fallback), "the fallback is a bound role");
+        crate::fonts::set_bound(always_bound());
+    }
+
+    #[test]
+    fn arbitrary_names_never_yield_an_unbound_family() {
+        let _g = crate::fonts::TEST_LOCK.lock().unwrap_or_else(|e| e.into_inner());
+        // A workbook can hold any font name; none may name a family egui has no data for.
+        crate::fonts::set_bound(always_bound());
+        for seed in 0..500u32 {
+            let name: String =
+                (0..(seed % 40)).map(|k| char::from_u32(0x20 + (seed.wrapping_mul(31).wrapping_add(k) % 0x5F)).unwrap_or('x')).collect();
+            let FontFamily::Name(fam) = cell_family(&name, seed % 2 == 0, seed % 3 == 0) else { continue };
+            assert!(crate::fonts::is_bound(&fam), "{name:?} → unbound {fam:?}");
+        }
+    }
+}