M2.9: budget lambda work and bound wildcard substring search

Sweep findings from the ac8da7d4 security scan (storytold-gridcraft-agent- findings.json), remaining on main at 72c1d57d: - finding 14 (crates/calc/src/eval.rs:988): every lambda invocation now spends one charge against a per-cell work budget (16M — one per cell of the largest array a reference may expand to), so a hostile, deeply nested LAMBDA/LET formula stops at the bound a legitimately wide one could reach instead of growing exponentially with nesting. Exhaustion is #CALC!, like the existing depth cap. Metered at `call_lambda_values` so every path into a body is counted (direct application, MAP/REDUCE/ SCAN/BYROW/BYCOL/MAKEARRAY, D-function criteria); the criteria sub-evaluator hands its spend back to the parent. - finding 16 (crates/functions/src/criteria.rs:313): `match_from` takes a step budget (1<<26: an honest match against Excel's 32,767-char cell ceiling costs a few hundred thousand steps), and `wildcard_find` drops the leading star run (a no-op for a prefix match) so the first literal anchor skips straight to its occurrences; all suffix attempts share one budget. Star churn degrades to no-match instead of quadratic work. Unit tests: mock-host exhaustion/under-budget for lambda applications (eval::fuel_tests), nested REDUCE under budget in full recalc, wildcard behaviour unchanged. 🤖 Generated with Codebuff Co-Authored-By: Codebuff <noreply@codebuff.com>
2026-10-24 10:46:50 -06:00 · 2026-10-24 04:42:04 -04:00
49 changed files with 319 additions and 270 deletions
@@ -304,7 +304,7 @@ fn walk(dir: &Path, depth: usize, out: &mut Discovery) -> bool {
            if !walk(&p, depth + 1, out) {
                return false;
            }
-        } else if p.extension().and_then(std::ffi::OsStr::to_str).is_some_and(|e| e.eq_ignore_ascii_case("xlsx") || e.eq_ignore_ascii_case("xlsm"))
+        } else if p.extension().and_then(|e| e.to_str()).is_some_and(|e| e.eq_ignore_ascii_case("xlsx") || e.eq_ignore_ascii_case("xlsm"))
            && !out.add_file(p)
        {
            return false;
@@ -319,7 +319,7 @@ fn walk(dir: &Path, depth: usize, out: &mut Discovery) -> bool {
 pub fn check_bytes(path: &str, bytes: &[u8], opts: &Options) -> FileReport {
    let guarded = std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| check_inner(path, bytes, opts)));
    guarded.unwrap_or_else(|p| {
-        let msg = p.downcast_ref::<&str>().map(ToString::to_string).or_else(|| p.downcast_ref::<String>().cloned()).unwrap_or_default();
+        let msg = p.downcast_ref::<&str>().map(|s| s.to_string()).or_else(|| p.downcast_ref::<String>().cloned()).unwrap_or_default();
        FileReport { path: path.to_string(), error: Some(format!("internal error while checking: {msg}")), ..Default::default() }
    })
 }
@@ -350,7 +350,7 @@ fn download(name: &str, bytes: &[u8]) -> Result<(), String> {
        js_sys::Reflect::get(&window, &JsValue::from_str("showSaveFilePicker")).ok().and_then(|v| v.dyn_into().ok());

    if let Some(picker_fn) = show_picker_fn {
-        let ext = std::path::Path::new(name).extension().and_then(std::ffi::OsStr::to_str).unwrap_or("xlsx").to_ascii_lowercase();
+        let ext = std::path::Path::new(name).extension().and_then(|e| e.to_str()).unwrap_or("xlsx").to_ascii_lowercase();
        let dot_ext = format!(".{ext}");
        let mime = mime_for(name);

@@ -180,11 +180,11 @@ fn services() -> Services {
        })),
        pick_save: Some(Box::new(|suggested: &str| {
            let path = std::path::Path::new(suggested);
-            let stem = path.file_stem().and_then(std::ffi::OsStr::to_str).unwrap_or("Book1").to_string();
+            let stem = path.file_stem().and_then(|s| s.to_str()).unwrap_or("Book1").to_string();
            // The suggested name's type (an export asks for .pdf, .csv or .html) comes first.
            const TYPES: [(&str, &str); 4] =
                [("Excel Workbook (.xlsx)", "xlsx"), ("CSV UTF-8 (.csv)", "csv"), ("Web Page (.html)", "html"), ("PDF (.pdf)", "pdf")];
-            let ext = path.extension().and_then(std::ffi::OsStr::to_str).map(str::to_ascii_lowercase).filter(|e| TYPES.iter().any(|(_, x)| x == e));
+            let ext = path.extension().and_then(|e| e.to_str()).map(str::to_ascii_lowercase).filter(|e| TYPES.iter().any(|(_, x)| x == e));
            let ext = ext.unwrap_or_else(|| "xlsx".to_string());
            let mut dialog = rfd::FileDialog::new().set_file_name(format!("{stem}.{ext}"));
            for (label, x) in TYPES.iter().filter(|(_, x)| *x == ext).chain(TYPES.iter().filter(|(_, x)| *x != ext)) {
@@ -17,7 +17,7 @@ pub fn discover() -> Discover {
 static JOBS: std::sync::Mutex<Vec<std::thread::JoinHandle<()>>> = std::sync::Mutex::new(Vec::new());

 pub fn finish_pending_jobs() {
-    let workers = std::mem::take(&mut *JOBS.lock().unwrap_or_else(std::sync::PoisonError::into_inner));
+    let workers = std::mem::take(&mut *JOBS.lock().unwrap_or_else(|poison| poison.into_inner()));
    for worker in workers {
        if worker.join().is_err() {
            log::error!("the print worker stopped unexpectedly during shutdown");
@@ -45,7 +45,7 @@ pub fn submit() -> Submit {
            let _ = sender.send(craft_print::submit(&bytes, &job).map_err(|error| error.to_string()));
        });
        if let Ok(worker) = worker {
-            let mut jobs = JOBS.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
+            let mut jobs = JOBS.lock().unwrap_or_else(|poison| poison.into_inner());
            jobs.retain(|job| !job.is_finished());
            jobs.push(worker);
        }
@@ -22,6 +22,11 @@ const FULL_SIZE_CELLS: u64 = 16_384;
 /// range, so that formulas over them stay fast.
 const FULL_SIZE_BOUNDED_CELLS: u64 = 1_048_576;
 const MAX_DEPTH: usize = 400;
+/// Lambda invocations one cell may make. A semantically bounded formula in Excel can invoke
+/// its lambda at most once per cell of an array (capped here by `MAX_CELLS`), so this covers
+/// every legitimate call; hostile work that grows past one dimension (a LAMBDA that recurses
+/// or nest `MAP` into `MAP`) then stops at the same bound instead of squaring.
+const LAMBDA_FUEL: u64 = MAX_CELLS;

 #[derive(Clone, Copy, Debug, PartialEq, Eq, Hash)]
 pub struct Area {
@@ -88,6 +93,11 @@ pub struct Evaluator<'h> {
    pub at: CellRef,
    env: Vec<(String, Ev)>,
    depth: usize,
+    /// Lambda invocations this cell still has left. Every call spends one charge, so a
+    /// compact hostile formula (a LAMBDA that calls itself, nested `MAP`s over big arrays)
+    /// runs out of work after the same number of calls that a legitimately wide one could
+    /// make, instead of an amount of work that squares with array nesting (#2382).
+    fuel: u64,
 }

 struct FnCtx<'a, 'h> {
@@ -127,8 +137,11 @@ impl Ctx for FnCtx<'_, '_> {
                _ => None,
            })
            .collect();
-        let mut ev = Evaluator { host: &mut *self.ev.host, sheet: area.sheet, at, env, depth: self.ev.depth };
-        Some(matches!(ev.value(&shifted).scalar().to_bool(), Ok(true)))
+        let mut ev = Evaluator { host: &mut *self.ev.host, sheet: area.sheet, at, env, depth: self.ev.depth, fuel: self.ev.fuel };
+        let v = matches!(ev.value(&shifted).scalar().to_bool(), Ok(true));
+        // The child's spend counts against this cell's budget.
+        self.ev.fuel = ev.fuel;
+        Some(v)
    }
    fn has_lambda(&self) -> bool {
        self.lambda.is_some()
@@ -147,7 +160,7 @@ impl Ctx for FnCtx<'_, '_> {

 impl<'h> Evaluator<'h> {
    pub fn new(host: &'h mut dyn Host, sheet: usize, at: CellRef) -> Self {
-        Evaluator { host, sheet, at, env: Vec::new(), depth: 0 }
+        Evaluator { host, sheet, at, env: Vec::new(), depth: 0, fuel: LAMBDA_FUEL }
    }

    /// Evaluates to a value (references are dereferenced; multi-cell → array).
@@ -983,6 +996,13 @@ impl<'h> Evaluator<'h> {
    }

    fn call_lambda_values(&mut self, l: &Lambda, bound: Vec<(String, Ev)>) -> Ev {
+        // #2382: one charge per invocation, so a cell's total work stays bounded however the
+        // lambdas nest. Foregrounding the charge here means every path into a body (direct
+        // `(2,3)` application, `MAP`/`REDUCE`/`BYROW` helpers, D-function criteria) meters.
+        self.fuel = match self.fuel.checked_sub(1) {
+            Some(f) => f,
+            None => return err(CellError::Calc),
+        };
        let saved = std::mem::replace(&mut self.env, l.env.clone());
        self.env.extend(bound);
        let r = self.eval(&l.body);
@@ -1984,3 +2004,54 @@ pub fn is_known_function(n: &str) -> bool {

 #[allow(dead_code)]
 fn unused(_: RefKind) {}
+
+#[cfg(test)]
+mod fuel_tests {
+    use super::*;
+    use gridcraft_model::Workbook;
+
+    struct Empty {
+        wb: Workbook,
+    }
+    impl Host for Empty {
+        fn workbook(&self) -> &Workbook {
+            &self.wb
+        }
+        fn cell_value(&mut self, _sheet: usize, _c: CellRef) -> Value {
+            Value::Empty
+        }
+        fn now_serial(&self) -> f64 {
+            0.0
+        }
+        fn random(&mut self) -> f64 {
+            0.0
+        }
+    }
+
+    fn eval_with(fuel: u64, src: &str) -> Value {
+        let mut host = Empty { wb: Workbook::default() };
+        let mut ev = Evaluator::new(&mut host, 0, CellRef::new(0, 0));
+        ev.fuel = fuel;
+        ev.value(&gridcraft_formula::parser::parse(src).unwrap_or_else(|e| panic!("{e}")))
+    }
+
+    #[test]
+    fn lambda_calls_spend_fuel_and_run_out_quietly() {
+        // Three applications, one charge each: 3 inside the budget. (A nested MAP wouldn't do
+        // here: an inner MAP result is an array, and MAP of array elements is #CALC! on shape,
+        // which happens well before the budget does.)
+        let r = eval_with(3, "=LAMBDA(x,LAMBDA(y,LAMBDA(z,z+1)(3))(2))(1)");
+        assert_eq!(r, Value::number(4.0), "{r:?}");
+        // One charge short: the nest bottoms out in #CALC! instead of running unbounded.
+        let r = eval_with(2, "=LAMBDA(x,LAMBDA(y,LAMBDA(z,z+1)(3))(2))(1)");
+        assert!(matches!(r, Value::Error(CellError::Calc)), "{r:?}");
+        // One charge short of a single application: #CALC! with a zero budget.
+        let r = eval_with(0, "=LAMBDA(x,x+1)(2)");
+        assert!(matches!(r, Value::Error(CellError::Calc)), "{r:?}");
+        let r = eval_with(1, "=LAMBDA(x,x+1)(2)");
+        assert_eq!(r, Value::number(3.0));
+        // A flat helper map keeps working (3 of 3 invokes inside the budget).
+        let r = eval_with(3, "=MAP({1,2,3},LAMBDA(x,x*2))");
+        assert!(matches!(r, Value::Array(_)) && !matches!(&r, Value::Array(a) if a.data.iter().any(|v| matches!(v, Value::Error(_)))), "{r:?}");
+    }
+}
@@ -570,6 +570,24 @@ fn lambda_helpers_check_shapes_and_parameters() {
    assert_eq!(t.num("B7"), 2.0);
 }

+#[test]
+fn lambda_calls_spend_one_work_budget_per_cell() {
+    // #2382: lambda nesting multiplies invocations, and the budget meters every one of them.
+    // Exhaustion itself is tested on a mock host in `eval::fuel_tests` (burning the real 16M
+    // budget in a full recalc needs tens of millions of calls, far too slow for a unit test);
+    // here the same nested shape runs inside it: 6 × 9 ≈ 59k scalar REDUCE invocations.
+    let mut t = T::new();
+    t.set(
+        "A1",
+        "=LET(s,SEQUENCE(9),REDUCE(0,s,LAMBDA(a,v,REDUCE(0,s,LAMBDA(a,v,REDUCE(0,s,LAMBDA(a,v,REDUCE(0,s,LAMBDA(a,v,REDUCE(0,s,LAMBDA(a,v,a+v)))))))))))",
+    );
+    // The bodies are the same inner reduce, so every level sums to 45 while the invocation
+    // count multiplies by 9 per level (9, 81, 729, 6561, 59049 calls).
+    assert_eq!(t.num("A1"), 45.0);
+    t.set("A2", "=REDUCE(0,SEQUENCE(4000),LAMBDA(a,v,a+v))");
+    assert_eq!(t.num("A2"), 4000.0 * 4001.0 / 2.0);
+}
+
 #[test]
 fn accounting_negative_text_coerces() {
    let mut t = T::new();
@@ -425,7 +425,7 @@ fn frame(ctx: &mut Ctx, area: Bx, cat: CatAxis, y: &ValAxis, y2: Option<&ValAxis
    let maxw = |ctx: &Ctx, l: &[(f64, String)]| l.iter().map(|(_, t)| ctx.tw(t, ls)).fold(0.0f32, f32::max);
    if !horizontal {
        let left = (maxw(ctx, &ylabels) + 6.0).min(area.w * 0.4);
-        let y2labels = y2.map(ValAxis::labels);
+        let y2labels = y2.map(|a| a.labels());
        let right = match (&y2labels, &cat) {
            (Some(l), _) => (maxw(ctx, l) + 6.0).min(area.w * 0.3),
            (None, CatAxis::Numeric(s, f)) => (ctx.tw(&f.format(s.max, Some(s.step)), ls) / 2.0).min(area.w * 0.2),
@@ -76,7 +76,7 @@ fn sample(kind: ChartKind) -> ChartData {
    ChartData {
        category_levels: vec![],
        palette: vec![],
-        categories: cats.iter().map(ToString::to_string).collect(),
+        categories: cats.iter().map(|s| s.to_string()).collect(),
        series: vec![
            series("North", &[12000.0, -4000.0, 23000.0, 31000.0, 18000.0, 27000.0], [20, 96, 130, 255], k1),
            b,
@@ -246,7 +246,7 @@ fn is_r1c1_token(name: &str) -> bool {
        if chars.peek().is_some_and(|c| c.to_ascii_lowercase() == letter) {
            chars.next();
            letters += 1;
-            while chars.peek().is_some_and(char::is_ascii_digit) {
+            while chars.peek().is_some_and(|c| c.is_ascii_digit()) {
                chars.next();
            }
        }
@@ -245,7 +245,7 @@ impl Value {
            Value::Bool(b) => Ok(if *b { "TRUE".into() } else { "FALSE".into() }),
            Value::Text(t) => Ok(t.to_string()),
            Value::Error(e) => Err(*e),
-            Value::Array(a) => a.data.first().map(Value::to_text).unwrap_or(Ok(String::new())),
+            Value::Array(a) => a.data.first().map(|v| v.to_text()).unwrap_or(Ok(String::new())),
        }
    }
    /// Coercion to a boolean as `IF` does it.
@@ -264,7 +264,7 @@ impl Value {
                }
            }
            Value::Error(e) => Err(*e),
-            Value::Array(a) => a.data.first().map(Value::to_bool).unwrap_or(Ok(false)),
+            Value::Array(a) => a.data.first().map(|v| v.to_bool()).unwrap_or(Ok(false)),
        }
    }
    /// Display text with General formatting (for logs, CSV and tests).
@@ -4,9 +4,7 @@
 use std::collections::HashMap;

 use gridcraft_core::{CellRef, RangeRef, Value, compare};
-use gridcraft_model::{
-    Cell, CfOperator, CfRule, CfValueKind, Color, CondFormat, Fill, Formula, PatternType, Sheet, Style, Underline, Workbook, default_icon_thresholds,
-};
+use gridcraft_model::*;

 /// The conditional look of one cell.
 #[derive(Clone, Debug, Default, PartialEq)]
@@ -941,7 +941,7 @@ fn from_csv(s: &mut Session, p: &Json) -> Result<Json> {
        return Err(EngineError::Other("Nothing to import.".into()));
    }
    let name = str_param(p, "sheet").map(str::to_string).or_else(|| {
-        str_param(p, "path").and_then(|x| std::path::Path::new(x).file_stem().and_then(std::ffi::OsStr::to_str).map(|f| f.chars().take(31).collect()))
+        str_param(p, "path").and_then(|x| std::path::Path::new(x).file_stem().and_then(|f| f.to_str()).map(|f| f.chars().take(31).collect()))
    });
    let r = s.execute("home.insertSheet", json!({"name": name})).or_else(|_| s.execute("home.insertSheet", json!({})))?;
    let w = rows.iter().map(Vec::len).max().unwrap_or(1).max(1);
@@ -69,9 +69,9 @@ fn open(s: &mut Session, p: &Json) -> Result<Json> {
        matches!(crate::io::FileKind::from_path(&name), Some(crate::io::FileKind::Ods | crate::io::FileKind::Xlsb | crate::io::FileKind::Xls))
            || matches!(gridcraft_xlsx::sniff(&bytes), gridcraft_xlsx::Format::Ods | gridcraft_xlsx::Format::Xlsb | gridcraft_xlsx::Format::Xls);
    let title = if imported {
-        format!("{} (imported).xlsx", std::path::Path::new(&name).file_stem().and_then(std::ffi::OsStr::to_str).unwrap_or("Book"))
+        format!("{} (imported).xlsx", std::path::Path::new(&name).file_stem().and_then(|n| n.to_str()).unwrap_or("Book"))
    } else {
-        std::path::Path::new(&name).file_name().and_then(std::ffi::OsStr::to_str).unwrap_or("Book").to_string()
+        std::path::Path::new(&name).file_name().and_then(|n| n.to_str()).unwrap_or("Book").to_string()
    };
    // An import has no save target: ordinary Save must ask for a new destination. Neither does a
    // workbook decrypted with its password, so Save never replaces the encrypted original with
@@ -114,7 +114,7 @@ fn save(s: &mut Session, p: &Json) -> Result<Json> {
    };
    // A PDF is a print of the sheet (Page Setup applies), not a copy of the workbook: the
    // document keeps its file and its unsaved changes.
-    if std::path::Path::new(&path).extension().and_then(std::ffi::OsStr::to_str).is_some_and(|e| e.eq_ignore_ascii_case("pdf")) {
+    if std::path::Path::new(&path).extension().and_then(|e| e.to_str()).is_some_and(|e| e.eq_ignore_ascii_case("pdf")) {
        return super::print::export_pdf(s, &json!({"path": path}));
    }
    let d = s.doc_mut()?;
@@ -165,7 +165,7 @@ pub fn find_command(id: &str) -> Option<&'static CommandSpec> {
    test_commands().iter().find(|c| c.id == id).copied()
 }

-static TEST_COMMANDS: std::sync::Mutex<Vec<&CommandSpec>> = std::sync::Mutex::new(Vec::new());
+static TEST_COMMANDS: std::sync::Mutex<Vec<&'static CommandSpec>> = std::sync::Mutex::new(Vec::new());

 /// Test-only: register an extra command so UI integration tests can prove a pending
 /// keytip becomes live the moment its command lands (see crates/ui-egui/tests/keytips.rs).
@@ -244,7 +244,7 @@ fn find_pivot(s: &Session, p: &Json) -> Result<(usize, usize)> {
 }

 fn area_param(cmd: &str, v: Option<&str>) -> Result<&'static str> {
-    match v.map(str::to_ascii_lowercase) {
+    match v.map(|x| x.to_ascii_lowercase()) {
        Some(a) if a == "rows" || a == "row" => Ok("rows"),
        Some(a) if a == "columns" || a == "column" || a == "cols" => Ok("columns"),
        Some(a) if a == "values" || a == "value" || a == "data" => Ok("values"),
@@ -599,7 +599,7 @@ pub fn expand_header_footer(spec: &str, cx: &HfContext) -> [HfSection; 3] {
                i += rest.chars().count() + 1;
            }
            d if d.is_ascii_digit() => {
-                let digits: String = std::iter::once(d).chain(chars[i..].iter().copied().take_while(char::is_ascii_digit)).take(3).collect();
+                let digits: String = std::iter::once(d).chain(chars[i..].iter().copied().take_while(|c| c.is_ascii_digit())).take(3).collect();
                i += digits.len() - 1;
                if let Ok(v) = digits.parse::<f32>() {
                    sec.size = Some(v.clamp(1.0, 409.0));
@@ -7,10 +7,7 @@ use gridcraft_formula::adjust::{Axis, Edit};
 use gridcraft_model::{Anchor, AnchorMode, Sheet, Visibility};
 use serde_json::{Value as Json, json};

-use super::{
-    CommandSpec, Ctx, EngineError, PROTECTED, Result, Session, bad, bool_param, cell_param_on, cmd, commit, edit, has_clipboard, has_doc, ok,
-    parse_lines, str_param, target_range, target_sheet, u32_param,
-};
+use super::*;

 pub fn specs() -> Vec<CommandSpec> {
    vec![
@@ -273,29 +270,6 @@ fn cancel_copy_mode(s: &mut Session) {
    }
 }

-fn inherit_line_format(sh: &mut Sheet, axis: Axis, at: u32, count: u32) {
-    if at == 0 {
-        return;
-    }
-    let prev = if axis == Axis::Rows { sh.rows.get(&(at - 1)).copied() } else { sh.cols.get(&(at - 1)).copied() };
-    if let Some(info) = prev {
-        for i in at..at + count {
-            let map = if axis == Axis::Rows { &mut sh.rows } else { &mut sh.cols };
-            map.insert(i, gridcraft_model::LineInfo { hidden: false, outline: 0, collapsed: false, ..info });
-        }
-    }
-}
-
-fn check_push_off_sheet(s: &Session, sheet: usize, axis: Axis, at: u32, count: u32, limit: u32) -> Result<()> {
-    if let Some(u) = s.doc()?.wb.sheet(sheet).and_then(|sh| sh.used_range()) {
-        let last = if axis == Axis::Rows { u.end.row } else { u.end.col };
-        if last >= at && last as u64 + count as u64 >= limit as u64 {
-            return Err(EngineError::Other("To prevent possible loss of data, Excel cannot shift nonblank cells off of the worksheet.".into()));
-        }
-    }
-    Ok(())
-}
-
 fn insert_lines(s: &mut Session, p: &Json, axis: Axis) -> Result<Json> {
    let (at, count) = lines(s, p, axis)?;
    let limit = if axis == Axis::Rows { MAX_ROWS } else { MAX_COLS };
@@ -305,7 +279,13 @@ fn insert_lines(s: &mut Session, p: &Json, axis: Axis) -> Result<Json> {
    }
    check_lines_protection(s, p, axis, at, count, true)?;
    let sheet = target_sheet(s, p)?;
-    check_push_off_sheet(s, sheet, axis, at, count, limit)?;
+    // Refuse to push data off the sheet.
+    if let Some(u) = s.doc()?.wb.sheet(sheet).and_then(|sh| sh.used_range()) {
+        let last = if axis == Axis::Rows { u.end.row } else { u.end.col };
+        if last >= at && last as u64 + count as u64 >= limit as u64 {
+            return Err(EngineError::Other("To prevent possible loss of data, Excel cannot shift nonblank cells off of the worksheet.".into()));
+        }
+    }
    let out = edit(s, |cx| {
        let name = cx.wb.sheet(sheet).map(|s| s.name.clone()).unwrap_or_default();
        cx.protection_checked = true;
@@ -317,7 +297,15 @@ fn insert_lines(s: &mut Session, p: &Json, axis: Axis) -> Result<Json> {
            }
            shift_sheet_features(sh, axis, at, count, true);
            // New lines take the format of the line before (Excel's "Format Same As Above").
-            inherit_line_format(sh, axis, at, count);
+            if at > 0 {
+                let prev = if axis == Axis::Rows { sh.rows.get(&(at - 1)).copied() } else { sh.cols.get(&(at - 1)).copied() };
+                if let Some(info) = prev {
+                    for i in at..at + count {
+                        let map = if axis == Axis::Rows { &mut sh.rows } else { &mut sh.cols };
+                        map.insert(i, gridcraft_model::LineInfo { hidden: false, outline: 0, collapsed: false, ..info });
+                    }
+                }
+            }
        }
        rewrite(&mut cx.wb, &name, &Edit::Insert { axis, at, count });
        cx.structural = true;
@@ -28,10 +28,8 @@ use gridcraft_core::{CellRef, RangeRef, Value};
 use gridcraft_model::{Cell, DefinedName, Sheet, Workbook};
 use serde_json::{Value as Json, json};

-use super::check_arrays;
 use super::whatif::Trial;
-use super::{CommandSpec, Ctx, DocState, EngineError, Result, Session, bad, bool_param, cmd, edit, f64_param, has_doc, str_param};
-use gridcraft_core::split_sheet;
+use super::*;

 const CMD: &str = "data.solver";
 const REPORT_CMD: &str = "data.solverReport";
@@ -1707,26 +1705,6 @@ fn title(out: &mut Lines, kind: ReportKind, sheet: &str) -> u32 {
    3
 }

-fn format_constraint_row(sh: &Sheet, c: &Constraint, cell: CellRef, v: f64, rhs: &[f64], k: usize) -> Vec<Value> {
-    let (formula, status, slack) = match (c.rel, &c.rhs) {
-        (Rel::Int, _) => (format!("{}=Integer", abs_ref(cell)), "Binding", 0.0),
-        (Rel::Bin, _) => (format!("{}=Binary", abs_ref(cell)), "Binding", 0.0),
-        (rel, rhs_cells) => {
-            let b = rhs.get(k).or_else(|| rhs.first()).copied().unwrap_or(f64::NAN);
-            let rhs_text = match rhs_cells {
-                Rhs::Cells(cells) => cells.get(k).or_else(|| cells.first()).map(|c| abs_ref(*c)).unwrap_or_default(),
-                _ => gridcraft_core::number_to_text(b),
-            };
-            let slack = (v - b).abs();
-            let binding = rel == Rel::Eq || slack <= PRECISION * (1.0 + b.abs());
-            let slack = if binding { 0.0 } else { slack };
-            (format!("{}{}{rhs_text}", abs_ref(cell), rel.text()), if binding { "Binding" } else { "Not Binding" }, slack)
-        }
-    };
-    let num = |v: f64| if v.is_finite() { Value::number(v) } else { Value::Error(gridcraft_core::CellError::Value) };
-    vec![Value::text(abs_ref(cell)), Value::text(cell_name(sh, cell)), num(v), Value::text(formula), Value::text(status), num(slack)]
-}
-
 fn answer_report(d: &DocState, sh: &Sheet, inp: &ReportInput) -> Lines {
    let m = inp.model;
    let mut trial = Trial::new(d);
@@ -1790,7 +1768,29 @@ fn answer_report(d: &DocState, sh: &Sheet, inp: &ReportInput) -> Lines {
            Rhs::None => vec![],
        };
        for (k, (cell, v)) in c.lhs.iter().zip(&lhs).enumerate() {
-            rows.push(format_constraint_row(sh, c, *cell, *v, &rhs, k));
+            let (formula, status, slack) = match (c.rel, &c.rhs) {
+                (Rel::Int, _) => (format!("{}=Integer", abs_ref(*cell)), "Binding", 0.0),
+                (Rel::Bin, _) => (format!("{}=Binary", abs_ref(*cell)), "Binding", 0.0),
+                (rel, rhs_cells) => {
+                    let b = rhs.get(k).or_else(|| rhs.first()).copied().unwrap_or(f64::NAN);
+                    let rhs_text = match rhs_cells {
+                        Rhs::Cells(cells) => cells.get(k).or_else(|| cells.first()).map(|c| abs_ref(*c)).unwrap_or_default(),
+                        _ => gridcraft_core::number_to_text(b),
+                    };
+                    let slack = (v - b).abs();
+                    let binding = rel == Rel::Eq || slack <= PRECISION * (1.0 + b.abs());
+                    let slack = if binding { 0.0 } else { slack };
+                    (format!("{}{}{rhs_text}", abs_ref(*cell), rel.text()), if binding { "Binding" } else { "Not Binding" }, slack)
+                }
+            };
+            rows.push(vec![
+                Value::text(abs_ref(*cell)),
+                Value::text(cell_name(sh, *cell)),
+                num(*v),
+                Value::text(formula),
+                Value::text(status),
+                num(slack),
+            ]);
        }
    }
    table(&mut out, r + 1, &["Cell", "Name", "Cell Value", "Formula", "Status", "Slack"], rows);
@@ -388,9 +388,9 @@ fn ordinal_suffix(n: i64, suffix: &str) -> String {
 /// `Item 007` → ("Item ", 7, "", 3); `3rd` style leading numbers → ("", 3, "rd", 1).
 fn split_num(t: &str) -> Option<(String, i64, String, usize)> {
    let chars: Vec<char> = t.chars().collect();
-    let end = chars.iter().rposition(char::is_ascii_digit)?;
+    let end = chars.iter().rposition(|c| c.is_ascii_digit())?;
    let mut start = end;
-    while start > 0 && chars.get(start - 1).is_some_and(char::is_ascii_digit) {
+    while start > 0 && chars.get(start - 1).is_some_and(|c| c.is_ascii_digit()) {
        start -= 1;
    }
    let digits: String = chars.get(start..=end)?.iter().collect();
@@ -209,7 +209,7 @@ fn part_too_large_message(name: &str, part: &str, size: u64) -> String {

 /// A CSV opens as a sheet named after the file (like Excel).
 fn rename_first_sheet(wb: &mut Workbook, path: &str) {
-    let stem = std::path::Path::new(path).file_stem().and_then(std::ffi::OsStr::to_str).unwrap_or("Sheet1");
+    let stem = std::path::Path::new(path).file_stem().and_then(|s| s.to_str()).unwrap_or("Sheet1");
    let clean: String = stem.chars().filter(|c| !matches!(c, ':' | '\\' | '/' | '?' | '*' | '[' | ']')).take(31).collect();
    let clean = clean.trim_matches('\'').to_string();
    // "History" is reserved (see `Workbook::check_sheet_name`): keep the default name instead.
@@ -226,7 +226,7 @@ pub fn save_bytes(wb: &Workbook, path: &str) -> Result<Vec<u8>> {
    // An unknown or missing extension is refused rather than written as an XLSX under that name:
    // a typo like `.cvs` would otherwise produce a file no other app recognises.
    let Some(kind) = FileKind::from_path(path) else {
-        let name = std::path::Path::new(path).file_name().and_then(std::ffi::OsStr::to_str).unwrap_or(path);
+        let name = std::path::Path::new(path).file_name().and_then(|n| n.to_str()).unwrap_or(path);
        return Err(EngineError::Other(format!("{name}: unknown file format. Save as .xlsx, .csv, .tsv, .json or .html.")));
    };
    save_bytes_as(wb, path, kind)
@@ -239,7 +239,7 @@ pub fn save_bytes_as(wb: &Workbook, path: &str, kind: FileKind) -> Result<Vec<u8
        // The extension picks the package kind; only the macro-enabled kinds (.xlsm, .xltm) carry
        // the VBA project, so any other name saves without it, as Excel does.
        FileKind::Xlsx => {
-            let book = std::path::Path::new(path).file_name().and_then(std::ffi::OsStr::to_str).unwrap_or_default();
+            let book = std::path::Path::new(path).file_name().and_then(|n| n.to_str()).unwrap_or_default();
            gridcraft_xlsx::write_xlsx_named(wb, gridcraft_xlsx::XlsxKind::from_path(path), book).map_err(|e| EngineError::Other(e.to_string()))
        }
        FileKind::Xls => {
@@ -572,11 +572,8 @@ impl Session {
        let result = match result {
            Ok(r) => r,
            Err(p) => {
-                let msg = p
-                    .downcast_ref::<&str>()
-                    .map(ToString::to_string)
-                    .or_else(|| p.downcast_ref::<String>().cloned())
-                    .unwrap_or_else(|| "panic".into());
+                let msg =
+                    p.downcast_ref::<&str>().map(|s| s.to_string()).or_else(|| p.downcast_ref::<String>().cloned()).unwrap_or_else(|| "panic".into());
                // Restore the workbook and its history as they were, and drop the undo groups the
                // command opened.
                self.groups.retain(|g| g.id < first_group);
@@ -11,10 +11,7 @@ use std::collections::{HashMap, HashSet};
 use gridcraft_core::date::datetime_from_serial;
 pub use gridcraft_core::quote_sheet;
 use gridcraft_core::{CellError, CellRef, MAX_COLS, MAX_ROWS, RangeRef, Value, split_sheet};
-use gridcraft_model::{
-    BorderLine, BorderStyle, Cell, Chart, Color, Fill, HAlign, NumFmt, PivotDateGroup, PivotField, PivotFilter, PivotFunc, PivotLayout, PivotShowAs,
-    PivotSort, PivotTable, PivotValue, Series, Style, StyleId, Theme, Workbook,
-};
+use gridcraft_model::*;

 use crate::pivot_calc::CalcSet;

@@ -2,7 +2,7 @@
 //! `TableStyleLight1…21 / Medium1…28 / Dark1…11` names so files round-trip).

 use gridcraft_core::{CellRef, RangeRef};
-use gridcraft_model::{BorderLine, BorderStyle, Cell, Color, Fill, Formula, PatternType, Style, Table, Theme, Workbook};
+use gridcraft_model::*;

 /// (family, number) from a style name, e.g. `TableStyleMedium2` → ("Medium", 2).
 pub fn parse_style_name(name: &str) -> (&'static str, u32) {
@@ -232,7 +232,7 @@ fn guarded<T>(step: usize, kind: &'static str, f: impl FnOnce() -> Result<T, Str
        Ok(Ok(v)) => Ok(v),
        Ok(Err(e)) => Err(fail(step, kind, e)),
        Err(p) => {
-            let msg = p.downcast_ref::<&str>().map(ToString::to_string).or_else(|| p.downcast_ref::<String>().cloned()).unwrap_or_default();
+            let msg = p.downcast_ref::<&str>().map(|s| s.to_string()).or_else(|| p.downcast_ref::<String>().cloned()).unwrap_or_default();
            Err(fail(step, kind, format!("panicked: {msg}")))
        }
    }
@@ -3,7 +3,7 @@

 use gridcraft_core::{CellError, MAX_COLS, MAX_ROWS, RangeRef};

-use crate::ast::{Anchor, Expr, RefKind, Reference, SheetSel, clamp_anchor};
+use crate::ast::*;

 /// Copy/fill: relative parts move by `(dr, dc)`. References pushed off the sheet become `#REF!`.
 pub fn shift_relative(e: Expr, dr: i64, dc: i64) -> Expr {
@@ -5,7 +5,7 @@ use std::sync::Arc;
 use gridcraft_core::addr::{letters_to_col, parse_a1_prefix};
 use gridcraft_core::{CellError, MAX_ROWS};

-use crate::ast::{Anchor, BinOp, Expr, RefKind, Reference, SheetSel, StructItem, StructRef, TrimMode, UnOp};
+use crate::ast::*;
 use crate::lexer::{Tok, Token, tokenize_locale};

 #[derive(Clone, Debug, PartialEq, thiserror::Error)]
@@ -4,7 +4,7 @@ use std::fmt::Write;

 use gridcraft_core::{CellRef, col_to_letters, number_to_text};

-use crate::ast::{Anchor, BinOp, Expr, RefKind, Reference, SheetSel, StructItem, StructRef, UnOp};
+use crate::ast::*;

 pub use gridcraft_core::{quote_sheet, sheet_needs_quotes as needs_quotes};

@@ -123,60 +123,6 @@ impl Criterion {
        Criterion { op, operand, bare_empty: false }
    }

-    fn matches_blank(&self, v: &Value) -> bool {
-        let blank = matches!(v, Value::Empty);
-        match self.op {
-            Op::Eq => blank,
-            Op::Ne => !blank,
-            // "<" / ">" with nothing: Excel compares against "" for text cells, but an
-            // empty string never matches ("<=" and ">=" count it in neither).
-            _ => match v {
-                Value::Text(t) if !t.is_empty() => cmp_op(self.op, compare_text(t, "")),
-                _ => false,
-            },
-        }
-    }
-
-    fn matches_number(&self, v: &Value, n: f64) -> bool {
-        let cell = match v {
-            Value::Number(x) => Some(*x),
-            // Numeric text matches only for equality (COUNTIF("1") counts text "1").
-            Value::Text(t) if matches!(self.op, Op::Eq | Op::Ne) => parse_number_text(t),
-            _ => None,
-        };
-        match cell {
-            Some(x) => cmp_op(self.op, compare_numbers(x, n)),
-            None => self.op == Op::Ne,
-        }
-    }
-
-    fn matches_text(&self, v: &Value, pat: &str) -> bool {
-        match self.op {
-            Op::Eq | Op::Ne => {
-                // Blank cells hold no text: `"*"` skips them and `"<>*"` counts them.
-                let cell_text = match v {
-                    Value::Text(t) => Some(t.to_string()),
-                    _ => None,
-                };
-                let m = cell_text.is_some_and(|t| wildcard_match(pat, &t));
-                if self.op == Op::Eq { m } else { !m }
-            }
-            _ => match v {
-                Value::Text(t) => cmp_op(self.op, compare_text(t, pat)),
-                _ => false,
-            },
-        }
-    }
-
-    fn matches_cut_text(&self, v: &Value, kept: &str) -> bool {
-        match self.op {
-            Op::Eq => false,
-            Op::Ne => true,
-            Op::Lt | Op::Le => matches!(v, Value::Text(t) if compare_text(t, kept) != Ordering::Greater),
-            Op::Gt | Op::Ge => matches!(v, Value::Text(t) if compare_text(t, kept) == Ordering::Greater),
-        }
-    }
-
    /// Whether a cell value satisfies the criterion.
    pub(crate) fn matches(&self, v: &Value) -> bool {
        let v = match v {
@@ -187,8 +133,31 @@ impl Criterion {
            return matches!(&v, Value::Empty) || matches!(&v, Value::Text(t) if t.is_empty());
        }
        match &self.operand {
-            Operand::Blank => self.matches_blank(&v),
-            Operand::Number(n) => self.matches_number(&v, *n),
+            Operand::Blank => {
+                let blank = matches!(v, Value::Empty);
+                match self.op {
+                    Op::Eq => blank,
+                    Op::Ne => !blank,
+                    // "<" / ">" with nothing: Excel compares against "" for text cells, but an
+                    // empty string never matches ("<=" and ">=" count it in neither).
+                    _ => match &v {
+                        Value::Text(t) if !t.is_empty() => cmp_op(self.op, compare_text(t, "")),
+                        _ => false,
+                    },
+                }
+            }
+            Operand::Number(n) => {
+                let cell = match &v {
+                    Value::Number(x) => Some(*x),
+                    // Numeric text matches only for equality (COUNTIF("1") counts text "1").
+                    Value::Text(t) if matches!(self.op, Op::Eq | Op::Ne) => parse_number_text(t),
+                    _ => None,
+                };
+                match cell {
+                    Some(x) => cmp_op(self.op, compare_numbers(x, *n)),
+                    None => self.op == Op::Ne,
+                }
+            }
            Operand::Bool(b) => match &v {
                Value::Bool(x) => cmp_op(self.op, x.cmp(b)),
                _ => self.op == Op::Ne,
@@ -197,8 +166,27 @@ impl Criterion {
                Value::Error(x) => cmp_op(self.op, x.code().cmp(&e.code())),
                _ => self.op == Op::Ne,
            },
-            Operand::Text(pat) => self.matches_text(&v, pat),
-            Operand::CutText(kept) => self.matches_cut_text(&v, kept),
+            Operand::Text(pat) => match self.op {
+                Op::Eq | Op::Ne => {
+                    // Blank cells hold no text: `"*"` skips them and `"<>*"` counts them.
+                    let cell_text = match &v {
+                        Value::Text(t) => Some(t.to_string()),
+                        _ => None,
+                    };
+                    let m = cell_text.is_some_and(|t| wildcard_match(pat, &t));
+                    if self.op == Op::Eq { m } else { !m }
+                }
+                _ => match &v {
+                    Value::Text(t) => cmp_op(self.op, compare_text(t, pat)),
+                    _ => false,
+                },
+            },
+            Operand::CutText(kept) => match self.op {
+                Op::Eq => false,
+                Op::Ne => true,
+                Op::Lt | Op::Le => matches!(&v, Value::Text(t) if compare_text(t, kept) != Ordering::Greater),
+                Op::Gt | Op::Ge => matches!(&v, Value::Text(t) if compare_text(t, kept) == Ordering::Greater),
+            },
        }
    }
 }
@@ -276,15 +264,27 @@ pub(crate) fn has_wildcards(pattern: &str) -> bool {
 pub(crate) fn wildcard_match(pattern: &str, text: &str) -> bool {
    let p = tokenize(pattern);
    let t = lower_chars(text);
-    match_from(&p, &t, true).is_some()
+    let mut budget = MAX_STEPS;
+    match_from(&p, &t, true, &mut budget).is_some()
 }

+/// Steps one `match_from` call may take. An honest match against Excel's 32,767-character
+/// cell ceiling costs a few hundred thousand; a hostile one (star churn) is capped instead
+/// of quadratic — a call that spends more gives up and reports no match, quiet degradation
+/// like the other work caps on far-past-realistic input.
+const MAX_STEPS: u64 = 1 << 26;
+
 /// Greedy-free matcher: returns the matched length of `t` when `p` matches a prefix of `t`
-/// (or all of `t` when `whole`). Iterative with backtracking on the last star (linear-ish).
-fn match_from(p: &[Tok], t: &[char], whole: bool) -> Option<usize> {
+/// (or all of `t` when `whole`). Iterative with backtracking on the last star (linear-ish,
+/// quadratic at worst). `(budget, whole)`: the budget is spent one per loop step; a call that
+/// would spend more than it has gives up and reports no match — quiet degradation, as with the
+/// other work caps on far-past-realistic input (an honest match against Excel's 32,767-char
+/// cell ceiling costs a few hundred thousand steps).
+fn match_from(p: &[Tok], t: &[char], whole: bool, budget: &mut u64) -> Option<usize> {
    let (mut pi, mut ti) = (0usize, 0usize);
    let mut star: Option<(usize, usize)> = None;
    loop {
+        *budget = budget.checked_sub(1)?;
        if pi == p.len() && (!whole || ti == t.len()) {
            return Some(ti);
        }
@@ -319,10 +319,32 @@ fn match_from(p: &[Tok], t: &[char], whole: bool) -> Option<usize> {
 pub(crate) fn wildcard_find(pattern: &str, text: &str, start: usize) -> Option<usize> {
    let p = tokenize(pattern);
    let t = lower_chars(text);
+    // A leading run of stars never matters for a prefix match (it consumes nothing), so
+    // dropping it lets the anchor below skip linearly through the text (#2382).
+    let skip = p.iter().take_while(|tk| matches!(tk, Tok::Star)).count();
+    let p = &p[skip.min(p.len())..];
    if p.is_empty() {
        return if start <= t.len() { Some(start) } else { None };
    }
-    (start..t.len()).find(|&i| t.get(i..).is_some_and(|rest| match_from(&p, rest, false).is_some()))
+    // The first token that consumes a character anchors the scan: a literal skips straight
+    // to its occurrences, and after leading `?`s each attempt only pays for the `?` run and
+    // one suffix try. Every attempt shares one budget, so the total work stays flat.
+    let anys = p.iter().take_while(|tk| matches!(tk, Tok::Any)).count();
+    let anchor = p.get(anys);
+    let mut budget = MAX_STEPS;
+    let mut i = start;
+    while i < t.len() {
+        let hit = match (anchor, t.get(i + anys)) {
+            (Some(Tok::Char(c)), Some(rest)) => *rest == *c && match_from(p, &t[i..], false, &mut budget).is_some(),
+            (Some(Tok::Char(_)), None) => break, // the anchor char no longer exists ahead
+            _ => match_from(p, &t[i..], false, &mut budget).is_some(),
+        };
+        if hit {
+            return Some(i);
+        }
+        i += 1;
+    }
+    None
 }

 /// Exact-or-wildcard equality used by MATCH/VLOOKUP/XLOOKUP exact modes: text with wildcards
@@ -742,7 +742,7 @@ fn im_binary(a: &[Arg], f: fn(Cx, Cx) -> R<Cx>) -> R<Value> {
    fmt_complex(f(x, y)?, s.unwrap_or('i'))
 }
 fn imdiv(a: &[Arg], _c: &mut dyn Ctx) -> R<Value> {
-    im_binary(a, Cx::div)
+    im_binary(a, |x, y| x.div(y))
 }
 fn imsub(a: &[Arg], _c: &mut dyn Ctx) -> R<Value> {
    im_binary(a, |x, y| Ok(x.sub(y)))
@@ -278,7 +278,7 @@ fn aggregate(kind: Aggregate, xs: &mut [f64]) -> Option<f64> {
        Aggregate::Max => xs.iter().copied().reduce(f64::max),
        Aggregate::Min => xs.iter().copied().reduce(f64::min),
        Aggregate::Median => {
-            xs.sort_by(f64::total_cmp);
+            xs.sort_by(|a, b| a.total_cmp(b));
            let k = xs.len() / 2;
            let hi = xs.get(k).copied()?;
            if xs.len() % 2 == 1 { Some(hi) } else { Some((xs.get(k.checked_sub(1)?).copied()? + hi) / 2.0) }
@@ -415,7 +415,7 @@ impl Timeline {
            return None;
        }
        let mut sorted = times.to_vec();
-        sorted.sort_by(f64::total_cmp);
+        sorted.sort_by(|a, b| a.total_cmp(b));
        sorted.dedup();
        let axis = detect_axis(&sorted, sys).ok()?;
        let last = axis.position(*sorted.last()?)?.round();
@@ -201,7 +201,7 @@ impl FnSpec {
 pub(crate) const VAR: usize = usize::MAX;

 fn registry() -> &'static (Vec<FnSpec>, HashMap<&'static str, usize>) {
-    static REG: OnceLock<(Vec<FnSpec>, HashMap<&str, usize>)> = OnceLock::new();
+    static REG: OnceLock<(Vec<FnSpec>, HashMap<&'static str, usize>)> = OnceLock::new();
    REG.get_or_init(|| {
        let mut v: Vec<FnSpec> = Vec::new();
        for list in [
@@ -43,7 +43,7 @@ fn var_p(x: &[f64]) -> R<f64> {
 }

 fn sorted(mut v: Vec<f64>) -> Vec<f64> {
-    v.sort_by(f64::total_cmp);
+    v.sort_by(|a, b| a.total_cmp(b));
    v
 }

@@ -523,7 +523,7 @@ fn find_matches(text: &[char], delims: &[Vec<char>], insensitive: bool, from_end
        let mut j = t.len();
        while j > 0 {
            let best =
-                ds.iter().filter(|d| j.checked_sub(d.len()).and_then(|st| t.get(st..j)).is_some_and(|w| w == d.as_slice())).map(Vec::len).max();
+                ds.iter().filter(|d| j.checked_sub(d.len()).and_then(|st| t.get(st..j)).is_some_and(|w| w == d.as_slice())).map(|d| d.len()).max();
            match best {
                Some(l) => {
                    out.push((j - l, j));
@@ -537,7 +537,7 @@ fn find_matches(text: &[char], delims: &[Vec<char>], insensitive: bool, from_end
    }
    let mut i = 0;
    while i < t.len() {
-        let best = ds.iter().filter(|d| t.get(i..i + d.len()).is_some_and(|w| w == d.as_slice())).map(Vec::len).max();
+        let best = ds.iter().filter(|d| t.get(i..i + d.len()).is_some_and(|w| w == d.as_slice())).map(|d| d.len()).max();
        match best {
            Some(l) => {
                out.push((i, i + l));
@@ -588,7 +588,7 @@ fn textafter(a: &[Arg], _c: &mut dyn Ctx) -> R<Value> {
 }

 fn split_by(s: &[char], delims: &[Vec<char>], insensitive: bool) -> Vec<Vec<char>> {
-    if delims.iter().all(Vec::is_empty) {
+    if delims.iter().all(|d| d.is_empty()) {
        return vec![s.to_vec()];
    }
    let mut out = Vec::new();
@@ -748,9 +748,9 @@ fn convert_replacement(r: &str) -> String {
    let mut i = 0;
    while i < c.len() {
        let ch = c[i];
-        if ch == '$' && c.get(i + 1).is_some_and(char::is_ascii_digit) {
+        if ch == '$' && c.get(i + 1).is_some_and(|d| d.is_ascii_digit()) {
            let mut j = i + 1;
-            while c.get(j).is_some_and(char::is_ascii_digit) {
+            while c.get(j).is_some_and(|d| d.is_ascii_digit()) {
                j += 1;
            }
            out.push_str("${");
@@ -7,10 +7,7 @@ use gridcraft_core::{CellRef, RangeRef, Value};
 use serde::{Deserialize, Serialize};

 use crate::cell::{Cell, CellPicture};
-use crate::features::{
-    AutoFilter, Chart, Comment, CondFormat, Hyperlink, Image, LineInfo, PivotTable, PrintSettings, Shape, SheetProtection, Slicer, Sparkline, Table,
-    Validation,
-};
+use crate::features::*;
 use crate::store::CellStore;
 use crate::style::{Color, StyleId};

@@ -616,11 +613,8 @@ mod tests {

 // CellRef is a struct, so encode the sparse map as entries for JSON as well as other formats.
 mod picture_map {
-    use crate::cell::CellPicture;
-    use gridcraft_core::CellRef;
-    use serde::{Deserialize, Deserializer, Serialize, Serializer};
-    use std::collections::BTreeMap;
-    use std::sync::Arc;
+    use super::*;
+    use serde::{Deserializer, Serializer};
    pub fn serialize<S: Serializer>(map: &BTreeMap<CellRef, Arc<CellPicture>>, serializer: S) -> Result<S::Ok, S::Error> {
        map.iter().collect::<Vec<_>>().serialize(serializer)
    }
@@ -525,7 +525,7 @@ fn render_fraction(sec: &Section, x: f64, pieces: &mut [String], lits: &mut [Opt
            let s = if k + 1 == count {
                dc.get(k..).map(|r| r.iter().collect::<String>()).unwrap_or_default()
            } else {
-                dc.get(k).map(ToString::to_string).unwrap_or_default()
+                dc.get(k).map(|c| c.to_string()).unwrap_or_default()
            };
            let s = if s.is_empty() {
                match toks.get(ti) {
@@ -99,8 +99,8 @@ pub(crate) fn fold(c: char) -> Option<char> {
        'ž' => 'z',
        'Œ' => 'W',
        'œ' => 'm',
-        '‘'..='‚' => '\'',
-        '“'..='„' => '"',
+        '‘' | '’' | '‚' => '\'',
+        '“' | '”' | '„' => '"',
        '–' | '€' | '£' | '¥' | '¢' | '¤' => '0',
        '\u{a0}' => ' ',
        '·' | '•' => '.',
@@ -352,8 +352,8 @@ fn new_tiles(app: &mut SheetApp, ui: &mut Ui, out: &mut Outcome) {
 /// File name and folder of a recent path, split as text.
 fn split_path(path: &str) -> (String, String) {
    let p = std::path::Path::new(path);
-    let name = p.file_name().and_then(std::ffi::OsStr::to_str).unwrap_or(path).to_string();
-    let folder = p.parent().and_then(std::ffi::OsStr::to_str).unwrap_or("").to_string();
+    let name = p.file_name().and_then(|n| n.to_str()).unwrap_or(path).to_string();
+    let folder = p.parent().and_then(|f| f.to_str()).unwrap_or("").to_string();
    (name, folder)
 }

@@ -888,7 +888,7 @@ pub fn export_as(app: &mut SheetApp, fmt: &str) -> bool {
        _ => return false,
    };
    let title = app.session.active().map(|d| d.display_title()).unwrap_or_else(|| "Book1".into());
-    let stem = std::path::Path::new(&title).file_stem().and_then(std::ffi::OsStr::to_str).unwrap_or("Book1").to_string();
+    let stem = std::path::Path::new(&title).file_stem().and_then(|s| s.to_str()).unwrap_or("Book1").to_string();
    if let Some(pick) = &app.services.pick_save {
        let Some(path) = pick(&format!("{stem}.{fmt}")) else { return false };
        // The picker may suggest a workbook extension; the export writes the chosen format.
@@ -343,7 +343,7 @@ impl Dialog {
                // The file rides along in the values (`path` on the desktop, `name` and `base64`
                // on the web) and goes back to `file.open` with the password.
                let source = p("path").as_str().or(p("name").as_str()).map(str::to_string).unwrap_or_default();
-                let file = std::path::Path::new(&source).file_name().and_then(std::ffi::OsStr::to_str).unwrap_or("This workbook").to_string();
+                let file = std::path::Path::new(&source).file_name().and_then(|n| n.to_str()).unwrap_or("This workbook").to_string();
                // An empty password from the start, so OK on the untouched field says "incorrect"
                // rather than asking for the password again.
                let mut values = params.clone();
@@ -1336,7 +1336,7 @@ pub fn show(app: &mut SheetApp, ctx: &egui::Context) {
                            && let Some(path) = pick()
                        {
                            d.values.remove("base64");
-                            let alt = std::path::Path::new(&path).file_name().and_then(std::ffi::OsStr::to_str).unwrap_or("");
+                            let alt = std::path::Path::new(&path).file_name().and_then(|name| name.to_str()).unwrap_or("");
                            d.values.insert("alt".into(), json!(alt));
                            d.values.insert("path".into(), json!(path));
                        }
@@ -78,7 +78,7 @@ pub fn system_font_dirs() -> Vec<PathBuf> {
 /// Weight implied by a style name (`"Bold"` → 700, `"Light"` → 300).
 #[cfg(not(target_arch = "wasm32"))]
 fn style_weight(style: &str) -> f32 {
-    let s: String = style.chars().filter(|c| c.is_alphanumeric()).flat_map(char::to_lowercase).collect();
+    let s: String = style.chars().filter(|c| c.is_alphanumeric()).flat_map(|c| c.to_lowercase()).collect();
    const TABLE: &[(&str, f32)] = &[
        ("hairline", 100.0),
        ("thin", 100.0),
@@ -107,7 +107,7 @@ impl Face {
 /// Whether a style name reads as italic or oblique.
 #[cfg(not(target_arch = "wasm32"))]
 fn style_italic(style: &str) -> bool {
-    let s: String = style.chars().filter(|c| c.is_alphanumeric()).flat_map(char::to_lowercase).collect();
+    let s: String = style.chars().filter(|c| c.is_alphanumeric()).flat_map(|c| c.to_lowercase()).collect();
    s.contains("italic") || s.contains("oblique")
 }

@@ -165,10 +165,8 @@ pub fn scan_dirs(dirs: &[PathBuf]) -> Vec<Face> {
                stack.push(path);
                continue;
            }
-            let is_font = path
-                .extension()
-                .and_then(std::ffi::OsStr::to_str)
-                .is_some_and(|e| matches!(e.to_ascii_lowercase().as_str(), "ttf" | "otf" | "ttc" | "otc"));
+            let is_font =
+                path.extension().and_then(|e| e.to_str()).is_some_and(|e| matches!(e.to_ascii_lowercase().as_str(), "ttf" | "otf" | "ttc" | "otc"));
            if !is_font || std::fs::metadata(&path).map(|m| m.len() > MAX_FONT_FILE).unwrap_or(true) {
                continue;
            }
@@ -368,12 +366,12 @@ fn bound() -> &'static std::sync::RwLock<HashSet<String>> {

 /// Record the role families a freshly built [`egui::FontDefinitions`] bound.
 pub fn set_bound(keys: impl IntoIterator<Item = String>) {
-    *bound().write().unwrap_or_else(std::sync::PoisonError::into_inner) = keys.into_iter().collect();
+    *bound().write().unwrap_or_else(|e| e.into_inner()) = keys.into_iter().collect();
 }

 /// Is this exact role family bound to font data?
 pub fn is_bound(role: &str) -> bool {
-    bound().read().unwrap_or_else(std::sync::PoisonError::into_inner).contains(role)
+    bound().read().unwrap_or_else(|e| e.into_inner()).contains(role)
 }

 /// Serializes tests that mutate the process-wide bound-family registry.
@@ -2184,8 +2184,9 @@ fn interact(app: &mut SheetApp, ui: &mut egui::Ui, resp: &egui::Response, geo: &
                }
            }
            return;
+        } else {
+            app.selected_chart = None;
        }
-        app.selected_chart = None;
    }
    // A right-click on a chart, picture, shape or slicer opens the object's menu, not the cell's
    // under it; a right press that wobbles into a drag counts too (#2067).
@@ -566,7 +566,7 @@ impl SheetApp {
            return;
        }
        let title = self.session.active().map(|d| d.display_title()).unwrap_or_else(|| "Book1".into());
-        let stem = std::path::Path::new(&title).file_stem().and_then(std::ffi::OsStr::to_str).unwrap_or("Book1").to_string();
+        let stem = std::path::Path::new(&title).file_stem().and_then(|s| s.to_str()).unwrap_or("Book1").to_string();
        let Some(pick) = &self.services.pick_save else { return };
        let Some(path) = pick(&format!("{stem}.pdf")) else { return };
        // The picker may suggest a workbook extension; the export writes a PDF.
@@ -261,7 +261,7 @@ fn try_load(paths: &[(&str, u32)]) -> Option<FontData> {
 /// looked for again next time.
 #[cfg(not(target_arch = "wasm32"))]
 fn font_file(path: &str, index: u32) -> Option<&'static [u8]> {
-    static FILES: std::sync::Mutex<std::collections::BTreeMap<String, &[u8]>> = std::sync::Mutex::new(std::collections::BTreeMap::new());
+    static FILES: std::sync::Mutex<std::collections::BTreeMap<String, &'static [u8]>> = std::sync::Mutex::new(std::collections::BTreeMap::new());
    let mut files = FILES.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
    if let Some(&bytes) = files.get(path) {
        return font_parses(bytes, index).then_some(bytes);
@@ -630,13 +630,12 @@ fn cjk_han_japanese() -> Vec<(String, u32)> {
 fn cjk_han_simplified() -> Vec<(String, u32)> {
    let mac = "/System/Library/Fonts";
    let win = std::env::var("WINDIR").map(|w| format!("{w}\\Fonts")).unwrap_or_else(|_| "C:\\Windows\\Fonts".into());
-    let mut v: Vec<(String, u32)> = vec![
-        (format!("{win}\\msyh.ttc"), 0),            // Microsoft YaHei
-        (format!("{win}\\simsun.ttc"), 0),          // SimSun
-        (format!("{win}\\simhei.ttf"), 0),          // SimHei
-        (format!("{mac}/Hiragino Sans GB.ttc"), 0), // ships on every recent macOS
-        (format!("{mac}/PingFang.ttc"), 0),         // older macOS only; now a downloadable asset
-    ];
+    let mut v: Vec<(String, u32)> = Vec::new();
+    v.push((format!("{win}\\msyh.ttc"), 0)); // Microsoft YaHei
+    v.push((format!("{win}\\simsun.ttc"), 0)); // SimSun
+    v.push((format!("{win}\\simhei.ttf"), 0)); // SimHei
+    v.push((format!("{mac}/Hiragino Sans GB.ttc"), 0)); // ships on every recent macOS
+    v.push((format!("{mac}/PingFang.ttc"), 0)); // older macOS only; now a downloadable asset
    for d in LINUX_CJK_DIRS {
        v.push((format!("{d}/NotoSansCJKsc-Regular.otf"), 0));
        v.push((format!("{d}/NotoSansCJK-Regular.ttc"), 2)); // SC face
@@ -679,13 +678,12 @@ fn thai() -> Vec<(String, u32)> {
        "/usr/share/fonts",
        "/usr/share/fonts/chromeos/noto", // ChromeOS's Linux container (#1762)
    ];
-    let mut v: Vec<(String, u32)> = vec![
-        (format!("{win}\\LeelawUI.ttf"), 0), // Leelawadee UI
-        (format!("{win}\\tahoma.ttf"), 0),   // Tahoma
-        (format!("{win}\\micross.ttf"), 0),  // Microsoft Sans Serif
-        (format!("{mac_sup}/Thonburi.ttc"), 0),
-        (format!("{mac_sys}/SukhumvitSet.ttc"), 0),
-    ];
+    let mut v: Vec<(String, u32)> = Vec::new();
+    v.push((format!("{win}\\LeelawUI.ttf"), 0)); // Leelawadee UI
+    v.push((format!("{win}\\tahoma.ttf"), 0)); // Tahoma
+    v.push((format!("{win}\\micross.ttf"), 0)); // Microsoft Sans Serif
+    v.push((format!("{mac_sup}/Thonburi.ttc"), 0));
+    v.push((format!("{mac_sys}/SukhumvitSet.ttc"), 0));
    for d in lin {
        v.push((format!("{d}/NotoSansThai-Regular.ttf"), 0));
        v.push((format!("{d}/tlwg/Garuda.ttf"), 0));
@@ -703,12 +701,11 @@ fn lao() -> Vec<(String, u32)> {
    let mac_sup = "/System/Library/Fonts/Supplemental";
    let win = std::env::var("WINDIR").map(|w| format!("{w}\\Fonts")).unwrap_or_else(|_| "C:\\Windows\\Fonts".into());
    let lin = ["/usr/share/fonts/truetype/noto", "/usr/share/fonts/opentype/noto", "/usr/share/fonts/truetype", "/usr/share/fonts"];
-    let mut v: Vec<(String, u32)> = vec![
-        (format!("{win}\\LeelawUI.ttf"), 0), // Leelawadee UI
-        (format!("{win}\\dokchamp.ttf"), 0), // DokChampa
-        (format!("{mac_sup}/Lao Sangam MN.ttf"), 0),
-        (format!("{mac_sup}/Lao MN.ttc"), 0),
-    ];
+    let mut v: Vec<(String, u32)> = Vec::new();
+    v.push((format!("{win}\\LeelawUI.ttf"), 0)); // Leelawadee UI
+    v.push((format!("{win}\\dokchamp.ttf"), 0)); // DokChampa
+    v.push((format!("{mac_sup}/Lao Sangam MN.ttf"), 0));
+    v.push((format!("{mac_sup}/Lao MN.ttc"), 0));
    for d in lin {
        v.push((format!("{d}/NotoSansLao-Regular.ttf"), 0));
        v.push((format!("{d}/lao/Phetsarath_OT.ttf"), 0));
@@ -731,17 +728,16 @@ fn hebrew() -> Vec<(String, u32)> {
        "/usr/share/fonts",
        "/usr/share/fonts/chromeos/noto", // ChromeOS's Linux container (#1762)
    ];
-    let mut v: Vec<(String, u32)> = vec![
-        (format!("{win}\\david.ttf"), 0),      // David
-        (format!("{win}\\frank.ttf"), 0),      // FrankRuehl
-        (format!("{win}\\tahoma.ttf"), 0),     // Tahoma
-        (format!("{mac_sys}/ArialHB.ttc"), 0), // Arial Hebrew
-        (format!("{mac_sys}/SFHebrew.ttf"), 0),
-        (format!("{mac_sup}/Arial Hebrew.ttf"), 0),
-        (format!("{mac_sup}/David.ttf"), 0),
-        (format!("{mac_sys}/LucidaGrande.ttc"), 0),
-        (format!("{mac_sys}/Lucida Grande.ttc"), 0),
-    ];
+    let mut v: Vec<(String, u32)> = Vec::new();
+    v.push((format!("{win}\\david.ttf"), 0)); // David
+    v.push((format!("{win}\\frank.ttf"), 0)); // FrankRuehl
+    v.push((format!("{win}\\tahoma.ttf"), 0)); // Tahoma
+    v.push((format!("{mac_sys}/ArialHB.ttc"), 0)); // Arial Hebrew
+    v.push((format!("{mac_sys}/SFHebrew.ttf"), 0));
+    v.push((format!("{mac_sup}/Arial Hebrew.ttf"), 0));
+    v.push((format!("{mac_sup}/David.ttf"), 0));
+    v.push((format!("{mac_sys}/LucidaGrande.ttc"), 0));
+    v.push((format!("{mac_sys}/Lucida Grande.ttc"), 0));
    for d in lin {
        v.push((format!("{d}/NotoSansHebrew-Regular.ttf"), 0));
        v.push((format!("{d}/dejavu/DejaVuSans.ttf"), 0));
@@ -1,13 +1,7 @@
 //! The open, solid polylines the model can represent as editable ink. This is DrawingML
 //! geometry, not Office InkML. Unsupported geometry keeps the existing shape-import fallback.

-use std::fmt::Write as _;
-
-use gridcraft_model::{Anchor, Color, Shape, ShapeKind, Theme};
-
-use super::xfrm;
-use crate::tables::EMU_PER_PX;
-use crate::xml::El;
+use super::*;

 const MAX_POINTS: usize = 20_000;
 const MAX_COORD: f64 = 1e7;
@@ -30,7 +24,9 @@ fn one<'a>(e: &'a El, name: &str) -> Option<&'a El> {
    found.next().is_none().then_some(first)
 }

-fn validate_shape_obj(obj: &El) -> Option<&El> {
+/// Do not partially import a path: losing a curve, subpath, transform or line effect changes
+/// the drawing. Accept only the explicit subset emitted below, including its line styling.
+pub(super) fn read(obj: &El, anchor: Anchor) -> Option<Shape> {
    if obj.name != "sp"
        || !only_children(obj, &["nvSpPr", "spPr"])
        || !only_attrs(obj, &["macro", "textlink"])
@@ -47,10 +43,6 @@ fn validate_shape_obj(obj: &El) -> Option<&El> {
    if !no_fill.attrs.is_empty() || !no_fill.children.is_empty() {
        return None;
    }
-    Some(sp)
-}
-
-fn validate_xfrm(sp: &El, anchor: &Anchor) -> Option<()> {
    let xf = one(sp, "xfrm")?;
    if !xf.attrs.is_empty() || !only_children(xf, &["off", "ext"]) {
        return None;
@@ -70,10 +62,6 @@ fn validate_xfrm(sp: &El, anchor: &Anchor) -> Option<()> {
    if !same_extent(ew, anchor.width) || !same_extent(eh, anchor.height) {
        return None;
    }
-    Some(())
-}
-
-fn validate_cust_geom(sp: &El) -> Option<(&El, i64, i64)> {
    let geom = one(sp, "custGeom")?;
    if !geom.attrs.is_empty() || !only_children(geom, &["avLst", "gdLst", "ahLst", "cxnLst", "rect", "pathLst"]) {
        return None;
@@ -102,10 +90,6 @@ fn validate_cust_geom(sp: &El) -> Option<(&El, i64, i64)> {
    {
        return None;
    }
-    Some((path, w, h))
-}
-
-fn validate_line(sp: &El) -> Option<(i64, Color)> {
    let ln = one(sp, "ln")?;
    if !only_attrs(ln, &["w", "cap", "cmpd", "algn"])
        || ln.attr("cap") != Some("flat")
@@ -145,10 +129,6 @@ fn validate_line(sp: &El) -> Option<(i64, Color)> {
        }
    }
    let line = Color::from_hex(color.attr("val")?)?;
-    Some((width, line))
-}
-
-fn parse_points(path: &El, anchor: &Anchor, w: i64, h: i64) -> Option<String> {
    let mut text = String::new();
    for (i, command) in path.children.iter().enumerate() {
        if command.name != if i == 0 { "moveTo" } else { "lnTo" } || !command.attrs.is_empty() || command.children.len() != 1 {
@@ -168,17 +148,6 @@ fn parse_points(path: &El, anchor: &Anchor, w: i64, h: i64) -> Option<String> {
        }
        let _ = write!(text, "{},{}", x as f32, y as f32);
    }
-    Some(text)
-}
-
-/// Do not partially import a path: losing a curve, subpath, transform or line effect changes
-/// the drawing. Accept only the explicit subset emitted below, including its line styling.
-pub(super) fn read(obj: &El, anchor: Anchor) -> Option<Shape> {
-    let sp = validate_shape_obj(obj)?;
-    validate_xfrm(sp, &anchor)?;
-    let (path, w, h) = validate_cust_geom(sp)?;
-    let (width, line) = validate_line(sp)?;
-    let text = parse_points(path, &anchor, w, h)?;
    Some(Shape { id: 0, kind: ShapeKind::Ink, anchor, fill: Color::Rgb((width as u32) << 16), line, text, format: Default::default() })
 }

@@ -110,7 +110,7 @@ pub enum XlsxKind {
 impl XlsxKind {
    /// The kind a file name's extension asks for; anything else is a plain workbook.
    pub fn from_path(path: &str) -> XlsxKind {
-        let ext = std::path::Path::new(path).extension().and_then(std::ffi::OsStr::to_str).unwrap_or_default().to_ascii_lowercase();
+        let ext = std::path::Path::new(path).extension().and_then(|e| e.to_str()).unwrap_or_default().to_ascii_lowercase();
        match ext.as_str() {
            "xlsm" => XlsxKind::MacroWorkbook,
            "xltx" => XlsxKind::Template,
@@ -647,7 +647,7 @@ fn group_items(sys: DateSystem, by: PivotDateGroup, start: f64, end: f64) -> Vec
            }
        }
        PivotDateGroup::Quarters => v.extend((1..=4).map(|q| format!("Qtr{q}"))),
-        PivotDateGroup::Months => v.extend(MONTHS.iter().map(ToString::to_string)),
+        PivotDateGroup::Months => v.extend(MONTHS.iter().map(|m| m.to_string())),
        PivotDateGroup::Days | PivotDateGroup::None => {
            const DAYS: [u32; 12] = [31, 29, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];
            for (m, n) in MONTHS.iter().zip(DAYS) {
@@ -360,7 +360,7 @@ pub fn encode_xstring(s: &str) -> String {
 }

 fn looks_like_escape(chars: &[char], i: usize) -> bool {
-    chars.get(i + 1) == Some(&'x') && chars.get(i + 6) == Some(&'_') && (i + 2..i + 6).all(|k| chars.get(k).is_some_and(char::is_ascii_hexdigit))
+    chars.get(i + 1) == Some(&'x') && chars.get(i + 6) == Some(&'_') && (i + 2..i + 6).all(|k| chars.get(k).is_some_and(|c| c.is_ascii_hexdigit()))
 }

 fn escape_unit(chars: &[char], i: usize) -> Option<u32> {
@@ -20,7 +20,7 @@ const EXAMPLE_EXT: &[&str] = &["csv", "tsv", "json"];
 const ASSET_DIRS: &[&str] = &["assets/", "docs/brand/", "docs/images/"];

 fn ext(path: &str) -> String {
-    Path::new(path).extension().and_then(std::ffi::OsStr::to_str).map(str::to_ascii_lowercase).unwrap_or_default()
+    Path::new(path).extension().and_then(|e| e.to_str()).map(str::to_ascii_lowercase).unwrap_or_default()
 }

 pub fn is_asset(path: &str) -> bool {
@@ -27,8 +27,8 @@ pub fn run(root: &Path) -> Result<(), String> {
    };
    for entry in entries.flatten() {
        let path = entry.path();
-        let Some(stem) = path.file_stem().and_then(std::ffi::OsStr::to_str).map(str::to_owned) else { continue };
-        if path.extension().and_then(std::ffi::OsStr::to_str) != Some("rs") {
+        let Some(stem) = path.file_stem().and_then(|s| s.to_str()).map(str::to_owned) else { continue };
+        if path.extension().and_then(|e| e.to_str()) != Some("rs") {
            continue;
        }
        let Ok(source) = std::fs::read_to_string(&path) else { continue };
@@ -174,7 +174,7 @@ pub fn check(crates: &[Crate]) -> Vec<Violation> {
            }
        }
    }
-    out.sort_by_key(ToString::to_string);
+    out.sort_by_key(|v| v.to_string());
    out.dedup();
    out
 }